last executing test programs: 6m34.032471658s ago: executing program 0 (id=849): mkdir(&(0x7f0000000040)='./file0\x00', 0x102) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000780)='rpc_pipefs\x00', 0x1000000, 0x0) fspick(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) 6m33.90739981s ago: executing program 0 (id=850): openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000001500)=[{{0x0, 0x0, &(0x7f0000000300)=[{0x0}, {0x0}, {0x0}], 0x3}}, {{&(0x7f0000000600)=@can, 0x80, &(0x7f0000000680)=[{&(0x7f0000000580)="49a6cc7e52cf0644e1fb10e13cb6893bd19afc65f2af20dd1746a881eb4dabcaf163ce54133d2499c296320937b805f1880adf0cb1507d", 0x37}, {&(0x7f0000000a80)="190e431aa3b287c28be2f5404c8034cc87b917c381ccff6f8d431e872be3", 0x1e}], 0x2, &(0x7f0000000b40)=[@timestamping={{0x14, 0x1, 0x25, 0x101}}, @timestamping={{0x14, 0x1, 0x25, 0x7}}, @timestamping={{0x14, 0x1, 0x25, 0xc}}], 0x48}}], 0x2, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000f80)=[{{&(0x7f0000000340)={0xa, 0x4e20, 0x80000000, @empty, 0x7}, 0x1c, &(0x7f0000000f00)=[{&(0x7f0000000880)="562f2edb8e8c8229195820c788783ff270fb0f06936fe49376e5519e3fa8f998387d7011fc5d8c9f5fc8e0e1663c9f6919128a8941ae935aaba3f683642630f5a74535b0e1f886ea2807f04d3a68ff4285f2bf581674a033cb5ecf8c756e8df3968c959df5326ed67c09d8b72eceeb87023f6188e15cb258cd8c85be3eddaac311ee4cb17a08ef47157753606ce7996162ea4b18214763730e2b944b468575927829842ee7f6f8a3603a7a522025c55284c9ca0ab899626f86c9336ead2278445733db5e643e10fa93339be48ff1592bc6bcf2b68b4536951c600a0e6d1b5d5b0cdb", 0xe2}, {&(0x7f0000000540)}, {&(0x7f00000006c0)}, {0x0}, {0x0}, {0x0}], 0x6}}], 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d754", 0x7c9}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 6m33.60065817s ago: executing program 0 (id=854): sendmsg$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x30}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048fd8696e524b2934126c443ce93d82e931eb9918e6c082", 0x61}], 0x1}}], 0x1, 0x2090) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000300)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0x8000011000000009, 0x3a, 'B\xd4GGI\x82\\4\xbb\xbb\xbb\xb3\xd4)\xed\x8f\xaa\xf4\xd2{\xc5\t\xa9\xed\xf8e\xaa\xb9\xf5\r\xe3T\x0e\x8a\xd6\x9a_?G\x05\x00\x00\x00\x00\x00\x00\x00\x1e\x9a\xce\xac&x3\x15\x14y\xbf\xc6)\xa8\b/\x01\x00\x00\f\x8e1\xc4\xa1\xb2]I\xa5\x13}9\x1b0x0}) sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc142e00004788031c", 0xe, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 6m32.669842008s ago: executing program 0 (id=855): close(0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000b80)='./file0\x00', 0x1008002, &(0x7f0000000d00)={[{@grpjquota}]}, 0x3, 0x5ee, &(0x7f0000000280)="$eJzs3c1vVFUbAPDnTj9oKXk7kDcqLqSJMZAoLS1gGuMCtoY0+BE3urDSgkiBhtZo0YSS4MbEuDHGxJUL8b9QIltWunLhxpUhIWpYmjjmztxbOu1Mv2jnEu7vlwxz7zlze86lfeace+acOwGU1lD6TyVif0TMJhGDyeJSXndkmUON193/+5Mz6SOJWu31P5NIsrT89Un2PJAd3BcRP/+UxL6u1eXOLVy9MDkzM30l2x+Zvzg7Mrdw9fD5i5Pnps9NXxp7cWz8+LHj46NHtnRe11qknbrx/oeDn0289d03/ySj3/82kcSJeCV74fLz2C5DMVT/P0lWZw2Mb3dhBenK/k5qtVotT0u6i60TG5f//noi4skYjK548MsbjE9fLbRywI6qJY33bqCMEvEPJZX3A/Jr+5XXwZVCeiVAJ9w72RgAWB3/3Y2xweirjw3svp/E8mGdJCK2NjLXbE9E3Lk9cePs7YkbsUPjcEBri9cj4qlW8Z/U478afVGtx3+lKf7TfsHp7DlNf22L5a8cKhb/0DmN+O9bM/6jTfy/kz5fa8Twu1ssv/pg873+pvjv3+opAQAAAAAAQGndOhkRL7T6/L+yNP8nWsz/GYiIE9tQ/tCK/dWf/1fubkMxQAv3Tka83HL+byWf/VvtWraEtRo9ydnzM9NHIuJ/EXEoenal+6NrlHH4831ft8sbyub/5Y+0/DvZXMCsHne7dzUfMzU5P/kQpwxk7l2PeLrl/N9kqf1PWrT/6TvD7AbL2PfczdPt8taPf2Cn1L6NONiy/X9w14pk7ftzjNT7AyN5r2C1Zz7+4od25W81/t1iAh5e2v7vXjv+q8ny+/XMbb6MowvdtXZ5W+3/9yZv1O8q1JulfTQ5P39lNKI3OdWVpjalj22+zvA4yuMhj5c0/g89u/b4X6v+f39ELK742clfzWuKc0/8O/B7u/ro/0Nx0vif2lT7v/mNsZvVH9uVv7H2/1i9rT+UpRj/g4av8jDtbU5vEY7drbI6XV8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeBxUImJPJJXhpe1KZXg4YiAi/h+7KzOX5+afP3v5g0tTaV79+/8r+Tf9Djb2k/z7/6vL9sdW7B+NiL0R8WVXf31/+MzlmamiTx4AAAAAAAAAAAAAAAAAAAAeEQNt1v+n/ugqunbAjusuugJAYVrE/y9F1APoPO0/lJf4h/IS/1Be4h/KS/xDea0d/2+Pd6wiQMdp/6G8xD8AAAAAADxW9h649WsSEYsv9dcfqd4sr6fQmgE7rVJ0BYDCuMUPlJepP1BervGBZJ38vrYHrXfkWmbPPMTBAAAAAAAAAAAAAFA6B/db/w9lZf0/lJf1/1Be+fr/AwXXA+g81/hArLOSv+X6/3WPAgAAAAAAAAAAAAC209zC1QuTMzPTV2y8+WhUo5MbtVrtWvpX8KjUZ/s3kmyGekcKzafCd/5Mezdygvlav4395OLekwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgGb/BQAA//8wviV5") mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) r1 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$binfmt_register(r1, &(0x7f0000000880)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x1, 0x3a, 'usrjquota=\xb9\xc4\xd7A%S\n\x10i\xcf\x84\x93v\x02\xe4y}\xcbV\xbb\xc1\xd5\x06\v\xdc\xd8\\\xc5\xb3\ag\xa6u\xbe\xf4)\xae\xb6\xfe*\x9d?\xb2C\xf0<\xc9\x820M\x92Tzs\xba\xca\x9d\xad\x17\x1b\x84\xbc\xb3\xd8\xad\f\x17\xbe\x17\xb5}.H\x90\xc7\x0e\xb3y\xd0\xc3\xf0c\x04\xe6\fzZ\x02\xfd_W\x9a\xa7\x81\xfcr\xe9B\x95\x13\x9f\x10\'5\xc0\xf9\xb5\xe1\x15Y\x9b$\xa43\xe7F>\xb7\xa1\xb7zw\xac\xc8\x12\x94\xa7\xe5\xcb\xc0g\x865\\\x9e\xca\x8e\xe2\t\xb7\b\x00\x00\x00\x00\x00\x00\x00i7b\xad\x14oVT\xcb\xea\xd3\xad\xa9\x16\xd5\xb2\xa0 \x13^\xf6>\xd4\x8bZzl\x88\xddn\xab\xd6\x12\x1f\x06', 0x3a, '\x00\x03!\f\xee\x998r~\b\x13\x89\xae\xf1\x06hz\xcc\xd6\xbb\xb8\x19\x90\x9e\xdb\xa2F\xfa_F(\x05\b\x13\x82\x12\xad\x0f^\xdc\xf2\xb5', 0x3a, './file2', 0x3a, [0x46]}, 0x113) 6m31.74770671s ago: executing program 0 (id=860): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_TSC(0x1a, 0x1) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r3, 0x29, 0x19, 0x0, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @mcast2}, 0x1c) connect$inet6(r3, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420", 0x11, 0x8000, 0x0, 0x0) recvmmsg(r3, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) syz_mount_image$erofs(&(0x7f0000000000), &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000", @ANYRESHEX=0x0], 0x1, 0x194, &(0x7f0000000640)="$eJzsmD9P+kAYx7/X8if88ktw1UUTScDB0hY1MjgwO2ii0bhJpBK0iIEOwGZ8Ec6+AmfiwvvQQZ0cxM3Joebawx4oYuI/jM9neO57dw/Hc0+Tb5OCIIg/y831w9VZMhHj+j8SiIr1WzXIUaT8Vvxx5qK0cn6i31+22svZ/vMYANd9//+HALRzKhwxd93eXyfEuA6lq8Py/iYYNKG3oWBDaAsMW0LvSbrC8zVtt2Rb2k7FLnCh82DwYPKQ6a+vc8RQkOpj0n6t0dzP27ZV/UIxrH+dnIIlqT75eXV7owf9gwEFhtAZMKwJvYhotzd+S6T7T4SC89Vvvv/vFuPxITlhjEqpJD5BMHBxFwNGo56fEoE/uacMScmfQpJ/pJ3yYbrWaM6WyvmiVbQOTDOzoM/p+ryZ9ozIj2/4X8zzp3/S+eEBuREWQT3vOFXDj89zsx6FUzVfc9yI538KUtN+1UysyXjvgzE2xYeUChwPrJYgCIIgCIIgCIIgCIIgCOIjTIJ5X0F7yL5YMle97KcAAAD//5Z1cak=") r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x0) read$FUSE(r4, &(0x7f0000003f00)={0x2020}, 0x2020) preadv(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000640)=""/4112, 0x1010}], 0x1, 0x4000, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file3\x00', &(0x7f0000000480), 0x8000, 0x0) setreuid(0xee01, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 6m30.00206441s ago: executing program 0 (id=864): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000940)=@newlink={0x30, 0x10, 0x1, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x40938, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x68010}, 0x0) 6m29.07417454s ago: executing program 32 (id=864): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000940)=@newlink={0x30, 0x10, 0x1, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x40938, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x68010}, 0x0) 2m18.959065792s ago: executing program 2 (id=1762): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/wireless\x00') msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000040)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @dev={0xfe, 0x80, '\x00', 0x1e}}, 0x80, 0x0}, 0x5b4}], 0x1, 0x20000850) socket$inet(0xa, 0x801, 0x84) r1 = socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) sendto$packet(r1, &(0x7f0000000400)="05d936277c6f5422007f83477ca1b278e3e4018a34e7bfd3de1a00ad6762646c95c716727eb53b", 0x27, 0x40880, &(0x7f0000000200)={0x11, 0x86dd, r3, 0x1, 0x4, 0x6, @local}, 0x14) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r4, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r6, &(0x7f0000000cc0)={'syz1\x00', {0x0, 0x0, 0x0, 0xffff}, 0x3, [0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f9, 0x100, 0x0, 0x101, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x3, 0xe, 0x721a2d63, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x400, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x6], [0x0, 0x0, 0x0, 0x0, 0x63c, 0x10, 0x8, 0x7f, 0x0, 0xfffffffd, 0x6, 0x197a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x289, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0xa46, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x8000, 0x0, 0x7fff, 0x71, 0x0, 0x0, 0x0, 0xffffffff, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x3, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x5, 0x8, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x3, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0xfffffffe], [0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x1000008, 0xc7, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3, 0x0, 0x3, 0x0, 0x0, 0x689b, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7, 0x0, 0x6, 0x0, 0x0, 0x0, 0xbffffffd, 0x400, 0xffffffff, 0xfffffffc, 0x40, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x4]}, 0x45c) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x6, &(0x7f0000001300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1800}, [@ldst={0x2, 0x2, 0x1, 0x3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff}, @exit, @ldst={0x3, 0x3, 0x3, 0x3, 0x8, 0x40, 0xfffffffffffffffc}]}, &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x0, r7}, 0x94) ioctl$UI_DEV_SETUP(r6, 0x5501, 0x0) readv(r6, &(0x7f0000001900)=[{&(0x7f0000000040)=""/65, 0x41}], 0x1) preadv(r0, &(0x7f00000026c0)=[{&(0x7f0000000240)=""/4088, 0xff8}], 0x1, 0x15f, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f00000012c0)={&(0x7f0000000180), 0xc, &(0x7f0000001280)={&(0x7f0000001240)={0x28, 0x0, 0x2, 0x201, 0x0, 0x0, {0x7, 0x0, 0x9}, [@CTA_EXPECT_HELP_NAME={0x9, 0x6, 'snmp\x00'}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x800) 2m12.616279304s ago: executing program 2 (id=1767): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_setup(0x49a, 0x0, 0x0, 0x0, 0x0) eventfd2(0x7fffffff, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7fffffff], 0x0, 0x1}) 2m12.251348423s ago: executing program 2 (id=1768): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x9c}}, 0x0) 2m11.954825698s ago: executing program 5 (id=1770): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@updpolicy={0xb4, 0x19, 0x1, 0x0, 0x0, {{@in=@broadcast, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}}, 0xb4}}, 0x0) syz_emit_ethernet(0xa6, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x70, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "ffffffffff60000000000000"}]}}}}}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000380)={@val={0x0, 0x86dd}, @val={0x3, 0x0, 0xa, 0x0, 0x8d}, @mpls={[], @ipv6=@tipc_packet={0x8, 0x6, "09c2b4", 0x68, 0x6, 0xff, @private1, @mcast2, {[@dstopts={0x5e, 0x6, '\x00', [@generic={0x4, 0x2f, "1c7997d787e8513c85d2d0c48cae6c818f96c8e4784da8bf6ed4fce7126305a7a2c5ef39e2bef2ed4e6a567a6f04ca"}]}], @payload_named={{{{{0x28, 0x0, 0x0, 0x0, 0x1, 0xa, 0x2, 0x2, 0x4886, 0x0, 0x3, 0x9, 0x0, 0x2, 0x8, 0x0, 0x0, 0x4e23, 0x4e20}, 0xffffffff}, 0x2, 0x4}}}}}}}, 0x9e) 2m11.94597972s ago: executing program 2 (id=1772): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_TSC(0x1a, 0x1) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r2, 0x29, 0x19, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @mcast2}, 0x1c) connect$inet6(r2, 0x0, 0x0) sendto$inet6(r2, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420", 0x11, 0x8000, 0x0, 0x0) recvmmsg(r2, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) syz_mount_image$erofs(&(0x7f0000000000), &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000", @ANYRESHEX=0x0], 0x1, 0x194, &(0x7f0000000640)="$eJzsmD9P+kAYx7/X8if88ktw1UUTScDB0hY1MjgwO2ii0bhJpBK0iIEOwGZ8Ec6+AmfiwvvQQZ0cxM3Joebawx4oYuI/jM9neO57dw/Hc0+Tb5OCIIg/y831w9VZMhHj+j8SiIr1WzXIUaT8Vvxx5qK0cn6i31+22svZ/vMYANd9//+HALRzKhwxd93eXyfEuA6lq8Py/iYYNKG3oWBDaAsMW0LvSbrC8zVtt2Rb2k7FLnCh82DwYPKQ6a+vc8RQkOpj0n6t0dzP27ZV/UIxrH+dnIIlqT75eXV7owf9gwEFhtAZMKwJvYhotzd+S6T7T4SC89Vvvv/vFuPxITlhjEqpJD5BMHBxFwNGo56fEoE/uacMScmfQpJ/pJ3yYbrWaM6WyvmiVbQOTDOzoM/p+ryZ9ozIj2/4X8zzp3/S+eEBuREWQT3vOFXDj89zsx6FUzVfc9yI538KUtN+1UysyXjvgzE2xYeUChwPrJYgCIIgCIIgCIIgCIIgCOIjTIJ5X0F7yL5YMle97KcAAAD//5Z1cak=") r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x0) read$FUSE(r3, &(0x7f0000003f00)={0x2020}, 0x2020) preadv(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000640)=""/4112, 0x1010}], 0x1, 0x4000, 0x0) setgroups(0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file3\x00', &(0x7f0000000480), 0x8000, 0x0) setreuid(0xee01, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 2m11.263885821s ago: executing program 5 (id=1776): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd26, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x2, 0x4}, {}, {0x8, 0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x1000, 0x20000000, 0xfffffffc, 0x7ff}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4811}, 0x40884) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x32, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 2m6.711062553s ago: executing program 5 (id=1779): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) 2m5.984553099s ago: executing program 5 (id=1781): ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000100050005000700000000000800090000003f0014002000ff250100100000000000e1ffe000000108000a0000000000060002000100000014001f"], 0x5c}, 0x1, 0x6c}, 0x0) 2m5.56741771s ago: executing program 5 (id=1784): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0xe, 0x0, &(0x7f0000000000)={0x11, 0x0, r1}, 0x14) 2m4.645575407s ago: executing program 5 (id=1788): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$IMADDTIMER(0xffffffffffffffff, 0x80044940, &(0x7f0000000080)=0x14) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x40}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xe0004000}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 2m0.558948485s ago: executing program 2 (id=1792): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3380, 0x1, 0x40024e}, 0x0, 0x0, 0x0) eventfd2(0x7fffffff, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7fffffff], 0x0, 0x1}) 1m59.098413441s ago: executing program 2 (id=1794): socket$nl_netfilter(0x10, 0x3, 0xc) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = fsopen(&(0x7f0000000000)='gfs2\x00', 0x0) memfd_secret(0x80000) poll(&(0x7f0000000440)=[{r1, 0x8280}], 0x1, 0x8) fsconfig$FSCONFIG_SET_BINARY(r2, 0x2, 0x0, &(0x7f0000000200)='\t', 0x1) shmget$private(0x0, 0x400000, 0x800, &(0x7f000000e000/0x400000)=nil) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) socket$key(0xf, 0x3, 0x2) syz_usb_connect(0x2, 0x24, &(0x7f0000002040)=ANY=[@ANYBLOB], 0x0) r3 = syz_open_dev$sndctrl(0x0, 0x3, 0xbc01) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r3, 0x80dc5521, &(0x7f0000000000)=""/138) 1m49.09432804s ago: executing program 33 (id=1788): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$IMADDTIMER(0xffffffffffffffff, 0x80044940, &(0x7f0000000080)=0x14) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x40}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xe0004000}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 1m42.298801287s ago: executing program 34 (id=1794): socket$nl_netfilter(0x10, 0x3, 0xc) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = fsopen(&(0x7f0000000000)='gfs2\x00', 0x0) memfd_secret(0x80000) poll(&(0x7f0000000440)=[{r1, 0x8280}], 0x1, 0x8) fsconfig$FSCONFIG_SET_BINARY(r2, 0x2, 0x0, &(0x7f0000000200)='\t', 0x1) shmget$private(0x0, 0x400000, 0x800, &(0x7f000000e000/0x400000)=nil) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) socket$key(0xf, 0x3, 0x2) syz_usb_connect(0x2, 0x24, &(0x7f0000002040)=ANY=[@ANYBLOB], 0x0) r3 = syz_open_dev$sndctrl(0x0, 0x3, 0xbc01) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r3, 0x80dc5521, &(0x7f0000000000)=""/138) 1m29.088926783s ago: executing program 3 (id=1828): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=@newtfilter={0x6c, 0x2c, 0xd27, 0x70bd26, 0x8000007, {0x0, 0x0, 0x0, r2, {0x0, 0x6}, {}, {0x1, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x3c, 0x2, [@TCA_BASIC_EMATCHES={0x38, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x7f, 0x1, 0x8001}, {0x8, 0x6a6, 0xffff, 0x5, 0x3, 0x2}}}, @TCF_EM_CONTAINER={0x10, 0x2, 0x0, 0x0, {{0xffff, 0x0, 0x7540}, '\"'}}]}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24008004}, 0x0) 1m28.499713401s ago: executing program 3 (id=1829): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) r1 = epoll_create1(0x80000) r2 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x48) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x4, 0x7ffe, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfffffffe, 0xffffffff}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, 0x0, 0x22102, 0x0) ioctl$KVM_GET_SUPPORTED_HV_CPUID_sys(r5, 0xc008aec1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffffff"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r7 = syz_open_dev$vim2m(0x0, 0x5, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$vim2m_VIDIOC_DQBUF(r7, 0xc0585611, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) openat$ttyprintk(0xffffff9c, &(0x7f0000000200), 0x84142, 0x0) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) sendfile(r8, r9, 0x0, 0xb524) connect$inet6(r2, &(0x7f0000000140)={0xa, 0x4e60, 0x4, @remote, 0xb}, 0x1c) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x1e}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) 1m28.027403267s ago: executing program 4 (id=1831): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCMGET(r2, 0x541e, &(0x7f0000000040)) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x40000014}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) r3 = socket(0x10, 0x80002, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0xb, 0x9}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6}, {0x4}}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157) sendmmsg$alg(r3, &(0x7f00000000c0), 0x492492492492627, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo\x00') r10 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r9) sendmsg$TIPC_NL_PUBL_GET(r9, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)={0x34, r10, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x40}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x200}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) fchdir(r9) sendmmsg$unix(r8, &(0x7f0000002d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40884}}, {{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40000}}], 0x2, 0x40000004) io_uring_register$IORING_REGISTER_MEM_REGION(r9, 0x22, 0x0, 0x1) 1m24.266418796s ago: executing program 3 (id=1835): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_TSC(0x1a, 0x1) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r3, 0x29, 0x19, 0x0, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @mcast2}, 0x1c) connect$inet6(r3, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420", 0x11, 0x8000, 0x0, 0x0) recvmmsg(r3, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) syz_mount_image$erofs(&(0x7f0000000000), &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000", @ANYRESHEX=0x0], 0x1, 0x194, &(0x7f0000000640)="$eJzsmD9P+kAYx7/X8if88ktw1UUTScDB0hY1MjgwO2ii0bhJpBK0iIEOwGZ8Ec6+AmfiwvvQQZ0cxM3Joebawx4oYuI/jM9neO57dw/Hc0+Tb5OCIIg/y831w9VZMhHj+j8SiIr1WzXIUaT8Vvxx5qK0cn6i31+22svZ/vMYANd9//+HALRzKhwxd93eXyfEuA6lq8Py/iYYNKG3oWBDaAsMW0LvSbrC8zVtt2Rb2k7FLnCh82DwYPKQ6a+vc8RQkOpj0n6t0dzP27ZV/UIxrH+dnIIlqT75eXV7owf9gwEFhtAZMKwJvYhotzd+S6T7T4SC89Vvvv/vFuPxITlhjEqpJD5BMHBxFwNGo56fEoE/uacMScmfQpJ/pJ3yYbrWaM6WyvmiVbQOTDOzoM/p+ryZ9ozIj2/4X8zzp3/S+eEBuREWQT3vOFXDj89zsx6FUzVfc9yI538KUtN+1UysyXjvgzE2xYeUChwPrJYgCIIgCIIgCIIgCIIgCOIjTIJ5X0F7yL5YMle97KcAAAD//5Z1cak=") r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x0) read$FUSE(r4, &(0x7f0000003f00)={0x2020}, 0x2020) preadv(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000640)=""/4112, 0x1010}], 0x1, 0x4000, 0x0) setgroups(0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file3\x00', &(0x7f0000000480), 0x8000, 0x0) setreuid(0xee01, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 1m22.830451209s ago: executing program 4 (id=1838): socket$netlink(0x10, 0x3, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1ba20, 0x40a38}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}, @IFLA_VLAN_EGRESS_QOS={0x4}]}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_LINKMODE={0x5, 0x11, 0x1}]}, 0x50}}, 0x8000002) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) 1m21.600679885s ago: executing program 4 (id=1842): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x2b, &(0x7f0000000280)=0xfffffffe, 0x4) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000040)={0x37, 0x1, 0x200, "4749570000000000000000000e1609d600", 0x20493859}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x9, r2}) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000000)="c65a697dc193404fa0e2f58f60b4a27b59b6ba2ced2a80952f4742cd184015cfff3ea1491931aa", 0x27}], 0x1) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100153a42908f00a71729188010203010902240001060000000904020002ffffff000905"], 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) 1m21.488621265s ago: executing program 1 (id=1843): unshare(0x2040400) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x402c582b, 0x0) 1m21.267236649s ago: executing program 1 (id=1844): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$unix(0x1, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00'}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) 1m19.995798853s ago: executing program 3 (id=1845): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)=':', 0x1, 0x24044013, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x1) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000100)='^', 0xfdef}], 0x1) 1m19.840009637s ago: executing program 1 (id=1846): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @loopback, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r1, 0x7}}, 0x48) 1m19.426139918s ago: executing program 1 (id=1847): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=@newtfilter={0x6c, 0x2c, 0xd27, 0x70bd26, 0x8000007, {0x0, 0x0, 0x0, r2, {0x0, 0x6}, {}, {0x1, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x3c, 0x2, [@TCA_BASIC_EMATCHES={0x38, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x7f, 0x1, 0x8001}, {0x8, 0x6a6, 0xffff, 0x5, 0x3, 0x2}}}, @TCF_EM_CONTAINER={0x10, 0x2, 0x0, 0x0, {{0xffff, 0x0, 0x7540}, '\"'}}]}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24008004}, 0x0) 1m19.219424756s ago: executing program 1 (id=1848): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2c, r1, 0x325, 0xfffffffe, 0x0, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}, @TIPC_NLA_MON={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20004044}, 0x0) 1m19.081935053s ago: executing program 3 (id=1849): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd26, 0x25dfdc00, {0x0, 0x0, 0x0, r2, {0x2, 0x4}, {}, {0x8, 0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x1000, 0x20000000, 0xfffffffc, 0x7ff}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4811}, 0x40884) 1m18.930898729s ago: executing program 1 (id=1850): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, r1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = memfd_create(&(0x7f0000000780)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\nh<\x99\xaa\xe1\xf3\xb8Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev<\x97\x1a2_\x82\xfa\x15h$\x01\xdd\xe5\xceC\x19\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xb2\xf5\x1e5.\xc1\xa1\x05\x92\x82d\x0e\xf5PMjIt\xc5u~Tw\xbeNg\xb5\xeeP\x9c\xce\xfaS\xa7\xec0\xf4\xd2\xc2+@\x12=\xaa\b\xd2&\x19k6\xc7\xa6+\x04V\xc3\xe1\xd3\fZZ\x1cJo\xa5(& \r\xf1\xa4\xb8\xc23\x16\xc3\xaejA/', 0x0) write$binfmt_elf32(r4, &(0x7f0000000f00)=ANY=[@ANYBLOB="7f454c466000002ed8e4f97765ce27b90300060000000000000000b738000000000035f4c38422a3bc82200005"], 0x66) execveat(r4, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x40200, 0x0) ioctl$FBIOPUT_VSCREENINFO(r5, 0x4601, &(0x7f0000000100)={0x400, 0x80, 0x550, 0x40, 0x1000, 0x0, 0x20, 0x0, {0x0, 0x7ff}, {0x354, 0x2, 0x420}, {0xf4ef}, {0x0, 0x0, 0xffe}, 0x1, 0x100, 0x0, 0xd619, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4, 0x0, 0xb}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) ptrace$ARCH_GET_GS(0x1e, 0x0, &(0x7f00000003c0), 0x1004) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYRES32=r6, @ANYRES16=r8, @ANYRES16=r8, @ANYRES64=r0], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x802) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f0000000240)={&(0x7f0000000180), 0xc, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="00012dbd7000fcdbdf2501ce2e00e992fcd44f0356c55b11ae4e85000000f297c49f3ae6914cda0b3c513d0f000141000000180017000000090000010169ada181776df479300000007abb2f4f223c2e68e7ad39c8384fbfb3fa9461147cc380eaf53718e802323bc97a170b071172940be23a34acad35aff13b0042070078b402ae736151c4edb4a4f05051de4a43314e3fb6"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x4) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x45, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={0x0}}, 0x0) ioctl$SIOCSIFMTU(r10, 0x8923, &(0x7f0000000100)={'vlan0\x00', 0x40}) r11 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x1c3902, 0x0) sendfile(r11, r11, 0x0, 0x200000) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x20008000) 1m18.643956942s ago: executing program 4 (id=1851): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) fcntl$F_GET_RW_HINT(r1, 0x40f, &(0x7f0000000040)) 1m18.45880653s ago: executing program 3 (id=1852): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3fb, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x402c8c0}, 0xe0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x805f, 0x7}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x4207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031400d3fc220000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 1m18.061536573s ago: executing program 4 (id=1853): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000000, 0x0, 0xff, 0x1}, 0x20) 1m17.92118062s ago: executing program 4 (id=1854): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$unix(0x1, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00'}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) 0s ago: executing program 35 (id=1850): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, r1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = memfd_create(&(0x7f0000000780)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\nh<\x99\xaa\xe1\xf3\xb8Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev<\x97\x1a2_\x82\xfa\x15h$\x01\xdd\xe5\xceC\x19\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xb2\xf5\x1e5.\xc1\xa1\x05\x92\x82d\x0e\xf5PMjIt\xc5u~Tw\xbeNg\xb5\xeeP\x9c\xce\xfaS\xa7\xec0\xf4\xd2\xc2+@\x12=\xaa\b\xd2&\x19k6\xc7\xa6+\x04V\xc3\xe1\xd3\fZZ\x1cJo\xa5(& \r\xf1\xa4\xb8\xc23\x16\xc3\xaejA/', 0x0) write$binfmt_elf32(r4, &(0x7f0000000f00)=ANY=[@ANYBLOB="7f454c466000002ed8e4f97765ce27b90300060000000000000000b738000000000035f4c38422a3bc82200005"], 0x66) execveat(r4, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x40200, 0x0) ioctl$FBIOPUT_VSCREENINFO(r5, 0x4601, &(0x7f0000000100)={0x400, 0x80, 0x550, 0x40, 0x1000, 0x0, 0x20, 0x0, {0x0, 0x7ff}, {0x354, 0x2, 0x420}, {0xf4ef}, {0x0, 0x0, 0xffe}, 0x1, 0x100, 0x0, 0xd619, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4, 0x0, 0xb}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) ptrace$ARCH_GET_GS(0x1e, 0x0, &(0x7f00000003c0), 0x1004) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYRES32=r6, @ANYRES16=r8, @ANYRES16=r8, @ANYRES64=r0], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x802) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f0000000240)={&(0x7f0000000180), 0xc, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="00012dbd7000fcdbdf2501ce2e00e992fcd44f0356c55b11ae4e85000000f297c49f3ae6914cda0b3c513d0f000141000000180017000000090000010169ada181776df479300000007abb2f4f223c2e68e7ad39c8384fbfb3fa9461147cc380eaf53718e802323bc97a170b071172940be23a34acad35aff13b0042070078b402ae736151c4edb4a4f05051de4a43314e3fb6"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x4) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x45, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={0x0}}, 0x0) ioctl$SIOCSIFMTU(r10, 0x8923, &(0x7f0000000100)={'vlan0\x00', 0x40}) r11 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x1c3902, 0x0) sendfile(r11, r11, 0x0, 0x200000) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x20008000) kernel console output (not intermixed with test programs): ] tipc: Enabling of bearer rejected, failed to enable media [ 200.820751][ T8196] syzkaller0: entered promiscuous mode [ 200.837017][ T8196] syzkaller0: entered allmulticast mode [ 201.239259][ T8211] loop6: detected capacity change from 0 to 7 [ 202.045552][ T8221] netlink: 68 bytes leftover after parsing attributes in process `syz.2.694'. [ 202.054637][ T8221] netlink: 68 bytes leftover after parsing attributes in process `syz.2.694'. [ 202.558946][ T8211] ldm_validate_partition_table(): Disk read failed. [ 202.561881][ T8225] FĴ [ 202.561881][ T8225] ffrhHӬ|LđOw?EO~&V2_ߞA:~k\ E7Ȃxx[>|\݈e^j?/)r|k%`cw!ԟi0B&z[P}uO.SW8A'z [ 202.570164][ T8211] Dev loop6: unable to read RDB block 0 [ 202.653007][ T8211] loop6: unable to read partition table [ 202.659583][ T8211] loop6: partition table beyond EOD, truncated [ 202.670263][ T8211] loop_reread_partitions: partition scan of loop6 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 202.858239][ C1] blk_print_req_error: 27 callbacks suppressed [ 202.858258][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 202.875224][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 202.884394][ C1] buffer_io_error: 28 callbacks suppressed [ 202.884409][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 203.206230][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 203.215445][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 204.494934][ T29] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 205.127431][ T29] usb 1-1: Using ep0 maxpacket: 8 [ 205.268628][ T29] usb 1-1: unable to get BOS descriptor or descriptor too short [ 205.299489][ T29] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 205.334560][ T29] usb 1-1: can't read configurations, error -71 [ 205.914140][ T1239] libceph: connect (1)[c::]:6789 error -101 [ 205.928165][ T8266] tipc: Enabling of bearer rejected, failed to enable media [ 205.949547][ T1239] libceph: mon0 (1)[c::]:6789 connect error [ 206.103771][ T8259] ceph: No mds server is up or the cluster is laggy [ 206.841628][ T5909] libceph: connect (1)[c::]:6789 error -101 [ 207.207459][ T5909] libceph: mon0 (1)[c::]:6789 connect error [ 208.057130][ T1179] libceph: connect (1)[c::]:6789 error -101 [ 208.075238][ T1179] libceph: mon0 (1)[c::]:6789 connect error [ 208.107736][ T8287] bridge0: entered promiscuous mode [ 208.113209][ T8287] macsec1: entered promiscuous mode [ 210.047072][ T8324] fuse: Bad value for 'fd' [ 210.085162][ T29] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 210.300750][ T29] usb 5-1: Using ep0 maxpacket: 8 [ 210.614208][ T29] usb 5-1: unable to get BOS descriptor or descriptor too short [ 210.879643][ T8330] loop0: detected capacity change from 0 to 512 [ 211.026813][ T29] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 211.034508][ T29] usb 5-1: can't read configurations, error -71 [ 211.682801][ T8330] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 211.890004][ T5838] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 213.209321][ T8358] loop4: detected capacity change from 0 to 512 [ 213.267690][ T8358] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 213.462387][ T8358] EXT4-fs (loop4): 1 truncate cleaned up [ 213.485939][ T8358] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 214.950588][ T5896] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 215.033764][ T8377] loop3: detected capacity change from 0 to 2048 [ 215.400257][ T5896] usb 5-1: Using ep0 maxpacket: 16 [ 215.548928][ T5896] usb 5-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 215.597551][ T8379] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 215.740295][ T5896] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 14 [ 215.905079][ T5896] usb 5-1: New USB device found, idVendor=05ac, idProduct=027d, bcdDevice= 0.00 [ 216.096105][ T5896] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.347622][ T8377] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 216.660081][ T5846] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.682282][ T5896] usb 5-1: config 0 descriptor?? [ 216.726114][ T5896] usb 5-1: can't set config #0, error -71 [ 216.757795][ T5896] usb 5-1: USB disconnect, device number 8 [ 216.843091][ T8388] loop2: detected capacity change from 0 to 4096 [ 216.909407][ T8391] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 217.035160][ T1239] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 217.091223][ T8394] NILFS (loop2): error -2 preparing GC: cannot delete virtual blocks from DAT file [ 217.475333][ T1239] usb 1-1: Using ep0 maxpacket: 8 [ 217.654921][ T1239] usb 1-1: unable to get BOS descriptor or descriptor too short [ 217.983038][ T1239] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 218.013370][ T1239] usb 1-1: can't read configurations, error -71 [ 218.125709][ T8400] netlink: 4 bytes leftover after parsing attributes in process `syz.1.745'. [ 218.162817][ T8402] syzkaller0: entered promiscuous mode [ 218.175271][ T8402] syzkaller0: entered allmulticast mode [ 218.307631][ T8407] netlink: 8 bytes leftover after parsing attributes in process `syz.4.746'. [ 218.331794][ T8407] netlink: 8 bytes leftover after parsing attributes in process `syz.4.746'. [ 219.051739][ T8418] 8021q: VLANs not supported on caif0 [ 219.327333][ T8423] loop2: detected capacity change from 0 to 8 [ 221.072188][ T10] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 221.384894][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 221.403318][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 221.433704][ T10] usb 4-1: config 4 interface 0 has no altsetting 0 [ 221.442636][ T8455] netlink: 8 bytes leftover after parsing attributes in process `syz.0.759'. [ 221.477324][ T10] usb 4-1: string descriptor 0 read error: -22 [ 221.485809][ T8455] netlink: 8 bytes leftover after parsing attributes in process `syz.0.759'. [ 221.512231][ T10] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 221.540813][ T10] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 221.603872][ T10] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 221.807821][ T10] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 222.052783][ T10] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 222.066284][ T10] usb 4-1: media controller created [ 222.236697][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 222.310358][ C0] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 222.567983][ T8467] 8021q: VLANs not supported on caif0 [ 222.583262][ T10] usb 4-1: USB disconnect, device number 6 [ 222.705684][ T8471] syzkaller0: entered promiscuous mode [ 222.711354][ T8471] syzkaller0: entered allmulticast mode [ 224.990962][ T8495] netlink: 8 bytes leftover after parsing attributes in process `syz.3.771'. [ 225.575536][ T8495] netlink: 8 bytes leftover after parsing attributes in process `syz.3.771'. [ 226.340897][ T8509] netlink: 4 bytes leftover after parsing attributes in process `syz.3.777'. [ 226.434754][ T8506] syzkaller0: entered promiscuous mode [ 226.449497][ T8506] syzkaller0: entered allmulticast mode [ 226.755077][ T10] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 227.284962][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 227.298161][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 227.324777][ T10] usb 3-1: config 4 interface 0 has no altsetting 0 [ 227.351683][ T10] usb 3-1: string descriptor 0 read error: -22 [ 227.367686][ T10] usb 3-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 227.385681][ T10] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 227.428800][ T10] usb 3-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 227.444502][ T8534] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 227.472043][ T10] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 227.498516][ T10] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 227.527715][ T10] usb 3-1: media controller created [ 227.585552][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 227.779343][ T8536] loop3: detected capacity change from 0 to 4096 [ 227.792092][ T8536] EXT4-fs (loop3): Test dummy encryption mode enabled [ 227.812328][ T8536] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 227.903235][ T10] usb 3-1: USB disconnect, device number 6 [ 227.961352][ T8536] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-aesni" [ 228.008972][ T8536] fscrypt: AES-256-XTS using implementation "xts-aes-aesni-avx" [ 228.106726][ T5837] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 228.234319][ T8546] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=984118777 (984118777 ns) > initial count (508649472 ns). Using initial count to start timer. [ 229.161160][ T8558] kernel profiling enabled (shift: 9) [ 230.421033][ T8575] loop3: detected capacity change from 0 to 512 [ 230.454413][ T8575] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 230.521502][ T8575] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 230.589565][ T8575] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0002] [ 230.717013][ T8575] System zones: 1-12 [ 230.770312][ T8585] loop1: detected capacity change from 0 to 32768 [ 230.797253][ T8585] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.799 (8585) [ 230.821170][ T8585] BTRFS info (device loop1): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 230.831357][ T8585] BTRFS info (device loop1): using crc32c checksum algorithm [ 230.838916][ T8585] BTRFS warning (device loop1): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 230.868368][ T8575] EXT4-fs (loop3): 1 truncate cleaned up [ 230.921622][ T8585] BTRFS info (device loop1): rebuilding free space tree [ 230.924164][ T8575] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 230.979895][ T8585] BTRFS info (device loop1): disabling free space tree [ 230.986911][ T8585] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 230.998710][ T8585] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 231.024554][ T8585] BTRFS info (device loop1): enabling ssd optimizations [ 231.032407][ T8585] BTRFS info (device loop1): turning on async discard [ 231.039290][ T8585] BTRFS info (device loop1): enabling disk space caching [ 231.046358][ T8585] BTRFS info (device loop1): force clearing of disk cache [ 231.053521][ T8585] BTRFS info (device loop1): use zstd compression, level 3 [ 231.911933][ T5837] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.107249][ T5849] BTRFS info (device loop1): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 232.125845][ T1239] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 232.819116][ T1239] usb 1-1: Using ep0 maxpacket: 8 [ 232.837633][ T1239] usb 1-1: unable to get BOS descriptor or descriptor too short [ 232.852770][ T1239] usb 1-1: config 4 interface 0 has no altsetting 0 [ 232.868517][ T1239] usb 1-1: string descriptor 0 read error: -22 [ 232.875318][ T1239] usb 1-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 232.884443][ T1239] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 232.971490][ T1239] usb 1-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 233.030606][ T1239] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 233.103790][ T1239] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 233.148623][ T1239] usb 1-1: media controller created [ 233.645153][ T1239] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 234.727547][ T8640] loop2: detected capacity change from 0 to 16 [ 234.885612][ T8640] erofs (device loop2): mounted with root inode @ nid 36. [ 234.911767][ T8640] syz.2.808: attempt to access beyond end of device [ 234.911767][ T8640] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 234.967540][ T8640] syz.2.808: attempt to access beyond end of device [ 234.967540][ T8640] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 234.982960][ T8640] erofs (device loop2): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 234.995333][ T8640] erofs (device loop2): read error -117 @ 1 of nid 89 [ 235.033421][ T30] audit: type=1800 audit(1774988355.180:8): pid=8640 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.808" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 235.682766][ T1239] usb 1-1: USB disconnect, device number 9 [ 235.766742][ T8652] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 236.124085][ T8668] binder_alloc: 8666: binder_alloc_buf, no vma [ 237.347962][ T8679] loop2: detected capacity change from 0 to 4096 [ 237.430947][ T8679] NILFS (loop2): invalid segment: Checksum error in segment payload [ 237.462875][ T8679] NILFS (loop2): trying rollback from an earlier position [ 237.637382][ T8679] NILFS (loop2): recovery complete [ 237.667633][ T8695] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 237.785447][ T5896] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 237.999351][ T5896] usb 2-1: Using ep0 maxpacket: 8 [ 238.132337][ T5896] usb 2-1: unable to get BOS descriptor or descriptor too short [ 238.199284][ T5896] usb 2-1: config 4 interface 0 has no altsetting 0 [ 238.402127][ T5896] usb 2-1: string descriptor 0 read error: -22 [ 238.432423][ T5896] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 238.446033][ T5896] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 238.483481][ T5896] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 238.518734][ T5896] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 238.550666][ T5896] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 238.574012][ T5896] usb 2-1: media controller created [ 238.622915][ T5896] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 239.068306][ T5896] usb 2-1: USB disconnect, device number 4 [ 239.838035][ T8746] 8021q: VLANs not supported on caif0 [ 240.765990][ T8753] netlink: 164 bytes leftover after parsing attributes in process `syz.3.833'. [ 241.838967][ T8758] loop0: detected capacity change from 0 to 4096 [ 241.880613][ T8758] NILFS (loop0): invalid segment: Checksum error in segment payload [ 241.919244][ T8758] NILFS (loop0): trying rollback from an earlier position [ 242.240642][ T8758] NILFS (loop0): recovery complete [ 242.535246][ T8770] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 243.526077][ T5909] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 243.708265][ T5909] usb 2-1: Using ep0 maxpacket: 8 [ 243.726161][ T8799] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.729471][ T5909] usb 2-1: unable to get BOS descriptor or descriptor too short [ 243.734559][ T8799] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.754534][ T5909] usb 2-1: config 4 interface 0 has no altsetting 0 [ 243.772010][ T5909] usb 2-1: string descriptor 0 read error: -22 [ 243.785450][ T5909] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 243.799505][ T5909] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 243.847592][ T5909] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 243.899942][ T5909] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 243.927838][ T5909] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 243.936341][ T5909] usb 2-1: media controller created [ 243.965887][ T5909] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 244.112531][ T8809] loop0: detected capacity change from 0 to 512 [ 244.139779][ T8799] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 244.187977][ T8799] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 244.199839][ T8809] EXT4-fs (loop0): blocks per group (95) and clusters per group (32768) inconsistent [ 244.234344][ T5909] usb 2-1: USB disconnect, device number 5 [ 245.300739][ T63] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.339432][ T63] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.382985][ T63] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.418245][ T63] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.198319][ T8825] binder: 8817:8825 ioctl c0306201 0 returned -14 [ 246.367514][ T8825] netlink: 8 bytes leftover after parsing attributes in process `syz.1.851'. [ 246.675986][ T8832] loop0: detected capacity change from 0 to 1024 [ 246.716565][ T8832] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 246.837972][ T8832] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 246.975610][ T8832] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 247.463238][ T5838] EXT4-fs error (device loop0): ext4_iget_extra_inode:5043: inode #15: comm syz-executor: corrupted in-inode xattr: ea_inode specified without ea_inode feature enabled [ 248.072471][ T5838] EXT4-fs error (device loop0): ext4_iget_extra_inode:5043: inode #15: comm syz-executor: corrupted in-inode xattr: ea_inode specified without ea_inode feature enabled [ 248.615026][ T5909] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 248.684890][ T8855] loop1: detected capacity change from 0 to 32768 [ 248.715332][ T8855] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 248.785055][ T5909] usb 5-1: Using ep0 maxpacket: 8 [ 248.814238][ T5909] usb 5-1: unable to get BOS descriptor or descriptor too short [ 248.843158][ T8855] XFS (loop1): Ending clean mount [ 248.849737][ T5909] usb 5-1: config 4 interface 0 has no altsetting 0 [ 248.860465][ T5909] usb 5-1: string descriptor 0 read error: -22 [ 248.862603][ T8855] XFS (loop1): Quotacheck needed: Please wait. [ 248.867010][ T5909] usb 5-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 248.883352][ T5909] usb 5-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 248.915955][ T5909] usb 5-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 248.940712][ T5909] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 248.961002][ T5909] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 248.970665][ T5909] usb 5-1: media controller created [ 248.991320][ T5909] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 249.078620][ T8855] XFS (loop1): Quotacheck: Done. [ 249.217965][ T30] audit: type=1800 audit(1774988369.400:9): pid=8867 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.861" name="file1" dev="loop1" ino=9286 res=0 errno=0 [ 249.232446][ T85] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.699836][ T5849] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 249.703155][ T5909] usb 5-1: USB disconnect, device number 9 [ 249.897454][ T85] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 250.259780][ T85] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 250.263387][ T5855] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 250.282177][ T5855] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 250.310376][ T5855] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 250.452877][ T5855] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 250.464860][ T5855] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 250.816082][ T85] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 252.533789][ T1239] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 252.635098][ T5855] Bluetooth: hci1: command tx timeout [ 252.756820][ T1239] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 252.783922][ T1239] usb 4-1: config 0 interface 0 has no altsetting 0 [ 252.861912][ T8905] loop4: detected capacity change from 0 to 16 [ 252.900297][ T8905] erofs (device loop4): mounted with root inode @ nid 36. [ 252.921574][ T8905] syz.4.874: attempt to access beyond end of device [ 252.921574][ T8905] loop4: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 252.953340][ T8905] syz.4.874: attempt to access beyond end of device [ 252.953340][ T8905] loop4: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 252.968433][ T8905] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 252.979808][ T8905] erofs (device loop4): read error -117 @ 1 of nid 89 [ 253.000759][ T8905] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 253.016111][ T8905] erofs (device loop4): read error -117 @ 1 of nid 89 [ 253.031885][ T30] audit: type=1800 audit(1774988373.170:10): pid=8905 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.874" name="file2" dev="loop4" ino=89 res=0 errno=0 [ 253.467056][ T1239] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 253.484518][ T1239] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 253.493343][ T1239] usb 4-1: Product: syz [ 253.497592][ T1239] usb 4-1: Manufacturer: syz [ 253.502212][ T1239] usb 4-1: SerialNumber: syz [ 253.512930][ T1239] usb 4-1: config 0 descriptor?? [ 253.595117][ T1239] usb 4-1: selecting invalid altsetting 0 [ 253.766484][ T8887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.778334][ T85] bridge_slave_1: left allmulticast mode [ 253.796522][ T8887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.798783][ T85] bridge_slave_1: left promiscuous mode [ 253.841363][ T85] bridge0: port 2(bridge_slave_1) entered disabled state [ 253.901739][ T85] bridge_slave_0: left allmulticast mode [ 253.912660][ T85] bridge_slave_0: left promiscuous mode [ 253.931324][ T85] bridge0: port 1(bridge_slave_0) entered disabled state [ 254.059651][ T1239] usb 4-1: USB disconnect, device number 7 [ 254.308080][ T8910] loop4: detected capacity change from 0 to 32768 [ 254.341877][ T8910] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 254.426238][ T8912] loop1: detected capacity change from 0 to 4096 [ 254.432076][ T5859] udevd[5859]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 254.540229][ T8921] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 254.556284][ T8910] XFS (loop4): Ending clean mount [ 254.567761][ T8910] XFS (loop4): Quotacheck needed: Please wait. [ 254.686901][ T5855] Bluetooth: hci1: command tx timeout [ 254.766305][ T8910] XFS (loop4): Quotacheck: Done. [ 254.850824][ T30] audit: type=1800 audit(1774988375.020:11): pid=8924 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.876" name="file1" dev="loop4" ino=9286 res=0 errno=0 [ 255.359949][ T5846] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 255.665077][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.850923][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.352951][ T85] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 256.393187][ T85] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 256.472414][ T85] bond0 (unregistering): Released all slaves [ 256.595150][ T8874] chnl_net:caif_netlink_parms(): no params data found [ 256.636022][ T8938] overlayfs: missing 'lowerdir' [ 256.769415][ T5855] Bluetooth: hci1: command tx timeout [ 258.112546][ T8951] ipip0: entered promiscuous mode [ 258.448795][ T8874] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.499060][ T8971] loop4: detected capacity change from 0 to 1024 [ 258.525275][ T8874] bridge0: port 1(bridge_slave_0) entered disabled state [ 258.563616][ T8971] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 258.584316][ T8874] bridge_slave_0: entered allmulticast mode [ 258.625526][ T8972] loop1: detected capacity change from 0 to 32768 [ 258.642570][ T8874] bridge_slave_0: entered promiscuous mode [ 258.662387][ T8874] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.673304][ T8874] bridge0: port 2(bridge_slave_1) entered disabled state [ 258.680976][ T8874] bridge_slave_1: entered allmulticast mode [ 258.689693][ T8972] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 258.695939][ T8971] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 258.701827][ T8874] bridge_slave_1: entered promiscuous mode [ 258.811462][ T8971] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 258.845324][ T5855] Bluetooth: hci1: command tx timeout [ 258.950499][ T8972] XFS (loop1): Ending clean mount [ 258.964107][ T8972] XFS (loop1): Quotacheck needed: Please wait. [ 258.988221][ T5846] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 259.114327][ T8972] XFS (loop1): Quotacheck: Done. [ 259.534982][ T30] audit: type=1800 audit(1774988379.380:12): pid=8996 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.891" name="file1" dev="loop1" ino=9286 res=0 errno=0 [ 259.592271][ T8997] loop3: detected capacity change from 0 to 2048 [ 260.143841][ T5849] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 260.173354][ T8997] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 260.187287][ T8997] ext4 filesystem being mounted at /175/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 260.932912][ T8997] fuse: Unknown parameter '0000000000000000000000000000000000000000' [ 262.480700][ T5837] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 262.546099][ T8874] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 262.624714][ T85] hsr_slave_0: left promiscuous mode [ 262.684766][ T85] hsr_slave_1: left promiscuous mode [ 262.723799][ T85] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 262.744960][ T85] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 262.769229][ T85] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 262.802254][ T85] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 262.883220][ T85] veth1_macvtap: left promiscuous mode [ 262.890499][ T85] veth1_vlan: left promiscuous mode [ 262.895946][ T85] veth0_vlan: left promiscuous mode [ 263.757853][ T85] team0 (unregistering): Port device team_slave_1 removed [ 263.817324][ T85] team0 (unregistering): Port device team_slave_0 removed [ 263.966250][ T9036] Bluetooth: hci5: Frame reassembly failed (-90) [ 264.153326][ T6948] Bluetooth: hci5: Frame reassembly failed (-84) [ 264.259070][ T6948] Bluetooth: hci5: Frame reassembly failed (-84) [ 264.442229][ T8874] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 264.618268][ T8874] team0: Port device team_slave_0 added [ 264.654526][ T8874] team0: Port device team_slave_1 added [ 264.706968][ T8874] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 264.713946][ T8874] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 264.795545][ T9038] loop2: detected capacity change from 0 to 32768 [ 264.830578][ T9038] XFS (loop2): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 264.836585][ T8874] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 264.898106][ T8874] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 264.962943][ T8874] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 265.031111][ T9038] XFS (loop2): Ending clean mount [ 265.039494][ T9038] XFS (loop2): Quotacheck needed: Please wait. [ 265.080729][ T8874] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 265.139793][ T9038] XFS (loop2): Quotacheck: Done. [ 265.288389][ T30] audit: type=1800 audit(1774988385.470:13): pid=9055 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.903" name="file1" dev="loop2" ino=9286 res=0 errno=0 [ 265.831772][ T85] IPVS: stop unused estimator thread 0... [ 265.844112][ T8874] hsr_slave_0: entered promiscuous mode [ 265.854004][ T8874] hsr_slave_1: entered promiscuous mode [ 265.884639][ T8874] debugfs: 'hsr0' already exists in 'hsr' [ 265.893844][ T5854] XFS (loop2): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 265.908221][ T8874] Cannot create hsr debugfs directory [ 266.046075][ T5850] Bluetooth: hci5: command 0x1003 tx timeout [ 266.053542][ T5855] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 268.208924][ T9090] loop2: detected capacity change from 0 to 4096 [ 268.781662][ T9101] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 268.969728][ T9106] NILFS (loop2): error -2 preparing GC: cannot delete virtual blocks from DAT file [ 269.464665][ T9108] loop1: detected capacity change from 0 to 32768 [ 269.501906][ T9108] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 269.591467][ T9108] XFS (loop1): Ending clean mount [ 269.603066][ T9108] XFS (loop1): Quotacheck needed: Please wait. [ 269.668480][ T8874] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 269.740696][ T8874] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 270.737125][ T8874] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 270.806914][ T8874] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 270.814236][ T9108] XFS (loop1): Quotacheck: Done. [ 270.893896][ T30] audit: type=1800 audit(1774988391.070:14): pid=9129 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.917" name="file1" dev="loop1" ino=9286 res=0 errno=0 [ 271.633667][ T5849] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 271.818045][ T9145] netlink: 4 bytes leftover after parsing attributes in process `syz.4.923'. [ 271.912476][ T8874] 8021q: adding VLAN 0 to HW filter on device bond0 [ 273.586479][ T8874] 8021q: adding VLAN 0 to HW filter on device team0 [ 273.631923][ T6948] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.639092][ T6948] bridge0: port 1(bridge_slave_0) entered forwarding state [ 273.708540][ T6948] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.715659][ T6948] bridge0: port 2(bridge_slave_1) entered forwarding state [ 274.132259][ T9176] loop4: detected capacity change from 0 to 4096 [ 274.182437][ T9182] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 274.266179][ T9184] NILFS (loop4): error -2 preparing GC: cannot delete virtual blocks from DAT file [ 274.525301][ T5896] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 274.825140][ T5896] usb 2-1: Using ep0 maxpacket: 16 [ 274.851570][ T5896] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 274.895728][ T5896] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 274.950059][ T5896] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 274.994460][ T5896] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.021612][ T8874] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 275.027165][ T5896] usb 2-1: Product: syz [ 275.038618][ T5896] usb 2-1: Manufacturer: syz [ 275.050873][ T5896] usb 2-1: SerialNumber: syz [ 275.140836][ T5896] usb 2-1: 0:2 : does not exist [ 275.351077][ T5896] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 276.424580][ T5896] usb 2-1: USB disconnect, device number 6 [ 276.582614][ T6864] udevd[6864]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 276.773565][ T8874] veth0_vlan: entered promiscuous mode [ 277.035143][ T8874] veth1_vlan: entered promiscuous mode [ 277.600344][ T8874] veth0_macvtap: entered promiscuous mode [ 277.631285][ T8874] veth1_macvtap: entered promiscuous mode [ 277.675223][ T8874] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 277.686911][ T8874] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 277.726188][ T3554] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.751843][ T3554] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.789320][ T3554] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.830395][ T3554] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.839639][ T9239] loop4: detected capacity change from 0 to 4096 [ 277.915190][ T9247] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 278.113274][ T9250] NILFS (loop4): error -2 preparing GC: cannot delete virtual blocks from DAT file [ 279.598462][ T9243] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 279.649291][ T9243] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 279.752930][ T9243] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 279.796680][ T9243] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 279.885357][ T9243] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 279.913691][ T9243] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 280.683312][ T9243] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 280.695327][ T9243] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 280.869154][ T3530] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 280.892315][ T3530] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 281.025029][ T9292] netlink: 164 bytes leftover after parsing attributes in process `syz.2.954'. [ 281.572492][ T3554] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 281.609069][ T3554] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.355639][ T9308] loop2: detected capacity change from 0 to 4096 [ 283.133540][ T9320] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 283.366568][ T9328] NILFS (loop2): error -2 preparing GC: cannot delete virtual blocks from DAT file [ 287.622470][ T9385] loop3: detected capacity change from 0 to 4096 [ 287.814110][ T9397] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 288.437196][ T9401] NILFS (loop3): error -2 preparing GC: cannot delete virtual blocks from DAT file [ 289.721618][ T9419] loop1: detected capacity change from 0 to 512 [ 289.806012][ T9419] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 289.923444][ T9419] ext4 filesystem being mounted at /199/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 290.254977][ T1179] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 290.904994][ T1179] usb 5-1: Using ep0 maxpacket: 32 [ 290.923569][ T1179] usb 5-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 291.026189][ T1179] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.036191][ T5849] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 291.047475][ T1179] usb 5-1: Product: syz [ 291.051785][ T1179] usb 5-1: Manufacturer: syz [ 291.060299][ T1179] usb 5-1: SerialNumber: syz [ 291.132384][ T1179] usb 5-1: config 0 descriptor?? [ 291.154717][ T1179] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 292.035364][ T1179] gspca_ov534_9: reg_w failed -110 [ 292.246031][ T9465] loop1: detected capacity change from 0 to 1024 [ 292.253018][ T9468] binder: 9467:9468 ioctl c0306201 0 returned -14 [ 292.271675][ T9465] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 292.331401][ T9465] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 292.436730][ T9465] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 292.474876][ T1179] gspca_ov534_9: Unknown sensor 0000 [ 292.474983][ T1179] ov534_9 5-1:0.0: probe with driver ov534_9 failed with error -22 [ 292.660040][ T5849] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 292.823192][ T9485] syzkaller0: entered promiscuous mode [ 292.842344][ T9485] syzkaller0: entered allmulticast mode [ 293.622638][ T5926] usb 5-1: USB disconnect, device number 10 [ 294.067845][ T9504] ceph: No mds server is up or the cluster is laggy [ 297.585347][ T1179] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 298.065956][ T1179] usb 5-1: Using ep0 maxpacket: 16 [ 298.087715][ T1179] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 298.109628][ T1179] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 298.129064][ T1179] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 298.144900][ T1179] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.166788][ T1179] usb 5-1: Product: syz [ 298.341418][ T1179] usb 5-1: Manufacturer: syz [ 298.346369][ T1179] usb 5-1: SerialNumber: syz [ 298.363868][ T1179] usb 5-1: 0:2 : does not exist [ 298.572803][ T1179] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 298.656563][ T9574] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 298.682376][ T9549] loop3: detected capacity change from 0 to 32768 [ 298.750275][ T1179] usb 5-1: USB disconnect, device number 11 [ 298.886909][ T30] audit: type=1800 audit(1774988419.070:15): pid=9549 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1021" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 298.951692][ T6864] udevd[6864]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 299.015261][ T9560] loop1: detected capacity change from 0 to 32768 [ 299.045577][ T9560] xfs: Deprecated parameter 'attr2' [ 299.061701][ T9560] XFS: attr2 mount option is deprecated. [ 299.098216][ T9588] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 299.141920][ T9560] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 299.273732][ T9560] XFS (loop1): Ending clean mount [ 299.313245][ T9560] XFS (loop1): Quotacheck needed: Please wait. [ 299.439441][ T9560] XFS (loop1): Quotacheck: Done. [ 299.473598][ T30] audit: type=1800 audit(1774988419.650:16): pid=9560 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1024" name="file1" dev="loop1" ino=4422 res=0 errno=0 [ 300.551391][ T5849] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 300.671322][ T9623] loop3: detected capacity change from 0 to 1024 [ 300.723192][ T9623] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 300.953778][ T9623] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 301.134570][ T9623] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 302.831009][ T5837] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 304.429733][ T9667] loop3: detected capacity change from 0 to 32768 [ 304.488451][ T9667] ERROR: (device loop3): xtSearch: xt_getpage: xtree page corrupt [ 304.488451][ T9667] [ 304.537548][ T9667] ERROR: (device loop3): remounting filesystem as read-only [ 304.555144][ T9667] xtLookup: xtSearch returned -5 [ 305.839629][ T9707] orangefs_mount: mount request failed with -4 [ 307.565982][ T9737] loop5: detected capacity change from 0 to 1024 [ 307.595105][ T9737] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 307.676197][ T9737] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 307.779775][ T9737] EXT4-fs (loop5): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 307.968739][ T8874] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 311.326433][ T29] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 313.552033][ T29] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 313.552071][ T29] usb 4-1: can't read configurations, error -71 [ 314.245346][ T9870] loop1: detected capacity change from 0 to 4096 [ 314.383683][ T9874] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 315.243047][ T9887] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1107'. [ 315.263884][ T9887] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1107'. [ 316.758938][ T9889] loop2: detected capacity change from 0 to 40427 [ 316.845649][ T9889] F2FS-fs (loop2): build fault injection rate: 771 [ 316.870594][ T9910] syzkaller0: entered promiscuous mode [ 316.889889][ T9889] F2FS-fs (loop2): invalid crc value [ 316.900016][ T9910] syzkaller0: entered allmulticast mode [ 317.091134][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.099126][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.375480][ T9918] loop3: detected capacity change from 0 to 2048 [ 317.636648][ T9918] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 317.649984][ T9918] ext4 filesystem being mounted at /219/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 317.751051][ T9918] fuse: Unknown parameter '0000000000000000000000000000000000000000' [ 318.069702][ T9889] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 318.180422][ T9889] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 318.193505][ T9923] loop5: detected capacity change from 0 to 4096 [ 318.215367][ T9926] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1119'. [ 318.256199][ T9927] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 318.260301][ T9926] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1119'. [ 318.325801][ T5837] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 319.101222][ T9931] loop3: detected capacity change from 0 to 4096 [ 319.175484][ T9931] NILFS (loop3): invalid segment: Checksum error in segment payload [ 319.231772][ T9931] NILFS (loop3): trying rollback from an earlier position [ 319.775221][ T9931] NILFS (loop3): recovery complete [ 319.792511][ T9942] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 319.981873][ T30] audit: type=1800 audit(1774988440.160:17): pid=9931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1120" name="file1" dev="loop3" ino=13 res=0 errno=0 [ 320.711229][ T9960] syzkaller0: entered promiscuous mode [ 320.747531][ T9960] syzkaller0: entered allmulticast mode [ 321.558221][ T9976] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1133'. [ 321.637165][ T9976] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1133'. [ 321.968921][ T9995] loop4: detected capacity change from 0 to 512 [ 322.048994][ T9995] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.1139: invalid indirect mapped block 256 (level 2) [ 322.072302][ T9995] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 322.218737][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 322.234320][ C1] EXT4-fs (loop4): initial error at time 1774988442: ext4_free_branches:1023: inode 11 [ 322.244035][ C1] EXT4-fs (loop4): last error at time 1774988442: ext4_free_branches:1023: inode 11 [ 322.523282][ T9995] EXT4-fs (loop4): 2 truncates cleaned up [ 322.546242][ T9995] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 322.624653][ T9995] EXT4-fs error (device loop4): ext4_validate_block_bitmap:432: comm syz.4.1139: bg 0: block 5: invalid block bitmap [ 322.794649][ T9995] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 322.807751][ T9995] EXT4-fs (loop4): This should not happen!! Data will be lost [ 322.807751][ T9995] [ 322.847277][ T9995] EXT4-fs (loop4): Total free blocks count 0 [ 322.872480][ T9995] EXT4-fs (loop4): Free/Dirty block details [ 322.924204][ T9995] EXT4-fs (loop4): free_blocks=0 [ 322.954495][ T9995] EXT4-fs (loop4): dirty_blocks=2 [ 322.999749][ T9995] EXT4-fs (loop4): Block reservation details [ 323.029039][ T9995] EXT4-fs (loop4): i_reserved_data_blocks=2 [ 323.128848][ T3530] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 131075 with max blocks 1 with error 28 [ 323.183452][T10019] loop1: detected capacity change from 0 to 2048 [ 323.243033][ T5846] EXT4-fs warning (device loop4): ext4_evict_inode:195: inode #15: comm syz-executor: data will be lost [ 323.322614][T10026] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 323.507514][T10019] NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 323.919000][T10019] Remounting filesystem read-only [ 323.955287][T10019] NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 323.985408][T10019] NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 324.027637][T10019] NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 324.051323][T10030] syzkaller0: entered promiscuous mode [ 324.061778][T10019] NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 324.078660][T10030] syzkaller0: entered allmulticast mode [ 324.089940][T10019] NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 324.136087][T10019] NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 324.200071][T10019] NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 324.260671][ T30] audit: type=1800 audit(1774988444.440:18): pid=10019 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1143" name="file2" dev="loop1" ino=16 res=0 errno=0 [ 325.629222][T10052] loop5: detected capacity change from 0 to 2048 [ 325.701880][T10053] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 325.758980][ T30] audit: type=1800 audit(1774988445.930:19): pid=10052 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1152" name="file1" dev="loop5" ino=15 res=0 errno=0 [ 325.833257][T10044] loop1: detected capacity change from 0 to 40427 [ 325.848795][T10044] F2FS-fs (loop1): Fix alignment : internally, start(4096) end(16896) block(12288) [ 325.871588][T10044] F2FS-fs (loop1): invalid crc value [ 326.077824][T10044] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 326.095588][T10044] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 326.209606][T10044] F2FS-fs (loop1): Try to recover all the superblocks, ret: 0 [ 326.297632][T10061] f2fs_ckpt-7:1: attempt to access beyond end of device [ 326.297632][T10061] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 326.325163][T10061] CPU: 0 UID: 0 PID: 10061 Comm: f2fs_ckpt-7:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 326.325193][T10061] Tainted: [L]=SOFTLOCKUP [ 326.325200][T10061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 326.325214][T10061] Call Trace: [ 326.325223][T10061] [ 326.325231][T10061] dump_stack_lvl+0xe8/0x150 [ 326.325265][T10061] f2fs_stop_checkpoint+0x3c7/0x590 [ 326.325298][T10061] f2fs_write_end_io+0x12e5/0x17a0 [ 326.325337][T10061] __submit_merged_bio+0x256/0x6a0 [ 326.325369][T10061] __submit_merged_write_cond+0x3c9/0x4e0 [ 326.325399][T10061] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 326.325450][T10061] f2fs_write_data_pages+0x287e/0x34f0 [ 326.325469][T10061] ? unwind_next_frame+0xa6/0x2550 [ 326.325527][T10061] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 326.325559][T10061] ? arch_stack_walk+0x11b/0x150 [ 326.325611][T10061] ? add_lock_to_list+0xc7/0x100 [ 326.325633][T10061] ? lockdep_unlock+0x5d/0xd0 [ 326.325654][T10061] ? __lock_acquire+0x146e/0x2cf0 [ 326.325711][T10061] ? do_raw_spin_lock+0x12b/0x2f0 [ 326.325745][T10061] ? do_raw_spin_unlock+0xf5/0x210 [ 326.325774][T10061] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 326.325795][T10061] do_writepages+0x32e/0x550 [ 326.325830][T10061] ? do_raw_spin_unlock+0xf5/0x210 [ 326.325856][T10061] filemap_fdatawrite+0x1e9/0x2f0 [ 326.325883][T10061] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 326.325963][T10061] ? do_raw_spin_unlock+0xf5/0x210 [ 326.325988][T10061] f2fs_sync_dirty_inodes+0x30e/0x830 [ 326.326022][T10061] f2fs_write_checkpoint+0x9df/0x26a0 [ 326.326082][T10061] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 326.326143][T10061] ? down_write+0x16d/0x200 [ 326.326176][T10061] ? __pfx_down_write+0x10/0x10 [ 326.326197][T10061] ? uplift_priority+0xdb/0x700 [ 326.326222][T10061] ? __schedule+0x1672/0x5520 [ 326.326251][T10061] __write_checkpoint_sync+0x124/0x2b0 [ 326.326280][T10061] ? __pfx___write_checkpoint_sync+0x10/0x10 [ 326.326314][T10061] ? __pfx___schedule+0x10/0x10 [ 326.326351][T10061] __checkpoint_and_complete_reqs+0x53/0x2d0 [ 326.326380][T10061] issue_checkpoint_thread+0xd6/0x280 [ 326.326405][T10061] ? __pfx_issue_checkpoint_thread+0x10/0x10 [ 326.326428][T10061] ? __pfx_autoremove_wake_function+0x10/0x10 [ 326.326452][T10061] ? __kthread_parkme+0x7a/0x1f0 [ 326.326481][T10061] kthread+0x388/0x470 [ 326.326501][T10061] ? __pfx_issue_checkpoint_thread+0x10/0x10 [ 326.326518][T10061] ? __pfx_kthread+0x10/0x10 [ 326.326539][T10061] ret_from_fork+0x514/0xb70 [ 326.326566][T10061] ? __pfx_ret_from_fork+0x10/0x10 [ 326.326590][T10061] ? __switch_to+0xc79/0x1410 [ 326.326615][T10061] ? __pfx_kthread+0x10/0x10 [ 326.326637][T10061] ret_from_fork_asm+0x1a/0x30 [ 326.326668][T10061] [ 326.603881][T10061] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 326.691901][T10044] syz.1.1149: attempt to access beyond end of device [ 326.691901][T10044] loop1: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 326.716702][T10044] syz.1.1149: attempt to access beyond end of device [ 326.716702][T10044] loop1: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 329.456650][T10077] loop4: detected capacity change from 0 to 2048 [ 329.957975][T10077] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 329.971110][T10077] ext4 filesystem being mounted at /220/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 331.383022][T10085] fuse: Unknown parameter '0000000000000000000000000000000000000000' [ 332.008037][ T5846] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 334.380052][T10103] loop3: detected capacity change from 0 to 32768 [ 334.387182][T10124] netlink: 'syz.5.1173': attribute type 10 has an invalid length. [ 334.992465][T10103] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 335.185636][T10103] XFS (loop3): Ending clean mount [ 335.305492][ T1239] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 335.475418][ T10] hid-generic 0080:0005:FFFFFFFE.0002: unknown main item tag 0x0 [ 335.487374][ T1239] usb 6-1: Using ep0 maxpacket: 16 [ 335.506889][ T1239] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 335.521562][ T10] hid-generic 0080:0005:FFFFFFFE.0002: unknown main item tag 0x0 [ 335.546926][ T5837] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 335.558647][ T1239] usb 6-1: config 0 has no interfaces? [ 335.588486][ T1239] usb 6-1: New USB device found, idVendor=045e, idProduct=fc40, bcdDevice=72.a8 [ 335.604873][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 335.645408][ T1239] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.659804][ T10] hid-generic 0080:0005:FFFFFFFE.0002: hidraw0: HID v0.03 Device [syz0] on syz1 [ 335.671584][ T1239] usb 6-1: config 0 descriptor?? [ 336.538521][T10141] loop1: detected capacity change from 0 to 40427 [ 336.675490][T10157] loop3: detected capacity change from 0 to 16 [ 337.283362][T10157] erofs (device loop3): mounted with root inode @ nid 36. [ 337.295832][T10156] syz.3.1179: attempt to access beyond end of device [ 337.295832][T10156] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 337.297258][T10141] F2FS-fs (loop1): Fix alignment : internally, start(4096) end(16896) block(12288) [ 337.328249][T10156] syz.3.1179: attempt to access beyond end of device [ 337.328249][T10156] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 337.342962][T10156] erofs (device loop3): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 337.354229][T10156] erofs (device loop3): read error -117 @ 1 of nid 89 [ 337.361485][ T30] audit: type=1800 audit(1774988457.540:20): pid=10156 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1179" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 337.781990][T10141] F2FS-fs (loop1): invalid crc value [ 337.857881][ T5926] usb 6-1: USB disconnect, device number 2 [ 338.909663][T10141] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 338.963245][T10141] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 340.244954][ T1239] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 340.493083][T10200] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1189'. [ 340.505134][ T1239] usb 4-1: Using ep0 maxpacket: 8 [ 340.513894][ T1239] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 340.526746][ T1239] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 340.537684][ T1239] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.543232][T10202] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 341.055610][ T1239] usb 4-1: Product: syz [ 341.062535][ T1239] usb 4-1: Manufacturer: syz [ 341.068178][ T1239] usb 4-1: SerialNumber: syz [ 341.097560][ T1239] usb 4-1: config 0 descriptor?? [ 341.113107][ T1239] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 341.122088][ T1239] usb 4-1: setting power ON [ 341.130516][ T1239] dvb-usb: bulk message failed: -22 (2/0) [ 341.145739][ T1239] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 341.166347][ T1239] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 341.176378][ T1239] usb 4-1: media controller created [ 341.208433][ T1239] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 341.389025][T10206] dvb-usb: bulk message failed: -22 (3/0) [ 341.693750][ T1239] usb 4-1: selecting invalid altsetting 6 [ 341.708742][ T1239] usb 4-1: digital interface selection failed (-22) [ 341.715856][ T1239] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 341.746844][ T1239] usb 4-1: setting power OFF [ 341.754925][ T1239] dvb-usb: bulk message failed: -22 (2/0) [ 341.941653][ T1239] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 341.957582][ T1239] (NULL device *): no alternate interface [ 342.081113][T10213] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1199'. [ 342.205664][ T5909] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 342.215856][ T1239] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 342.241251][ T1239] usb 4-1: USB disconnect, device number 10 [ 342.445743][ T5909] usb 2-1: Using ep0 maxpacket: 32 [ 342.457081][ T5909] usb 2-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 342.468478][ T5909] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.019221][ T5909] usb 2-1: Product: syz [ 343.041578][ T5909] usb 2-1: Manufacturer: syz [ 343.046930][ T5909] usb 2-1: SerialNumber: syz [ 343.069857][ T5909] usb 2-1: config 0 descriptor?? [ 343.759401][ T5909] peak_usb 2-1:0.0 can0: unable to request usb[type=0 value=0] err=-32 [ 343.773692][ T5909] peak_usb 2-1:0.0: unable to read PCAN-USB Pro bootloader info (err -32) [ 343.999255][ T5909] peak_usb 2-1:0.0: probe with driver peak_usb failed with error -32 [ 344.036605][ T5909] usb 2-1: USB disconnect, device number 7 [ 345.027884][T10228] loop5: detected capacity change from 0 to 32768 [ 345.037554][T10228] xfs: Deprecated parameter 'attr2' [ 345.089729][T10242] loop4: detected capacity change from 0 to 128 [ 345.114974][T10228] XFS: attr2 mount option is deprecated. [ 345.190658][T10242] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 345.222737][T10228] XFS (loop5): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 345.784305][T10242] hpfs: filesystem error: improperly stopped [ 345.815057][T10228] XFS (loop5): Ending clean mount [ 345.846937][T10228] XFS (loop5): Quotacheck needed: Please wait. [ 345.859718][T10242] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 345.975239][T10242] hpfs: You really don't want any checks? You are crazy... [ 346.001940][T10242] hpfs: hpfs_map_sector(): read error [ 346.021305][T10242] hpfs: code page support is disabled [ 346.053145][T10242] hpfs: hpfs_map_4sectors(): unaligned read [ 346.067841][T10242] hpfs: hpfs_map_4sectors(): unaligned read [ 346.081363][T10242] hpfs: filesystem error: unable to find root dir [ 346.116813][T10228] XFS (loop5): Quotacheck: Done. [ 346.139436][ T30] audit: type=1800 audit(1774988466.320:21): pid=10228 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1204" name="file1" dev="loop5" ino=4422 res=0 errno=0 [ 346.235399][T10260] hpfs: hpfs_map_4sectors(): unaligned read [ 346.272665][T10260] hpfs: filesystem error: invalid bitmap block pointer 00000000 -> 7b3184b5 at aib [ 347.437484][ T8874] XFS (loop5): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 347.890169][T10283] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1221'. [ 347.915423][T10282] input: syz1 as /devices/virtual/input/input12 [ 348.985168][T10291] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1223'. [ 349.879622][ T30] audit: type=1326 audit(1774988470.060:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa96ff9c819 code=0x7ffc0000 [ 350.092835][ T30] audit: type=1326 audit(1774988470.060:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa96ff9c819 code=0x7ffc0000 [ 350.115496][ T30] audit: type=1326 audit(1774988470.060:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fa96ff9c819 code=0x7ffc0000 [ 350.138269][ T30] audit: type=1326 audit(1774988470.080:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fa96ff9c582 code=0x7ffc0000 [ 350.681405][ T30] audit: type=1326 audit(1774988470.090:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fa96ff9c582 code=0x7ffc0000 [ 350.851069][ T30] audit: type=1326 audit(1774988470.090:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa96ff9c819 code=0x7ffc0000 [ 350.912105][ T30] audit: type=1326 audit(1774988470.090:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa96ff9c819 code=0x7ffc0000 [ 351.359894][ T30] audit: type=1326 audit(1774988470.130:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=213 compat=0 ip=0x7fa96ff9c819 code=0x7ffc0000 [ 351.387967][ T30] audit: type=1326 audit(1774988470.130:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa96ff9c819 code=0x7ffc0000 [ 351.416240][ T30] audit: type=1326 audit(1774988470.140:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10299 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=441 compat=0 ip=0x7fa96ff9c819 code=0x7ffc0000 [ 351.657998][T10322] lo: entered allmulticast mode [ 352.104558][T10327] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1233'. [ 352.587043][T10335] input: syz1 as /devices/virtual/input/input13 [ 353.848044][T10350] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1238'. [ 354.177897][T10357] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1243'. [ 354.740421][T10367] input: syz1 as /devices/virtual/input/input14 [ 355.009823][T10363] kvm: pic: non byte write [ 355.350239][ T30] audit: type=1326 audit(1774988475.530:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10380 comm="syz.5.1251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c4eb9c819 code=0x7ffc0000 [ 355.413163][ T30] audit: type=1326 audit(1774988475.560:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10380 comm="syz.5.1251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c4eb9c819 code=0x7ffc0000 [ 355.438179][ T30] audit: type=1326 audit(1774988475.560:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10380 comm="syz.5.1251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f1c4eb9c819 code=0x7ffc0000 [ 355.462205][ T30] audit: type=1326 audit(1774988475.560:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10380 comm="syz.5.1251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f1c4eb9c582 code=0x7ffc0000 [ 355.572419][ T30] audit: type=1326 audit(1774988475.570:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10380 comm="syz.5.1251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f1c4eb9c582 code=0x7ffc0000 [ 355.611254][ T30] audit: type=1326 audit(1774988475.570:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10380 comm="syz.5.1251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c4eb9c819 code=0x7ffc0000 [ 355.636677][ T30] audit: type=1326 audit(1774988475.570:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10380 comm="syz.5.1251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c4eb9c819 code=0x7ffc0000 [ 355.837205][T10388] input: syz1 as /devices/virtual/input/input15 [ 358.320088][T10408] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1256'. [ 359.261893][T10421] loop5: detected capacity change from 0 to 4096 [ 360.362527][T10432] loop2: detected capacity change from 0 to 1024 [ 362.450098][ T3530] hfsplus: b-tree write err: -5, ino 3 [ 362.941322][ T1179] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 363.522181][ T1179] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 363.538956][ T1179] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.576989][ T1179] usb 5-1: Product: syz [ 363.588844][ T1179] usb 5-1: Manufacturer: syz [ 363.602286][ T1179] usb 5-1: SerialNumber: syz [ 363.654584][ T1179] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 363.682072][T10441] fuse: Bad value for 'rootmode' [ 363.947309][T10471] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1276'. [ 364.480555][ T5909] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 364.774861][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 365.195557][ T1239] usb 5-1: USB disconnect, device number 12 [ 366.061161][ T5909] usb 5-1: Service connection timeout for: 257 [ 366.168937][ T5909] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services [ 366.194747][T10495] mmap: syz.3.1284 (10495) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 366.214290][ T5909] ath9k_htc: Failed to initialize the device [ 366.222932][ T1239] usb 5-1: ath9k_htc: USB layer deinitialized [ 366.948940][T10495] pim6reg: entered allmulticast mode [ 367.462879][T10524] netlink: 180 bytes leftover after parsing attributes in process `syz.5.1289'. [ 370.145664][T10546] loop1: detected capacity change from 0 to 1024 [ 370.160800][T10546] EXT4-fs (loop1): bad geometry: bigalloc file system with non-zero first_data_block [ 370.160800][T10546] [ 371.468070][T10551] netlink: 180 bytes leftover after parsing attributes in process `syz.2.1300'. [ 372.034294][T10570] process 'syz.5.1305' launched '/dev/fd/3' with NULL argv: empty string added [ 372.379927][T10575] loop5: detected capacity change from 0 to 16 [ 372.396159][T10575] erofs (device loop5): mounted with root inode @ nid 36. [ 372.412685][T10575] syz.5.1306: attempt to access beyond end of device [ 372.412685][T10575] loop5: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 372.475920][T10575] syz.5.1306: attempt to access beyond end of device [ 372.475920][T10575] loop5: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 372.491134][T10575] erofs (device loop5): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 372.502574][T10575] erofs (device loop5): read error -117 @ 1 of nid 89 [ 372.514133][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 372.514170][ T30] audit: type=1800 audit(1774988492.690:42): pid=10575 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1306" name="file2" dev="loop5" ino=89 res=0 errno=0 [ 373.454525][T10586] tipc: Enabling of bearer rejected, already enabled [ 374.200404][T10596] netlink: 164 bytes leftover after parsing attributes in process `syz.4.1311'. [ 375.011212][T10600] loop2: detected capacity change from 0 to 4096 [ 375.151376][T10609] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 376.498390][T10622] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1318'. [ 378.529958][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.540724][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.494406][T10671] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1331'. [ 382.317801][T10695] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 382.410007][T10697] loop9: detected capacity change from 0 to 7 [ 382.462231][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.486635][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.501968][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.527758][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.552018][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.573736][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.610947][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.632887][ T6864] ldm_validate_partition_table(): Disk read failed. [ 382.649607][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.682104][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.712928][ T6864] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.724390][T10699] macsec1: entered promiscuous mode [ 382.731622][ T6864] Dev loop9: unable to read RDB block 0 [ 382.753187][ T6864] loop9: unable to read partition table [ 382.764972][ T6864] loop9: partition table beyond EOD, truncated [ 382.771285][T10699] erspan0: entered promiscuous mode [ 382.861174][T10697] ldm_validate_partition_table(): Disk read failed. [ 382.893248][T10697] Dev loop9: unable to read RDB block 0 [ 382.923666][T10697] loop9: unable to read partition table [ 382.937746][T10699] erspan0: left promiscuous mode [ 382.968157][T10697] loop9: partition table beyond EOD, truncated [ 383.008394][T10697] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 383.118039][ T5212] ldm_validate_partition_table(): Disk read failed. [ 383.143492][ T5212] Dev loop9: unable to read RDB block 0 [ 383.162286][ T5212] loop9: unable to read partition table [ 383.186238][ T5212] loop9: partition table beyond EOD, truncated [ 383.404972][ C0] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 384.280772][T10724] netlink: 180 bytes leftover after parsing attributes in process `syz.5.1347'. [ 385.627411][T10731] loop5: detected capacity change from 0 to 2048 [ 388.130416][T10731] EXT4-fs warning (device loop5): ext4_multi_mount_protect:394: Unable to create kmmpd thread for loop5. [ 391.104724][T10772] netlink: 180 bytes leftover after parsing attributes in process `syz.2.1359'. [ 391.185544][T10770] loop5: detected capacity change from 0 to 2048 [ 391.794914][T10770] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 391.807623][T10770] ext4 filesystem being mounted at /98/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 392.333756][T10780] comedi comedi4: bad chanlist[1]=0x000058d8 chan=22744 range length=2 [ 392.429480][ T8874] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 394.587060][T10809] syzkaller0: entered promiscuous mode [ 394.609109][T10809] syzkaller0: entered allmulticast mode [ 398.243048][T10857] netlink: 180 bytes leftover after parsing attributes in process `syz.3.1387'. [ 398.931588][T10859] loop4: detected capacity change from 0 to 32768 [ 399.456626][T10861] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=984118777 (984118777 ns) > initial count (508649472 ns). Using initial count to start timer. [ 400.256845][T10871] syzkaller0: entered promiscuous mode [ 400.424545][T10878] loop5: detected capacity change from 0 to 16 [ 400.505882][T10878] erofs (device loop5): mounted with root inode @ nid 36. [ 400.526000][T10878] syz.5.1394: attempt to access beyond end of device [ 400.526000][T10878] loop5: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 400.589222][T10878] syz.5.1394: attempt to access beyond end of device [ 400.589222][T10878] loop5: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 400.604613][T10878] erofs (device loop5): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 400.616289][T10878] erofs (device loop5): read error -117 @ 1 of nid 89 [ 400.627589][ T30] audit: type=1800 audit(1774988520.800:43): pid=10878 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1394" name="file2" dev="loop5" ino=89 res=0 errno=0 [ 400.958447][ T5909] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 401.114926][ T5909] usb 2-1: Using ep0 maxpacket: 32 [ 401.122978][ T5909] usb 2-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 401.134380][ T5909] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.184463][ T5909] usb 2-1: config 0 descriptor?? [ 401.521143][T10886] fuse: Bad value for 'fd' [ 401.528655][ T5909] as10x_usb: device has been detected [ 401.552950][ T5909] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 401.774483][ T5909] usb 2-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 402.023722][T10869] loop2: detected capacity change from 0 to 32768 [ 402.116095][T10869] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 402.136500][T10869] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 402.262207][ T5909] as10x_usb: error during firmware upload part1 [ 402.294100][ T5909] Registered device nBox DVB-T Dongle [ 402.326128][ T5909] usb 2-1: USB disconnect, device number 8 [ 402.400480][ T5909] Unregistered device nBox DVB-T Dongle [ 402.403500][ T5909] as10x_usb: device has been disconnected [ 402.809722][T10869] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 402.852338][ T5926] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 402.907293][ T5926] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 403.218896][ T5926] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 311ms [ 403.392972][ T5926] gfs2: fsid=syz:syz.0: jid=0: Done [ 403.422484][T10869] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 403.502463][T10897] loop1: detected capacity change from 0 to 32768 [ 403.537842][T10869] gfs2: fsid=syz:syz.0: can't create logd thread: -4 [ 404.782906][T10918] netlink: 180 bytes leftover after parsing attributes in process `syz.3.1405'. [ 406.783684][T10910] 8021q: VLANs not supported on caif0 [ 407.161432][T10938] fuse: Bad value for 'fd' [ 408.157349][T10943] loop1: detected capacity change from 0 to 4096 [ 408.227235][T10951] tipc: Started in network mode [ 408.238454][T10951] tipc: Node identity 080211000001, cluster identity 4711 [ 408.238853][T10943] ntfs3(loop1): Mark volume as dirty due to NTFS errors [ 408.307732][T10951] tipc: Enabled bearer , priority 0 [ 408.461105][T10943] ntfs3(loop1): Failed to load $Extend (-22). [ 408.492502][T10957] 8021q: VLANs not supported on nlmon0 [ 408.493262][T10943] ntfs3(loop1): Failed to initialize $Extend. [ 408.930317][ T5909] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 409.314232][ T5909] usb 3-1: Using ep0 maxpacket: 8 [ 409.324305][ T5909] usb 3-1: unable to get BOS descriptor or descriptor too short [ 409.339185][ T5909] usb 3-1: config 4 interface 0 has no altsetting 0 [ 409.352909][ T5909] usb 3-1: string descriptor 0 read error: -22 [ 409.362676][ T5909] usb 3-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 409.377143][ T5909] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 409.484129][ T5926] tipc: Node number set to 134418688 [ 409.527678][ T5909] usb 3-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 409.599110][T10979] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1422'. [ 410.117444][ T5909] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 410.129718][ T5909] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 410.139374][ T5909] usb 3-1: media controller created [ 410.159714][ T5909] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 410.447300][ T5909] usb 3-1: USB disconnect, device number 7 [ 410.529036][T10989] tipc: Started in network mode [ 410.529068][T10989] tipc: Node identity 7ae1810780fd, cluster identity 4711 [ 410.529287][T10989] tipc: Enabled bearer , priority 0 [ 410.535454][T10989] syzkaller0: entered promiscuous mode [ 410.535478][T10989] syzkaller0: entered allmulticast mode [ 410.542114][T10989] tipc: Resetting bearer [ 410.575170][T10988] tipc: Resetting bearer [ 410.632696][T10988] tipc: Disabling bearer [ 410.738781][T10994] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1428'. [ 411.074953][ T5909] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 411.151056][T10998] 8021q: VLANs not supported on nlmon0 [ 411.238373][ T5909] usb 2-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 411.382436][ T5909] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 412.169065][ T5909] usb 2-1: config 0 descriptor?? [ 412.209935][ T5909] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 413.400122][T11019] netlink: 180 bytes leftover after parsing attributes in process `syz.5.1437'. [ 414.138765][ T5909] usb 2-1: USB disconnect, device number 9 [ 414.825856][T11025] loop5: detected capacity change from 0 to 2048 [ 415.328916][T11025] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 415.341890][T11025] ext4 filesystem being mounted at /115/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 415.385142][T11027] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1440'. [ 415.448892][T11025] fuse: Unknown parameter '0000000000000000000000000000000000000000' [ 415.485415][T11027] IPv6: NLM_F_CREATE should be specified when creating new route [ 415.897074][ T8874] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 415.910864][T11013] loop2: detected capacity change from 0 to 32768 [ 415.955140][T11033] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1442'. [ 415.989049][T11037] 8021q: VLANs not supported on nlmon0 [ 417.753136][T11061] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1449'. [ 419.261230][T11086] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1454'. [ 421.462961][T11113] loop2: detected capacity change from 0 to 2048 [ 421.736783][T11119] loop5: detected capacity change from 0 to 2048 [ 422.097963][T11119] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 422.111029][T11119] ext4 filesystem being mounted at /122/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 422.243567][T11126] fuse: Unknown parameter '0000000000000000000000000000000000000000' [ 422.527328][T11113] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 422.651014][ T8874] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 423.737725][ T5909] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 424.093709][T11148] netlink: 164 bytes leftover after parsing attributes in process `syz.1.1476'. [ 424.166530][ T5909] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 424.184593][ T5909] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.228767][ T5909] usb 6-1: config 0 descriptor?? [ 424.245500][ T5909] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 426.504705][ T5909] usb 6-1: USB disconnect, device number 3 [ 426.707124][T11181] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1487'. [ 429.000223][T11213] tipc: Enabled bearer , priority 0 [ 429.016926][T11213] syzkaller0: entered promiscuous mode [ 429.022913][T11213] syzkaller0: entered allmulticast mode [ 429.102587][T11213] tipc: Resetting bearer [ 429.122017][T11212] tipc: Resetting bearer [ 429.150009][T11212] tipc: Disabling bearer [ 432.029355][T11215] loop1: detected capacity change from 0 to 40427 [ 432.053380][T11215] F2FS-fs (loop1): Fix alignment : internally, start(4096) end(16896) block(12288) [ 432.095192][T11215] F2FS-fs (loop1): invalid crc value [ 432.313091][T11215] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 432.405445][T11215] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 433.358290][T11259] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=984118777 (984118777 ns) > initial count (508649472 ns). Using initial count to start timer. [ 435.858114][T11285] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1516'. [ 435.914955][ T5896] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 436.144936][ T5896] usb 2-1: Using ep0 maxpacket: 8 [ 436.159052][ T5896] usb 2-1: unable to get BOS descriptor or descriptor too short [ 436.176974][ T5896] usb 2-1: config 4 interface 0 has no altsetting 0 [ 436.214251][ T5896] usb 2-1: string descriptor 0 read error: -22 [ 436.229121][ T5896] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 436.328065][ T5896] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 436.388292][ T5896] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 436.458582][ T5896] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 436.504089][ T5896] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 436.526668][ T5896] usb 2-1: media controller created [ 436.567468][ T5896] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 436.840372][ T5896] usb 2-1: USB disconnect, device number 10 [ 437.059335][T11297] input: syz1 as /devices/virtual/input/input17 [ 437.897106][ T30] audit: type=1326 audit(1774988558.060:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11302 comm="syz.5.1515" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1c4eb9c819 code=0x0 [ 438.997502][T11318] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=984118777 (984118777 ns) > initial count (508649472 ns). Using initial count to start timer. [ 439.156444][ T5896] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 439.326501][ T5896] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 439.353723][ T5896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.480069][ T5896] usb 3-1: config 0 descriptor?? [ 439.496154][ T5896] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 439.706301][ T5896] usb 3-1: USB disconnect, device number 8 [ 439.969420][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.975937][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.704344][T11348] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1537'. [ 440.884936][ T9] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 440.925840][T11353] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1539'. [ 441.066384][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 441.071597][T11358] input: syz1 as /devices/virtual/input/input18 [ 441.143749][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 441.177763][ T9] usb 2-1: config 4 interface 0 has no altsetting 0 [ 441.204530][ T9] usb 2-1: string descriptor 0 read error: -22 [ 441.215175][ T9] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 441.288691][ T9] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 442.057711][ T9] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 442.107459][T11361] loop3: detected capacity change from 0 to 4096 [ 443.595669][ T9] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 443.670892][ T9] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 443.698598][T11366] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 443.724224][ T9] usb 2-1: media controller created [ 443.764777][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 443.806228][ T9] zl10353_read_register: readreg error (reg=127, ret==0) [ 443.860341][T11369] NILFS (loop3): error -2 preparing GC: cannot delete virtual blocks from DAT file [ 444.375099][ T5926] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 444.438663][ T9] usb 2-1: USB disconnect, device number 11 [ 444.616866][ T5926] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 444.651437][ T5926] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.716588][ T5926] usb 6-1: config 0 descriptor?? [ 444.766546][ T5926] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 444.774662][ T30] audit: type=1326 audit(1774988564.950:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11379 comm="syz.4.1547" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0301f9c819 code=0x0 [ 444.949677][T11388] loop2: detected capacity change from 0 to 4096 [ 445.003214][ T5926] usb 6-1: USB disconnect, device number 4 [ 445.859046][T11400] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1551'. [ 445.868094][T11400] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1551'. [ 445.885000][T11400] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1551'. [ 446.736700][ T5926] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 446.907048][ T5926] usb 4-1: Using ep0 maxpacket: 8 [ 446.940327][ T5926] usb 4-1: unable to get BOS descriptor or descriptor too short [ 446.959241][ T5926] usb 4-1: config 4 interface 0 has no altsetting 0 [ 446.984318][ T5926] usb 4-1: string descriptor 0 read error: -22 [ 447.003196][ T5926] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 447.082927][ T5926] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 447.104585][T11423] input: syz1 as /devices/virtual/input/input20 [ 447.207381][ T5926] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 447.834408][ T5926] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 447.880929][T11427] tipc: Enabling of bearer rejected, failed to enable media [ 447.915575][ T5926] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 447.938819][ T5926] usb 4-1: media controller created [ 447.988944][ T5926] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 448.378629][T11443] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1563'. [ 448.397092][T11443] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1563'. [ 448.423872][ T5926] usb 4-1: USB disconnect, device number 11 [ 448.651341][T11445] loop4: detected capacity change from 0 to 512 [ 448.660461][T11445] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 448.688361][T11445] EXT4-fs (loop4): 1 truncate cleaned up [ 448.695080][T11445] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 448.757871][T11447] loop2: detected capacity change from 0 to 4096 [ 448.843031][T11457] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 448.922471][T11460] NILFS (loop2): error -2 preparing GC: cannot delete virtual blocks from DAT file [ 448.947227][T11461] fuse: root generation should be zero [ 448.954926][ T1239] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 449.115539][ T1239] usb 5-1: Using ep0 maxpacket: 16 [ 449.138647][ T1239] usb 5-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 449.176281][ T1239] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 14 [ 449.248752][ T1239] usb 5-1: New USB device found, idVendor=05ac, idProduct=027d, bcdDevice= 0.00 [ 449.282253][ T1239] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.332637][ T1239] usb 5-1: config 0 descriptor?? [ 449.513084][ T1239] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 450.080221][T11475] tipc: Started in network mode [ 450.095675][T11475] tipc: Node identity 6ac6cc16c7cf, cluster identity 4711 [ 450.119099][T11475] tipc: Enabled bearer , priority 0 [ 450.215418][T11477] tipc: Resetting bearer [ 450.255463][T11476] syzkaller0: entered promiscuous mode [ 450.288597][T11473] tipc: Resetting bearer [ 450.347752][T11473] tipc: Disabling bearer [ 450.408363][T11448] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 450.447973][T11448] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 450.478780][T11448] EXT4-fs (loop4): shut down requested (2) [ 450.544544][T11448] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 450.585018][T11481] input: syz1 as /devices/virtual/input/input21 [ 450.663088][T11448] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 450.988691][ T5909] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 451.222829][ T5909] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 451.244036][ T5909] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.376328][ T5909] usb 6-1: config 0 descriptor?? [ 451.392644][ T5909] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 451.805136][ T1179] usb 5-1: USB disconnect, device number 13 [ 451.821554][ T5846] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 453.278574][ T5909] gspca_stv06xx: I2C: Read error writing address: -71 [ 453.306967][ T5909] usb 6-1: USB disconnect, device number 5 [ 453.432910][T11514] loop1: detected capacity change from 0 to 4096 [ 453.979065][T11529] fuse: Unknown parameter '0000000000000000000000000000000000000000' [ 455.257751][T11540] loop2: detected capacity change from 0 to 16 [ 455.286738][T11540] erofs (device loop2): mounted with root inode @ nid 36. [ 455.304580][T11540] syz.2.1592: attempt to access beyond end of device [ 455.304580][T11540] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 455.361203][T11540] syz.2.1592: attempt to access beyond end of device [ 455.361203][T11540] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 455.376495][T11540] erofs (device loop2): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 455.388098][T11540] erofs (device loop2): read error -117 @ 1 of nid 89 [ 455.408181][ T30] audit: type=1800 audit(1774988575.580:46): pid=11540 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1592" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 455.942872][T11543] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1594'. [ 456.400957][T11555] delete_channel: no stack [ 456.444423][T11554] loop5: detected capacity change from 0 to 4096 [ 456.504960][ T5896] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 456.593715][T11560] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1600'. [ 456.686946][ T5896] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 456.712654][ T5896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 456.762408][ T5896] usb 3-1: config 0 descriptor?? [ 456.781984][ T5896] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 456.794787][T11565] input: syz1 as /devices/virtual/input/input23 [ 458.088071][T11583] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1606'. [ 458.219817][T11588] usb usb8: usbfs: process 11588 (syz.1.1608) did not claim interface 0 before use [ 458.452893][T11561] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 458.637718][ T5896] gspca_stv06xx: I2C: Read error writing address: -71 [ 458.657037][ T5955] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 458.687984][ T5896] usb 3-1: USB disconnect, device number 9 [ 458.814947][ T5955] usb 5-1: Using ep0 maxpacket: 32 [ 458.838572][ T5955] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 458.872841][T11602] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1612'. [ 458.882063][ T5955] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 458.910198][ T5955] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 458.942875][ T5955] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid wMaxPacketSize 0 [ 458.973784][ T5955] usb 5-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 459.024550][ T5955] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.062527][ T5955] usb 5-1: Product: syz [ 459.077841][ T5955] usb 5-1: Manufacturer: syz [ 459.094387][ T5955] usb 5-1: SerialNumber: syz [ 459.129830][ T5955] usb 5-1: config 0 descriptor?? [ 459.180112][ T5955] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input24 [ 459.248963][T11607] loop3: detected capacity change from 0 to 4096 [ 459.547235][ T5955] usb 5-1: USB disconnect, device number 14 [ 459.994995][ T5896] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 460.166355][ T5896] usb 4-1: device descriptor read/64, error -71 [ 460.495686][ T5896] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 460.658203][ T5896] usb 4-1: device descriptor read/64, error -71 [ 460.714761][T11604] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 460.782988][T11624] pim6reg: entered allmulticast mode [ 460.813150][ T5896] usb usb4-port1: attempt power cycle [ 460.994960][ T5955] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 461.171204][ T5896] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 461.178921][ T5955] usb 5-1: Using ep0 maxpacket: 8 [ 461.186090][ T5955] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 461.196719][ T5955] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 461.207275][ T5896] usb 4-1: device descriptor read/8, error -71 [ 461.222753][ T5955] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 461.243482][ T5955] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 461.258958][ T5955] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 461.287547][ T5955] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.475041][ T5896] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 461.508841][ T5955] usb 5-1: GET_CAPABILITIES returned 0 [ 461.514574][ T5896] usb 4-1: device descriptor read/8, error -71 [ 461.524248][ T5955] usbtmc 5-1:16.0: can't read capabilities [ 461.625900][ T5896] usb usb4-port1: unable to enumerate USB device [ 461.726625][ T5896] usb 5-1: USB disconnect, device number 15 [ 461.815111][ T5955] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 461.977074][ T5955] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 461.990909][ T5955] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.008171][ T5955] usb 3-1: config 0 descriptor?? [ 462.022532][ T5955] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 463.489969][T11658] loop1: detected capacity change from 0 to 4096 [ 464.088327][ T5955] gspca_stv06xx: I2C: Read error writing address: -71 [ 464.126545][ T5955] usb 3-1: USB disconnect, device number 10 [ 464.301891][T11684] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1639'. [ 464.319478][T11684] vlan2: entered promiscuous mode [ 464.327914][T11684] batadv0: entered promiscuous mode [ 466.753583][T11721] loop5: detected capacity change from 0 to 4096 [ 467.384974][ T5926] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 467.557436][ T5926] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 467.604290][ T5926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 467.644586][ T5926] usb 3-1: config 0 descriptor?? [ 467.676193][ T5926] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 469.105136][ T5955] usb 4-1: new low-speed USB device number 16 using dummy_hcd [ 469.433361][ T5926] gspca_stv06xx: I2C: Read error writing address: -71 [ 469.467493][ T5955] usb 4-1: config index 0 descriptor too short (expected 1307, got 27) [ 469.484041][ T5926] usb 3-1: USB disconnect, device number 11 [ 469.492254][ T5955] usb 4-1: config 0 has an invalid interface number: 0 but max is -1 [ 469.511333][ T5955] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 469.528513][ T5955] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 469.548150][ T5955] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 469.560660][ T5955] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 246 [ 469.600593][ T5955] usb 4-1: string descriptor 0 read error: -22 [ 469.607148][ T5955] usb 4-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 469.624023][ T5955] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.645879][ T5955] usb 4-1: config 0 descriptor?? [ 469.659704][ T5955] hub 4-1:0.0: bad descriptor, ignoring hub [ 469.673639][ T5955] hub 4-1:0.0: probe with driver hub failed with error -5 [ 470.092274][T11770] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 470.130557][T11770] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 470.182577][T11769] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1658'. [ 470.448955][T11777] loop1: detected capacity change from 0 to 2048 [ 470.618243][T11777] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 470.631049][T11777] ext4 filesystem being mounted at /343/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 470.706733][T11777] fuse: Unknown parameter '0000000000000000000000000000000000000000' [ 471.237521][T11785] loop5: detected capacity change from 0 to 4096 [ 471.245203][T11787] fuse: Bad value for 'group_id' [ 471.262576][T11787] fuse: Bad value for 'group_id' [ 471.302039][ T5849] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 473.085690][ T5909] usb 4-1: USB disconnect, device number 16 [ 473.321107][T11825] fuse: Bad value for 'group_id' [ 473.352084][T11825] fuse: Bad value for 'group_id' [ 474.000826][T11842] syzkaller0: entered promiscuous mode [ 474.013575][T11842] syzkaller0: entered allmulticast mode [ 474.384937][ T5909] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 474.557388][T11849] loop3: detected capacity change from 0 to 1024 [ 474.585969][ T5909] usb 2-1: Using ep0 maxpacket: 32 [ 474.601821][ T5909] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 474.655955][ T5909] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 474.725580][ T13] hfsplus: b-tree write err: -5, ino 25 [ 474.736642][T11853] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1689'. [ 474.762100][ T5909] usb 2-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 474.773330][ T13] hfsplus: b-tree write err: -5, ino 4 [ 474.782362][ T5909] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.799017][ T13] hfsplus: b-tree write err: -5, ino 2 [ 474.830444][ T5909] usb 2-1: Product: syz [ 474.842646][ T5909] usb 2-1: Manufacturer: syz [ 474.859025][ T5909] usb 2-1: SerialNumber: syz [ 474.893176][ T5909] usb 2-1: config 0 descriptor?? [ 474.918290][T11854] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1689'. [ 476.045581][T11876] fuse: Bad value for 'group_id' [ 476.064769][T11876] fuse: Bad value for 'group_id' [ 476.353928][T11879] syzkaller0: entered promiscuous mode [ 476.360765][T11879] syzkaller0: entered allmulticast mode [ 476.468784][T11881] loop5: detected capacity change from 0 to 4096 [ 476.520222][T11885] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 476.658977][T11886] NILFS (loop5): error -2 preparing GC: cannot delete virtual blocks from DAT file [ 477.135468][T11892] loop2: detected capacity change from 0 to 4096 [ 477.218276][ T5909] usb 2-1: USB disconnect, device number 12 [ 477.415018][T11909] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1707'. [ 477.456180][T11909] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1707'. [ 477.718645][T11918] usb usb8: usbfs: process 11918 (syz.5.1710) did not claim interface 0 before use [ 478.384963][ T5909] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 478.554879][ T5909] usb 3-1: Using ep0 maxpacket: 32 [ 478.562494][ T5909] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 478.573516][ T5909] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 478.586873][ T5909] usb 3-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 478.611433][ T5909] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.637460][ T5909] usb 3-1: Product: syz [ 478.654635][ T5909] usb 3-1: Manufacturer: syz [ 478.668645][ T5909] usb 3-1: SerialNumber: syz [ 478.692236][ T5909] usb 3-1: config 0 descriptor?? [ 479.306019][T11950] input: syz1 as /devices/virtual/input/input25 [ 480.712447][T11962] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1724'. [ 480.744807][T11962] vlan2: entered promiscuous mode [ 481.168274][ T5955] usb 3-1: USB disconnect, device number 12 [ 481.317251][T11982] loop2: detected capacity change from 0 to 1024 [ 481.430586][ T3554] hfsplus: b-tree write err: -5, ino 25 [ 481.439482][ T3554] hfsplus: b-tree write err: -5, ino 4 [ 481.452326][ T3554] hfsplus: b-tree write err: -5, ino 2 [ 481.574122][T11984] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1731'. [ 481.603573][T11984] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1731'. [ 482.634593][T12006] input: syz1 as /devices/virtual/input/input26 [ 483.993540][T12022] loop2: detected capacity change from 0 to 512 [ 484.000932][T12022] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 484.015294][T12022] EXT4-fs (loop2): 1 truncate cleaned up [ 484.021866][T12022] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 484.104924][ T9] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 484.159167][T12026] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1739'. [ 484.254894][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 484.266732][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 484.275031][ T5926] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 484.277380][ T9] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 484.328436][ T9] usb 5-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 484.355946][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.436799][ T9] usb 5-1: Product: syz [ 484.445018][ T5926] usb 3-1: Using ep0 maxpacket: 16 [ 484.448628][ T9] usb 5-1: Manufacturer: syz [ 484.462059][ T9] usb 5-1: SerialNumber: syz [ 484.471550][ T5926] usb 3-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 484.502291][ T5926] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 14 [ 484.502606][ T9] usb 5-1: config 0 descriptor?? [ 484.531017][T12029] loop1: detected capacity change from 0 to 1024 [ 484.561199][ T5926] usb 3-1: New USB device found, idVendor=05ac, idProduct=027d, bcdDevice= 0.00 [ 484.604567][ T5926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.663338][ T5926] usb 3-1: config 0 descriptor?? [ 484.695360][ T5926] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 484.739001][ T6948] hfsplus: b-tree write err: -5, ino 25 [ 484.746147][ T6948] hfsplus: b-tree write err: -5, ino 4 [ 484.759072][ T6948] hfsplus: b-tree write err: -5, ino 2 [ 485.271453][T12037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.434669][T12037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.469589][T12037] EXT4-fs (loop2): shut down requested (2) [ 485.502584][T12037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.648038][T12037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.200847][ T5909] usb 5-1: USB disconnect, device number 16 [ 487.276169][ T5955] usb 3-1: USB disconnect, device number 13 [ 487.813744][ T5854] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 489.041322][T12055] input: syz1 as /devices/virtual/input/input27 [ 494.225004][ T1179] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 494.594914][ T1179] usb 2-1: Using ep0 maxpacket: 32 [ 494.613070][ T1179] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 494.652322][ T1179] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.701421][ T1179] usb 2-1: config 0 descriptor?? [ 495.074857][ T0] NOHZ tick-stop error: local softirq work is pending, handler #282!!! [ 495.267108][ T1179] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 495.436097][ T1179] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 495.477730][ T1179] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 495.517622][ T1179] usb 2-1: media controller created [ 495.621879][ T1179] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 495.908446][ T1179] DVB: Unable to find symbol dib7000p_attach() [ 495.939886][ T1179] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 496.166128][ T1179] rc_core: IR keymap rc-dib0700-rc5 not found [ 496.204275][ T1179] Registered IR keymap rc-empty [ 496.230782][ T1179] dvb-usb: could not initialize remote control. [ 496.251409][ T1179] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 496.354312][ T1179] usb 2-1: USB disconnect, device number 13 [ 496.594482][ T1179] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 496.923591][T12095] loop4: detected capacity change from 0 to 512 [ 496.957716][T12095] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 497.012857][T12095] EXT4-fs (loop4): 1 truncate cleaned up [ 497.059100][T12095] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 497.603243][ T5896] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 497.863688][ T5896] usb 5-1: Using ep0 maxpacket: 16 [ 497.932156][ T5896] usb 5-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 497.962509][ T5896] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 14 [ 498.009622][T12101] 8021q: adding VLAN 0 to HW filter on device bond1 [ 498.145851][ T5896] usb 5-1: New USB device found, idVendor=05ac, idProduct=027d, bcdDevice= 0.00 [ 498.189276][ T5896] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.617169][ T5896] usb 5-1: config 0 descriptor?? [ 498.978789][ T5896] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 499.384108][T12107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.573466][T12107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.879115][T12103] bond1: (slave veth3): Enslaving as an active interface with an up link [ 500.227097][T12107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.272176][T12101] vlan0: entered allmulticast mode [ 500.283137][T12107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.302287][T12101] veth0_to_bond: entered allmulticast mode [ 500.329003][T12101] bond1: (slave vlan0): Opening slave failed [ 501.453389][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.649275][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.260938][ T5896] usb 5-1: USB disconnect, device number 17 [ 504.793868][ T5846] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 505.834858][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 506.302104][T12116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1763'. [ 507.578520][T12139] loop2: detected capacity change from 0 to 16 [ 507.769949][T12139] erofs (device loop2): mounted with root inode @ nid 36. [ 507.855302][T12146] syzkaller0: entered promiscuous mode [ 507.902524][T12146] syzkaller0: entered allmulticast mode [ 511.471358][T12139] syz.2.1772: attempt to access beyond end of device [ 511.471358][T12139] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 512.202338][T12139] syz.2.1772: attempt to access beyond end of device [ 512.202338][T12139] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 512.363192][T12156] input: syz1 as /devices/virtual/input/input30 [ 512.529775][T12139] erofs (device loop2): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 512.750956][T12139] erofs (device loop2): read error -117 @ 1 of nid 89 [ 513.126567][ T30] audit: type=1800 audit(1774988633.300:47): pid=12139 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1772" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 513.242295][T12175] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1780'. [ 524.373118][ C1] sched: DL replenish lagged too much [ 526.092878][T12210] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1791'. [ 526.314844][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 528.379662][T12218] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 528.925103][ T1179] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 529.485095][ C0] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 529.933814][ T1179] usb 4-1: config 6 has an invalid interface number: 14 but max is 0 [ 529.991853][ T1179] usb 4-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 530.090311][ T1179] usb 4-1: config 6 has no interface number 0 [ 530.136888][ T1239] usb 3-1: new full-speed USB device number 14 using dummy_hcd [ 530.148526][ T1179] usb 4-1: config 6 interface 14 altsetting 218 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 530.316711][ T1179] usb 4-1: config 6 interface 14 has no altsetting 0 [ 530.341561][ T1239] usb 3-1: device descriptor read/64, error -71 [ 530.341950][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 530.373225][ T1179] usb 4-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 530.381534][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 530.407452][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 530.447449][ T1179] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.524913][ C0] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 530.574157][ T1179] usb 4-1: Product: syz [ 530.598929][ T1179] usb 4-1: Manufacturer: syz [ 530.680894][ T1179] usb 4-1: SerialNumber: syz [ 530.835484][ T1239] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 536.070609][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 536.249693][ T1179] usb 4-1: can't set config #6, error -71 [ 536.275401][ T1179] usb 4-1: USB disconnect, device number 17 [ 538.746885][ T5850] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 538.890781][ T5850] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 538.971441][ T5850] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 539.073583][ T5850] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 539.191789][ T5850] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 539.881132][T12254] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 539.910835][T12254] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 539.925661][T12254] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 539.944069][T12254] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 539.953602][T12254] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 541.375109][ T1239] usb 3-1: device descriptor read/64, error -110 [ 541.406018][T12254] Bluetooth: hci5: command tx timeout [ 541.557386][ T1239] usb usb3-port1: attempt power cycle [ 541.996788][ T1239] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 542.216457][T12254] Bluetooth: hci6: command tx timeout [ 542.245358][ T1239] usb 3-1: device descriptor read/8, error -32 [ 543.098144][ T1239] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 543.603483][T12254] Bluetooth: hci5: command tx timeout [ 543.610195][ T1239] usb 3-1: device descriptor read/8, error -32 [ 543.866258][ T1239] usb usb3-port1: unable to enumerate USB device [ 544.406700][T12254] Bluetooth: hci6: command tx timeout [ 545.645020][T12254] Bluetooth: hci5: command tx timeout [ 546.445360][T12254] Bluetooth: hci6: command tx timeout [ 547.392403][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.740442][T12254] Bluetooth: hci5: command tx timeout [ 547.775495][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.123119][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.478974][ T13] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.525286][T12254] Bluetooth: hci6: command tx timeout [ 548.656856][T12249] chnl_net:caif_netlink_parms(): no params data found [ 548.668681][ T1239] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 548.861242][ T1239] usb 5-1: config 0 has an invalid interface number: 69 but max is 0 [ 548.894606][ T1239] usb 5-1: config 0 has an invalid descriptor of length 238, skipping remainder of the config [ 548.967898][ T1239] usb 5-1: config 0 has no interface number 0 [ 548.995752][ T1239] usb 5-1: config 0 interface 69 altsetting 0 endpoint 0x8 has invalid maxpacket 3791, setting to 1024 [ 549.050751][ T1239] usb 5-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1024 [ 549.109440][ T1239] usb 5-1: config 0 interface 69 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 549.161325][ T1239] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 549.177318][T12253] chnl_net:caif_netlink_parms(): no params data found [ 549.190886][ T1239] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.204540][T12318] netlink: 'syz.3.1826': attribute type 1 has an invalid length. [ 549.225659][ T1239] usb 5-1: Product: syz [ 549.239448][ T1239] usb 5-1: Manufacturer: syz [ 549.256970][ T1239] usb 5-1: SerialNumber: syz [ 549.284078][ T1239] usb 5-1: config 0 descriptor?? [ 549.297362][T12320] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1826'. [ 549.315275][T12302] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 549.324956][T12320] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1826'. [ 549.345930][ T1239] cyberjack 5-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 549.377327][ T1239] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 549.445360][ T1239] usb 5-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 549.456274][T12318] bond2: entered promiscuous mode [ 549.474414][T12318] 8021q: adding VLAN 0 to HW filter on device bond2 [ 549.711967][T12321] bond2: (slave bridge1): making interface the new active one [ 549.740926][T12321] bridge1: entered promiscuous mode [ 549.757548][T12321] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 550.023388][T12249] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.039495][T12249] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.055662][T12249] bridge_slave_0: entered allmulticast mode [ 550.063771][T12249] bridge_slave_0: entered promiscuous mode [ 550.150061][T12249] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.160562][T12249] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.168403][T12249] bridge_slave_1: entered allmulticast mode [ 550.177602][T12249] bridge_slave_1: entered promiscuous mode [ 550.194739][ T9] usb 5-1: USB disconnect, device number 18 [ 550.289648][ T9] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 550.344358][ T9] cyberjack 5-1:0.69: device disconnected [ 550.538433][T12249] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 550.577033][T12253] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.593380][T12253] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.616795][T12253] bridge_slave_0: entered allmulticast mode [ 550.629069][T12253] bridge_slave_0: entered promiscuous mode [ 550.649232][T12249] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 550.679155][T12253] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.700592][T12253] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.714582][T12253] bridge_slave_1: entered allmulticast mode [ 550.752130][T12253] bridge_slave_1: entered promiscuous mode [ 550.858130][ T13] bridge_slave_1: left allmulticast mode [ 550.887738][ T13] bridge_slave_1: left promiscuous mode [ 550.908103][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.982624][ T13] bridge_slave_0: left allmulticast mode [ 551.255925][T12338] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1829'. [ 551.271998][ T13] bridge_slave_0: left promiscuous mode [ 551.282129][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 551.781593][ T13] lo: left allmulticast mode [ 553.760831][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 553.861067][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 553.936271][ T13] bond0 (unregistering): Released all slaves [ 554.960366][ T13] tipc: Left network mode [ 555.009184][T12249] team0: Port device team_slave_0 added [ 555.053336][T12253] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 555.139064][T12253] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 555.317657][T12249] team0: Port device team_slave_1 added [ 555.389797][T12372] loop3: detected capacity change from 0 to 16 [ 555.458019][T12372] erofs (device loop3): mounted with root inode @ nid 36. [ 555.479596][T12372] syz.3.1835: attempt to access beyond end of device [ 555.479596][T12372] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 555.527183][T12372] syz.3.1835: attempt to access beyond end of device [ 555.527183][T12372] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 555.547137][T12372] erofs (device loop3): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 555.565388][T12372] erofs (device loop3): read error -117 @ 1 of nid 89 [ 555.586995][ T30] audit: type=1800 audit(1774988675.760:48): pid=12372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1835" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 556.374679][T12253] team0: Port device team_slave_0 added [ 556.404646][T12383] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1838'. [ 556.483360][T12380] vlan2: entered allmulticast mode [ 556.504355][T12380] bond0: entered allmulticast mode [ 556.520891][T12380] bond_slave_0: entered allmulticast mode [ 556.553080][T12380] bond_slave_1: entered allmulticast mode [ 556.687106][T12249] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 556.712543][T12249] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 556.780884][T12249] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 556.811590][T12253] team0: Port device team_slave_1 added [ 556.909648][T12383] bond0 (unregistering): left promiscuous mode [ 556.921250][T12383] bond_slave_0: left promiscuous mode [ 556.939430][T12383] bond_slave_1: left promiscuous mode [ 556.998638][T12383] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 557.043518][T12383] bond_slave_0: left allmulticast mode [ 557.089769][T12383] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 557.123477][T12383] bond_slave_1: left allmulticast mode [ 557.141234][T12383] bond0 (unregistering): Released all slaves [ 557.256884][T12249] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 557.308683][T12249] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 557.430818][T12249] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 557.921969][ T13] hsr_slave_0: left promiscuous mode [ 557.935396][ T9] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 557.946865][ T13] hsr_slave_1: left promiscuous mode [ 557.953101][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 557.964371][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 557.978839][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 557.987331][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 558.111552][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 558.121895][ T9] usb 5-1: config 6 has an invalid interface number: 2 but max is 0 [ 558.138970][ T9] usb 5-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 558.160192][ T9] usb 5-1: config 6 has no interface number 0 [ 558.170200][ T9] usb 5-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xAA, changing to 0x8A [ 558.200294][ T9] usb 5-1: config 6 interface 2 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 558.223160][ T9] usb 5-1: config 6 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 558.253810][ T9] usb 5-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 558.274208][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.299646][ T9] usb 5-1: Product: syz [ 558.309069][ T9] usb 5-1: Manufacturer: syz [ 558.320990][ T9] usb 5-1: SerialNumber: syz [ 558.353376][ T9] hso 5-1:6.2: Failed to find INT IN ep [ 558.387462][ T13] team0 (unregistering): Port device team_slave_1 removed [ 558.427163][ T13] team0 (unregistering): Port device team_slave_0 removed [ 558.579210][ T9] usb 5-1: USB disconnect, device number 19 [ 558.731160][T12253] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 558.748524][T12253] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 558.836763][T12253] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 558.867112][T12253] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 558.884651][T12253] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 558.941741][T12253] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 558.983277][T12249] hsr_slave_0: entered promiscuous mode [ 559.007651][T12249] hsr_slave_1: entered promiscuous mode [ 559.037642][T12249] debugfs: 'hsr0' already exists in 'hsr' [ 559.055902][T12249] Cannot create hsr debugfs directory [ 559.559001][T12253] hsr_slave_0: entered promiscuous mode [ 559.603891][T12253] hsr_slave_1: entered promiscuous mode [ 559.647328][T12253] debugfs: 'hsr0' already exists in 'hsr' [ 559.673656][T12253] Cannot create hsr debugfs directory [ 561.064332][T12427] @: renamed from vlan0 (while UP) [ 563.697082][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.704791][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.399078][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.406985][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 670.582919][ T5842] Bluetooth: hci5: command 0x0406 tx timeout [ 670.583038][ T5842] Bluetooth: hci6: command 0x0406 tx timeout [ 722.852985][ T31] INFO: task kworker/u8:1:13 blocked for more than 143 seconds. [ 722.853019][ T31] Tainted: G L syzkaller #0 [ 722.853030][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 722.853040][ T31] task:kworker/u8:1 state:D stack:23256 pid:13 tgid:13 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 722.853087][ T31] Workqueue: netns cleanup_net [ 722.853127][ T31] Call Trace: [ 722.853139][ T31] [ 722.853154][ T31] __schedule+0x165c/0x5520 [ 722.853212][ T31] ? __pfx___schedule+0x10/0x10 [ 722.853245][ T31] ? schedule+0x90/0x360 [ 722.853272][ T31] schedule+0x164/0x360 [ 722.853297][ T31] schedule_preempt_disabled+0x13/0x30 [ 722.853320][ T31] __mutex_lock+0x856/0x1420 [ 722.853357][ T31] ? __mutex_lock+0x5fc/0x1420 [ 722.853385][ T31] ? fib_net_exit_batch+0x22/0xf0 [ 722.853412][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 722.853437][ T31] ? __pfx_evict+0x10/0x10 [ 722.853471][ T31] fib_net_exit_batch+0x22/0xf0 [ 722.853502][ T31] ? __pfx_fib_net_exit_batch+0x10/0x10 [ 722.853522][ T31] ops_undo_list+0x52b/0x940 [ 722.853550][ T31] ? __pfx_ops_undo_list+0x10/0x10 [ 722.853573][ T31] ? idr_destroy+0x218/0x290 [ 722.853595][ T31] ? do_raw_spin_unlock+0xf5/0x210 [ 722.853623][ T31] cleanup_net+0x56b/0x800 [ 722.853647][ T31] ? __pfx_cleanup_net+0x10/0x10 [ 722.853674][ T31] ? process_scheduled_works+0xa70/0x1860 [ 722.853700][ T31] ? process_scheduled_works+0xa70/0x1860 [ 722.853728][ T31] process_scheduled_works+0xb5d/0x1860 [ 722.853783][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 722.853817][ T31] ? assign_work+0x3d5/0x5e0 [ 722.853849][ T31] worker_thread+0xa53/0xfc0 [ 722.853894][ T31] kthread+0x388/0x470 [ 722.853916][ T31] ? __pfx_worker_thread+0x10/0x10 [ 722.853942][ T31] ? __pfx_kthread+0x10/0x10 [ 722.853965][ T31] ret_from_fork+0x514/0xb70 [ 722.853995][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 722.854022][ T31] ? __switch_to+0xc79/0x1410 [ 722.854049][ T31] ? __pfx_kthread+0x10/0x10 [ 722.854072][ T31] ret_from_fork_asm+0x1a/0x30 [ 722.854108][ T31] [ 722.854212][ T31] INFO: task kworker/u8:9:3530 blocked for more than 143 seconds. [ 722.854229][ T31] Tainted: G L syzkaller #0 [ 722.854240][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 722.854249][ T31] task:kworker/u8:9 state:D stack:22680 pid:3530 tgid:3530 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 722.854293][ T31] Workqueue: ipv6_addrconf addrconf_verify_work [ 722.854315][ T31] Call Trace: [ 722.854322][ T31] [ 722.854335][ T31] __schedule+0x165c/0x5520 [ 722.854389][ T31] ? __pfx___schedule+0x10/0x10 [ 722.854421][ T31] ? schedule+0x90/0x360 [ 722.854447][ T31] schedule+0x164/0x360 [ 722.854473][ T31] schedule_preempt_disabled+0x13/0x30 [ 722.854501][ T31] __mutex_lock+0x856/0x1420 [ 722.854533][ T31] ? __mutex_lock+0x5fc/0x1420 [ 722.854561][ T31] ? addrconf_verify_work+0x19/0x30 [ 722.854584][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 722.854616][ T31] ? process_scheduled_works+0xa70/0x1860 [ 722.854655][ T31] addrconf_verify_work+0x19/0x30 [ 722.854673][ T31] ? process_scheduled_works+0xa70/0x1860 [ 722.854698][ T31] process_scheduled_works+0xb5d/0x1860 [ 722.854754][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 722.854788][ T31] ? assign_work+0x3d5/0x5e0 [ 722.854819][ T31] worker_thread+0xa53/0xfc0 [ 722.863471][ T31] kthread+0x388/0x470 [ 722.863509][ T31] ? __pfx_worker_thread+0x10/0x10 [ 722.863536][ T31] ? __pfx_kthread+0x10/0x10 [ 722.863560][ T31] ret_from_fork+0x514/0xb70 [ 722.863589][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 722.863616][ T31] ? __switch_to+0xc79/0x1410 [ 722.863643][ T31] ? __pfx_kthread+0x10/0x10 [ 722.863666][ T31] ret_from_fork_asm+0x1a/0x30 [ 722.863702][ T31] [ 722.863752][ T31] INFO: task kworker/u8:12:6948 blocked for more than 143 seconds. [ 722.863769][ T31] Tainted: G L syzkaller #0 [ 722.863780][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 722.863789][ T31] task:kworker/u8:12 state:D stack:21352 pid:6948 tgid:6948 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 722.863833][ T31] Workqueue: events_unbound linkwatch_event [ 722.863865][ T31] Call Trace: [ 722.863872][ T31] [ 722.863884][ T31] __schedule+0x165c/0x5520 [ 722.863938][ T31] ? __pfx___schedule+0x10/0x10 [ 722.863970][ T31] ? schedule+0x90/0x360 [ 722.863997][ T31] schedule+0x164/0x360 [ 722.864023][ T31] schedule_preempt_disabled+0x13/0x30 [ 722.864045][ T31] __mutex_lock+0x856/0x1420 [ 722.864077][ T31] ? __mutex_lock+0x5fc/0x1420 [ 722.864105][ T31] ? linkwatch_event+0xe/0x60 [ 722.864131][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 722.864170][ T31] ? process_scheduled_works+0xa70/0x1860 [ 722.864195][ T31] ? process_scheduled_works+0xa70/0x1860 [ 722.864223][ T31] linkwatch_event+0xe/0x60 [ 722.864247][ T31] process_scheduled_works+0xb5d/0x1860 [ 722.864303][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 722.864336][ T31] ? assign_work+0x3d5/0x5e0 [ 722.864368][ T31] worker_thread+0xa53/0xfc0 [ 722.864413][ T31] kthread+0x388/0x470 [ 722.864435][ T31] ? __pfx_worker_thread+0x10/0x10 [ 722.864460][ T31] ? __pfx_kthread+0x10/0x10 [ 722.864483][ T31] ret_from_fork+0x514/0xb70 [ 722.864519][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 722.864546][ T31] ? __switch_to+0xc79/0x1410 [ 722.864572][ T31] ? __pfx_kthread+0x10/0x10 [ 722.864595][ T31] ret_from_fork_asm+0x1a/0x30 [ 722.864630][ T31] [ 722.864647][ T31] INFO: task syz-executor:12249 blocked for more than 143 seconds. [ 722.864663][ T31] Tainted: G L syzkaller #0 [ 722.864674][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 722.864682][ T31] task:syz-executor state:D stack:22192 pid:12249 tgid:12249 ppid:12234 task_flags:0x400140 flags:0x00080000 [ 722.864724][ T31] Call Trace: [ 722.864731][ T31] [ 722.864742][ T31] __schedule+0x165c/0x5520 [ 722.864796][ T31] ? __pfx___schedule+0x10/0x10 [ 722.882502][ T31] ? schedule+0x90/0x360 [ 722.882541][ T31] schedule+0x164/0x360 [ 722.882567][ T31] schedule_preempt_disabled+0x13/0x30 [ 722.882590][ T31] __mutex_lock+0x856/0x1420 [ 722.882615][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 722.882652][ T31] ? __mutex_lock+0x5fc/0x1420 [ 722.882681][ T31] ? register_nexthop_notifier+0x88/0x290 [ 722.882712][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 722.882744][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 722.882770][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 722.882790][ T31] ? lock_acquire+0x106/0x350 [ 722.882819][ T31] register_nexthop_notifier+0x88/0x290 [ 722.882846][ T31] ? devlink_resource_find+0xb2/0xe0 [ 722.882870][ T31] ? __pfx_register_nexthop_notifier+0x10/0x10 [ 722.882901][ T31] ? devlink_resource_find+0xbc/0xe0 [ 722.882928][ T31] nsim_fib_create+0x813/0xa10 [ 722.882962][ T31] ? __pfx_nsim_fib_create+0x10/0x10 [ 722.882997][ T31] nsim_drv_probe+0x803/0xc20 [ 722.883015][ T31] ? up_write+0x1ab/0x410 [ 722.883045][ T31] ? __pfx_nsim_drv_probe+0x10/0x10 [ 722.883063][ T31] ? kernfs_put+0x4bf/0x520 [ 722.883091][ T31] ? kernfs_create_link+0x187/0x200 [ 722.883121][ T31] ? driver_sysfs_add+0x1fe/0x210 [ 722.883143][ T31] ? __pfx_nsim_bus_probe+0x10/0x10 [ 722.883167][ T31] really_probe+0x267/0xaf0 [ 722.883194][ T31] __driver_probe_device+0x18c/0x320 [ 722.883217][ T31] driver_probe_device+0x4f/0x240 [ 722.883241][ T31] __device_attach_driver+0x279/0x430 [ 722.883266][ T31] bus_for_each_drv+0x258/0x2f0 [ 722.883292][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 722.883312][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 722.883346][ T31] __device_attach+0x2c5/0x450 [ 722.883368][ T31] ? __pfx___device_attach+0x10/0x10 [ 722.883391][ T31] ? _raw_spin_unlock+0x28/0x50 [ 722.883417][ T31] device_initial_probe+0xa1/0xd0 [ 722.883439][ T31] bus_probe_device+0x12a/0x220 [ 722.883462][ T31] ? device_add+0x726/0xb70 [ 722.883497][ T31] device_add+0x7b6/0xb70 [ 722.883529][ T31] new_device_store+0x37b/0x710 [ 722.883558][ T31] ? __pfx_new_device_store+0x10/0x10 [ 722.883583][ T31] ? sysfs_file_kobj+0x1a/0x230 [ 722.883607][ T31] ? sysfs_file_kobj+0x1e4/0x230 [ 722.883631][ T31] ? sysfs_kf_write+0x166/0x260 [ 722.883659][ T31] ? __pfx_sysfs_kf_write+0x10/0x10 [ 722.883680][ T31] kernfs_fop_write_iter+0x3af/0x540 [ 722.883709][ T31] vfs_write+0x61d/0xb90 [ 722.883737][ T31] ? __pfx_vfs_write+0x10/0x10 [ 722.883760][ T31] ? do_sys_openat2+0x14c/0x200 [ 722.883783][ T31] ? kmem_cache_free+0x182/0x650 [ 722.883801][ T31] ? fd_install+0x94/0x3d0 [ 722.883840][ T31] ksys_write+0x150/0x270 [ 722.883862][ T31] ? __pfx_ksys_write+0x10/0x10 [ 722.883890][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.883912][ T31] do_syscall_64+0x15f/0xf80 [ 722.883936][ T31] ? trace_irq_disable+0x3b/0x140 [ 722.883959][ T31] ? clear_bhb_loop+0x40/0x90 [ 722.883983][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.884003][ T31] RIP: 0033:0x7f75d9f5d04e [ 722.884032][ T31] RSP: 002b:00007fff5c7b7268 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 722.884054][ T31] RAX: ffffffffffffffda RBX: 00005555907e9500 RCX: 00007f75d9f5d04e [ 722.884068][ T31] RDX: 0000000000000003 RSI: 00007fff5c7b72f0 RDI: 0000000000000005 [ 722.884080][ T31] RBP: 00007f75da033538 R08: 0000000000000000 R09: 0000000000000000 [ 722.884093][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 722.884105][ T31] R13: 00007fff5c7b72f0 R14: 00007f75dad44620 R15: 0000000000000003 [ 722.884135][ T31] [ 722.884145][ T31] INFO: task syz-executor:12253 blocked for more than 143 seconds. [ 722.884162][ T31] Tainted: G L syzkaller #0 [ 722.884173][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 722.884183][ T31] task:syz-executor state:D stack:22552 pid:12253 tgid:12253 ppid:12242 task_flags:0x400140 flags:0x00080000 [ 722.884226][ T31] Call Trace: [ 722.884233][ T31] [ 722.884245][ T31] __schedule+0x165c/0x5520 [ 722.884299][ T31] ? __pfx___schedule+0x10/0x10 [ 722.884332][ T31] ? schedule+0x90/0x360 [ 722.884359][ T31] schedule+0x164/0x360 [ 722.884384][ T31] schedule_preempt_disabled+0x13/0x30 [ 722.884407][ T31] __mutex_lock+0x856/0x1420 [ 722.884439][ T31] ? __mutex_lock+0x5fc/0x1420 [ 722.884467][ T31] ? del_device_store+0xd7/0x370 [ 722.884503][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 722.884529][ T31] ? sysfs_file_kobj+0x1a/0x230 [ 722.884555][ T31] ? sysfs_file_kobj+0x1a/0x230 [ 722.884587][ T31] del_device_store+0xd7/0x370 [ 722.884612][ T31] ? sysfs_file_kobj+0x1a/0x230 [ 722.884636][ T31] ? __pfx_del_device_store+0x10/0x10 [ 722.884662][ T31] ? sysfs_file_kobj+0x1e4/0x230 [ 722.884686][ T31] ? sysfs_kf_write+0x166/0x260 [ 722.884713][ T31] ? __pfx_sysfs_kf_write+0x10/0x10 [ 722.884735][ T31] kernfs_fop_write_iter+0x3af/0x540 [ 722.884763][ T31] vfs_write+0x61d/0xb90 [ 722.884790][ T31] ? __pfx_vfs_write+0x10/0x10 [ 722.884812][ T31] ? do_sys_openat2+0x14c/0x200 [ 727.979239][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 727.986952][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 742.240364][ T31] ? kmem_cache_free+0x182/0x650 [ 742.240398][ T31] ? fd_install+0x94/0x3d0 [ 742.240440][ T31] ksys_write+0x150/0x270 [ 742.240465][ T31] ? __pfx_ksys_write+0x10/0x10 [ 742.240494][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.240515][ T31] do_syscall_64+0x15f/0xf80 [ 742.240540][ T31] ? trace_irq_disable+0x3b/0x140 [ 742.240563][ T31] ? clear_bhb_loop+0x40/0x90 [ 742.240587][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.240607][ T31] RIP: 0033:0x7fdb3f15d04e [ 742.240625][ T31] RSP: 002b:00007ffc986b47f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 742.240648][ T31] RAX: ffffffffffffffda RBX: 0000555566394500 RCX: 00007fdb3f15d04e [ 742.240662][ T31] RDX: 0000000000000001 RSI: 00007ffc986b4880 RDI: 0000000000000005 [ 742.240674][ T31] RBP: 00007fdb3f233514 R08: 0000000000000000 R09: 0000000000000000 [ 742.240686][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 742.240698][ T31] R13: 00007ffc986b4880 R14: 00007fdb3ff44620 R15: 0000000000000003 [ 742.240728][ T31] [ 742.240750][ T31] INFO: task syz.3.1852:12436 blocked for more than 162 seconds. [ 742.240768][ T31] Tainted: G L syzkaller #0 [ 742.240779][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 742.240788][ T31] task:syz.3.1852 state:D stack:27416 pid:12436 tgid:12432 ppid:5837 task_flags:0x400140 flags:0x00080002 [ 742.240836][ T31] Call Trace: [ 742.240844][ T31] [ 742.240856][ T31] __schedule+0x165c/0x5520 [ 742.240910][ T31] ? __pfx___schedule+0x10/0x10 [ 742.240950][ T31] ? schedule+0x90/0x360 [ 742.240977][ T31] schedule+0x164/0x360 [ 742.241002][ T31] schedule_preempt_disabled+0x13/0x30 [ 742.241025][ T31] __mutex_lock+0x856/0x1420 [ 742.241057][ T31] ? __mutex_lock+0x5fc/0x1420 [ 742.241086][ T31] ? tun_chr_close+0x3e/0x1c0 [ 742.241115][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 742.241158][ T31] ? __pfx_tun_chr_close+0x10/0x10 [ 742.241185][ T31] tun_chr_close+0x3e/0x1c0 [ 742.241213][ T31] __fput+0x44f/0xa70 [ 742.241250][ T31] fput_close_sync+0x11f/0x240 [ 742.241276][ T31] ? __pfx_fput_close_sync+0x10/0x10 [ 742.241306][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.241329][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.241348][ T31] __x64_sys_close+0x7e/0x110 [ 742.241372][ T31] do_syscall_64+0x15f/0xf80 [ 742.241396][ T31] ? clear_bhb_loop+0x40/0x90 [ 742.241418][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.241437][ T31] RIP: 0033:0x7f393499c819 [ 742.241453][ T31] RSP: 002b:00007f393593a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 742.241473][ T31] RAX: ffffffffffffffda RBX: 00007f3934c15fa0 RCX: 00007f393499c819 [ 742.241488][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 742.241500][ T31] RBP: 00007f3934a32c91 R08: 0000000000000000 R09: 0000000000000000 [ 742.241512][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 742.241524][ T31] R13: 00007f3934c16038 R14: 00007f3934c15fa0 R15: 00007ffc7bd627f8 [ 742.241555][ T31] [ 742.241564][ T31] INFO: task syz.3.1852:12439 blocked for more than 162 seconds. [ 742.241580][ T31] Tainted: G L syzkaller #0 [ 742.241591][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 742.241600][ T31] task:syz.3.1852 state:D stack:28088 pid:12439 tgid:12432 ppid:5837 task_flags:0x400140 flags:0x00080002 [ 742.241646][ T31] Call Trace: [ 742.241653][ T31] [ 742.241665][ T31] __schedule+0x165c/0x5520 [ 742.241719][ T31] ? __pfx___schedule+0x10/0x10 [ 742.241750][ T31] ? schedule+0x90/0x360 [ 742.241777][ T31] schedule+0x164/0x360 [ 742.241803][ T31] schedule_preempt_disabled+0x13/0x30 [ 742.241825][ T31] __mutex_lock+0x856/0x1420 [ 742.241858][ T31] ? __mutex_lock+0x5fc/0x1420 [ 742.241887][ T31] ? rtnetlink_rcv_msg+0x722/0xbe0 [ 742.241911][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 742.241963][ T31] rtnetlink_rcv_msg+0x722/0xbe0 [ 742.241987][ T31] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 742.242007][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 742.242027][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 742.242069][ T31] netlink_rcv_skb+0x232/0x4b0 [ 742.242091][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 742.242113][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 742.242144][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 742.242172][ T31] netlink_unicast+0x80f/0x9b0 [ 742.242207][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 742.242237][ T31] ? netlink_sendmsg+0x650/0xb40 [ 742.242256][ T31] ? skb_put+0x11b/0x210 [ 742.242282][ T31] netlink_sendmsg+0x813/0xb40 [ 742.242312][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 742.242336][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 742.242364][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 742.242396][ T31] ____sys_sendmsg+0x972/0x9f0 [ 742.242420][ T31] ? __might_fault+0xaf/0x130 [ 742.242453][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 742.242486][ T31] ? import_iovec+0x73/0xa0 [ 742.242514][ T31] ___sys_sendmsg+0x2a5/0x360 [ 742.242537][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 742.242567][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 742.242598][ T31] ? futex_wake+0x4ac/0x580 [ 742.242645][ T31] ? __fget_files+0x2a/0x420 [ 742.242669][ T31] ? __fget_files+0x3a0/0x420 [ 742.242704][ T31] __x64_sys_sendmsg+0x1bd/0x2a0 [ 742.242736][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 742.242768][ T31] ? rcu_is_watching+0x15/0xb0 [ 742.242797][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.242818][ T31] do_syscall_64+0x15f/0xf80 [ 742.242841][ T31] ? trace_irq_disable+0x3b/0x140 [ 742.242864][ T31] ? clear_bhb_loop+0x40/0x90 [ 742.242888][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.242906][ T31] RIP: 0033:0x7f393499c819 [ 742.242931][ T31] RSP: 002b:00007f3935919028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 742.242952][ T31] RAX: ffffffffffffffda RBX: 00007f3934c16090 RCX: 00007f393499c819 [ 742.242966][ T31] RDX: 00000000000000e0 RSI: 0000200000000000 RDI: 0000000000000004 [ 742.242979][ T31] RBP: 00007f3934a32c91 R08: 0000000000000000 R09: 0000000000000000 [ 742.242991][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 742.243004][ T31] R13: 00007f3934c16128 R14: 00007f3934c16090 R15: 00007ffc7bd627f8 [ 742.243035][ T31] [ 742.243043][ T31] INFO: task syz.3.1852:12442 blocked for more than 162 seconds. [ 742.243059][ T31] Tainted: G L syzkaller #0 [ 742.243070][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 742.243079][ T31] task:syz.3.1852 state:D stack:28088 pid:12442 tgid:12432 ppid:5837 task_flags:0x400140 flags:0x00080002 [ 742.243125][ T31] Call Trace: [ 742.243132][ T31] [ 742.243145][ T31] __schedule+0x165c/0x5520 [ 742.243198][ T31] ? __pfx___schedule+0x10/0x10 [ 742.243231][ T31] ? schedule+0x90/0x360 [ 742.243258][ T31] schedule+0x164/0x360 [ 742.243283][ T31] schedule_preempt_disabled+0x13/0x30 [ 742.243306][ T31] __mutex_lock+0x856/0x1420 [ 742.243338][ T31] ? __mutex_lock+0x5fc/0x1420 [ 742.243366][ T31] ? rtnetlink_rcv_msg+0x722/0xbe0 [ 742.243390][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 742.243435][ T31] rtnetlink_rcv_msg+0x722/0xbe0 [ 742.243459][ T31] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 742.243479][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 742.243499][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 742.243539][ T31] netlink_rcv_skb+0x232/0x4b0 [ 742.243560][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 742.243583][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 742.243613][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 742.243641][ T31] netlink_unicast+0x80f/0x9b0 [ 742.243675][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 742.243705][ T31] ? netlink_sendmsg+0x650/0xb40 [ 742.243724][ T31] ? skb_put+0x11b/0x210 [ 742.243749][ T31] netlink_sendmsg+0x813/0xb40 [ 742.243778][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 742.243800][ T31] ? __se_sys_ioctl+0x47/0x170 [ 742.243820][ T31] ? do_syscall_64+0x15f/0xf80 [ 742.243843][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 742.243865][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 742.243896][ T31] ____sys_sendmsg+0x972/0x9f0 [ 742.243925][ T31] ? __might_fault+0xaf/0x130 [ 742.243958][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 742.243991][ T31] ? import_iovec+0x73/0xa0 [ 742.244017][ T31] ___sys_sendmsg+0x2a5/0x360 [ 742.244040][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 742.244070][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 742.244101][ T31] ? tomoyo_path_number_perm+0x219/0x630 [ 742.244154][ T31] ? __fget_files+0x2a/0x420 [ 742.244179][ T31] ? __fget_files+0x3a0/0x420 [ 742.244214][ T31] __x64_sys_sendmsg+0x1bd/0x2a0 [ 742.244241][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 742.244264][ T31] ? rcu_is_watching+0x15/0xb0 [ 742.244293][ T31] ? __pfx_kcov_ioctl+0x10/0x10 [ 742.244322][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.244343][ T31] do_syscall_64+0x15f/0xf80 [ 742.244367][ T31] ? trace_irq_disable+0x3b/0x140 [ 742.244390][ T31] ? clear_bhb_loop+0x40/0x90 [ 742.244414][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.244432][ T31] RIP: 0033:0x7f393499c819 [ 742.244449][ T31] RSP: 002b:00007f39358f8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 742.244468][ T31] RAX: ffffffffffffffda RBX: 00007f3934c16180 RCX: 00007f393499c819 [ 742.244482][ T31] RDX: 0000000000004890 RSI: 00002000000003c0 RDI: 0000000000000004 [ 742.244496][ T31] RBP: 00007f3934a32c91 R08: 0000000000000000 R09: 0000000000000000 [ 742.244508][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 742.244520][ T31] R13: 00007f3934c16218 R14: 00007f3934c16180 R15: 00007ffc7bd627f8 [ 742.244551][ T31] [ 742.244560][ T31] INFO: task syz.4.1854:12441 blocked for more than 162 seconds. [ 742.244576][ T31] Tainted: G L syzkaller #0 [ 742.244587][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 742.244596][ T31] task:syz.4.1854 state:D stack:27104 pid:12441 tgid:12440 ppid:5846 task_flags:0x400140 flags:0x00080002 [ 742.244641][ T31] Call Trace: [ 742.244649][ T31] [ 742.244661][ T31] __schedule+0x165c/0x5520 [ 742.244715][ T31] ? __pfx___schedule+0x10/0x10 [ 742.244747][ T31] ? schedule+0x90/0x360 [ 742.244773][ T31] schedule+0x164/0x360 [ 742.244799][ T31] schedule_preempt_disabled+0x13/0x30 [ 742.244821][ T31] __mutex_lock+0x856/0x1420 [ 742.262020][ T31] ? __mutex_lock+0x5fc/0x1420 [ 742.262062][ T31] ? rtnetlink_rcv_msg+0x722/0xbe0 [ 742.262088][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 742.262133][ T31] rtnetlink_rcv_msg+0x722/0xbe0 [ 742.262158][ T31] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 742.262177][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 742.262195][ T31] ? ref_tracker_free+0x693/0x840 [ 742.262216][ T31] ? __copy_skb_header+0xa3/0x4a0 [ 742.262242][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 742.262262][ T31] ? __skb_clone+0x63/0x7a0 [ 742.262294][ T31] netlink_rcv_skb+0x232/0x4b0 [ 742.262316][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 742.262339][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 742.262369][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 742.262397][ T31] netlink_unicast+0x80f/0x9b0 [ 742.262434][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 742.262463][ T31] ? netlink_sendmsg+0x650/0xb40 [ 742.262481][ T31] ? skb_put+0x11b/0x210 [ 742.262506][ T31] netlink_sendmsg+0x813/0xb40 [ 742.262536][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 742.262560][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 742.262583][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 742.262614][ T31] ____sys_sendmsg+0x972/0x9f0 [ 742.262638][ T31] ? __might_fault+0xaf/0x130 [ 742.262670][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 742.262703][ T31] ? import_iovec+0x73/0xa0 [ 742.262730][ T31] ___sys_sendmsg+0x2a5/0x360 [ 742.262752][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 742.262782][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 742.262812][ T31] ? futex_wait+0x2a2/0x390 [ 742.262859][ T31] ? __fget_files+0x2a/0x420 [ 742.262884][ T31] ? __fget_files+0x3a0/0x420 [ 742.262927][ T31] __x64_sys_sendmsg+0x1bd/0x2a0 [ 742.262954][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 742.262987][ T31] ? rcu_is_watching+0x15/0xb0 [ 742.263016][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.263037][ T31] do_syscall_64+0x15f/0xf80 [ 742.263061][ T31] ? trace_irq_disable+0x3b/0x140 [ 742.263085][ T31] ? clear_bhb_loop+0x40/0x90 [ 742.263109][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.263128][ T31] RIP: 0033:0x7f0301f9c819 [ 742.263145][ T31] RSP: 002b:00007f0302f10028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 742.263167][ T31] RAX: ffffffffffffffda RBX: 00007f0302215fa0 RCX: 00007f0301f9c819 [ 742.263182][ T31] RDX: 0000000004000800 RSI: 00002000000001c0 RDI: 0000000000000006 [ 742.263195][ T31] RBP: 00007f0302032c91 R08: 0000000000000000 R09: 0000000000000000 [ 742.263208][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 742.263220][ T31] R13: 00007f0302216038 R14: 00007f0302215fa0 R15: 00007ffe2f4e1588 [ 742.263251][ T31] [ 742.263261][ T31] INFO: task syz.4.1854:12445 blocked for more than 162 seconds. [ 742.263278][ T31] Tainted: G L syzkaller #0 [ 742.263289][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 742.263298][ T31] task:syz.4.1854 state:D stack:26304 pid:12445 tgid:12440 ppid:5846 task_flags:0x400040 flags:0x00080002 [ 742.263343][ T31] Call Trace: [ 742.263350][ T31] [ 742.263362][ T31] __schedule+0x165c/0x5520 [ 742.263416][ T31] ? __pfx___schedule+0x10/0x10 [ 742.263449][ T31] ? schedule+0x90/0x360 [ 742.263475][ T31] schedule+0x164/0x360 [ 742.263501][ T31] schedule_preempt_disabled+0x13/0x30 [ 742.263524][ T31] __mutex_lock+0x856/0x1420 [ 742.263556][ T31] ? __mutex_lock+0x5fc/0x1420 [ 742.263584][ T31] ? tun_chr_close+0x3e/0x1c0 [ 742.263614][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 742.263656][ T31] ? __pfx_tun_chr_close+0x10/0x10 [ 742.263682][ T31] tun_chr_close+0x3e/0x1c0 [ 742.263709][ T31] __fput+0x44f/0xa70 [ 742.263746][ T31] fput_close_sync+0x11f/0x240 [ 742.263772][ T31] ? __pfx_fput_close_sync+0x10/0x10 [ 742.263803][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.263826][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.263846][ T31] __x64_sys_close+0x7e/0x110 [ 742.263874][ T31] do_syscall_64+0x15f/0xf80 [ 742.263898][ T31] ? trace_irq_disable+0x3b/0x140 [ 742.263928][ T31] ? clear_bhb_loop+0x40/0x90 [ 742.263951][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.263970][ T31] RIP: 0033:0x7f0301f9c819 [ 742.263986][ T31] RSP: 002b:00007f0302eef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 742.264006][ T31] RAX: ffffffffffffffda RBX: 00007f0302216090 RCX: 00007f0301f9c819 [ 742.264020][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 742.264032][ T31] RBP: 00007f0302032c91 R08: 0000000000000000 R09: 0000000000000000 [ 742.264045][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 742.264057][ T31] R13: 00007f0302216128 R14: 00007f0302216090 R15: 00007ffe2f4e1588 [ 742.264088][ T31] [ 742.264096][ T31] Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings [ 742.264118][ T31] [ 742.264118][ T31] Showing all locks held in the system: [ 742.264128][ T31] 2 locks held by kthreadd/2: [ 742.264142][ T31] 2 locks held by kworker/0:0/9: [ 742.264152][ T31] 2 locks held by kworker/0:1/10: [ 742.264163][ T31] 4 locks held by kworker/u8:1/13: [ 742.264174][ T31] #0: ffff88801bae6140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 742.264233][ T31] #1: ffffc90000127c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 742.264288][ T31] #2: ffffffff8fbcac88 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 742.264338][ T31] #3: ffffffff8fbd9580 (rtnl_mutex){+.+.}-{4:4}, at: fib_net_exit_batch+0x22/0xf0 [ 742.264392][ T31] 4 locks held by kworker/1:1/29: [ 742.264403][ T31] 1 lock held by khungtaskd/31: [ 742.264414][ T31] #0: ffffffff8e75d0a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 742.264465][ T31] 3 locks held by kworker/u8:4/63: [ 742.264477][ T31] 3 locks held by kworker/u8:5/85: [ 742.264488][ T31] 2 locks held by kswapd0/86: [ 742.264502][ T31] 3 locks held by kworker/u8:6/386: [ 742.264514][ T31] 2 locks held by kworker/1:2/808: [ 742.264533][ T31] 4 locks held by kworker/u8:7/1115: [ 742.264544][ T31] #0: ffff888034a27940 ((wq_completion)wg-kex-wg0#9){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 742.264606][ T31] #1: ffffc9000573fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 742.264663][ T31] #2: ffff88807e355380 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12f/0x830 [ 742.264721][ T31] #3: ffff88807c602ad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x140/0x830 [ 742.264779][ T31] 4 locks held by kworker/u8:8/1123: [ 742.264790][ T31] 3 locks held by kworker/0:2/1179: [ 742.264801][ T31] #0: ffff88805b528d40 ((wq_completion)wg-kex-wg1 [ 747.272578][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.280365][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.023123][ T31] #10){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 753.023181][ T31] #1: ffffc900058bfc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 753.023250][ T31] #2: ffff888079971380 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a1/0x9a0 [ 753.023312][ T31] 4 locks held by kworker/0:3/1239: [ 753.023355][ T31] 5 locks held by kworker/R-bat_e/3427: [ 753.023367][ T31] 3 locks held by kworker/u8:9/3530: [ 753.023378][ T31] #0: ffff88803177e140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 753.023434][ T31] #1: ffffc9000de4fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 753.023491][ T31] #2: ffffffff8fbd9580 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 753.023542][ T31] 1 lock held by klogd/5201: [ 753.023555][ T31] 2 locks held by crond/5581: [ 753.023566][ T31] 2 locks held by getty/5597: [ 753.023577][ T31] #0: ffff8880373fa0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 753.023629][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 [ 753.023679][ T31] 1 lock held by syz-executor/5825: [ 753.023691][ T31] 2 locks held by syz-executor/5837: [ 753.023703][ T31] 2 locks held by syz-executor/5849: [ 753.023715][ T31] 7 locks held by kworker/u9:8/5855: [ 753.023726][ T31] #0: ffff888079387940 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 753.023782][ T31] #1: ffffc900047a7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 753.023839][ T31] #2: ffff8880431a4ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 [ 753.023888][ T31] #3: ffff8880431a40b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 753.023950][ T31] #4: ffffffff8fd65aa0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 [ 753.024003][ T31] #5: ffff88803177baf8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x92/0x570 [ 753.024063][ T31] #6: ffffffff8e7633a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 753.024120][ T31] 4 locks held by kworker/1:4/5896: [ 753.024133][ T31] 3 locks held by kworker/1:5/5926: [ 753.024145][ T31] 4 locks held by kworker/1:7/5955: [ 753.024156][ T31] #0: ffff88805b528d40 ((wq_completion)wg-kex-wg1#10){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 753.024217][ T31] #1: ffffc90004ee7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 753.024284][ T31] #2: ffff888079971380 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a1/0x9a0 [ 753.024343][ T31] #3: ffff88801f6b3ea0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x58b/0x9a0 [ 753.024401][ T31] 4 locks held by kworker/u8:11/6481: [ 753.024413][ T31] 3 locks held by kworker/u8:12/6948: [ 753.024424][ T31] #0: ffff88813fe54140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 753.024480][ T31] #1: ffffc900024efc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 753.024537][ T31] #2: ffffffff8fbd9580 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 753.024590][ T31] 4 locks held by kworker/u8:13/7480: [ 753.024605][ T31] 7 locks held by syz-executor/12249: [ 753.024617][ T31] #0: ffff888036666410 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x227/0xb90 [ 753.024671][ T31] #1: ffff88807bb43480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1de/0x540 [ 753.024721][ T31] #2: ffff888029a344b8 (kn->active#53){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x231/0x540 [ 753.024776][ T31] #3: ffffffff8f448a60 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x710 [ 753.041963][ T31] #4: ffff88805ab56128 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 753.042026][ T31] #5: ffff888035658258 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_drv_probe+0xc9/0xc20 [ 753.042081][ T31] #6: ffffffff8fbd9580 (rtnl_mutex){+.+.}-{4:4}, at: register_nexthop_notifier+0x88/0x290 [ 753.042141][ T31] 4 locks held by syz-executor/12253: [ 753.042152][ T31] #0: ffff888036666410 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x227/0xb90 [ 753.042206][ T31] #1: ffff888032b04c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1de/0x540 [ 753.042257][ T31] #2: ffff888029a343c8 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x231/0x540 [ 753.042312][ T31] #3: ffffffff8f448a60 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 753.042369][ T31] 5 locks held by kworker/u9:0/12254: [ 753.042380][ T31] #0: ffff88807927b140 ((wq_completion)hci6){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 753.042437][ T31] #1: ffffc90003c77c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 753.042493][ T31] #2: ffff888057d7cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 [ 753.042542][ T31] #3: ffff888057d7c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 753.042595][ T31] #4: ffffffff8fd65aa0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 [ 753.042654][ T31] 2 locks held by syz.1.1850/12424: [ 753.042665][ T31] 8 locks held by syz.1.1850/12426: [ 753.042676][ T31] 2 locks held by syz.1.1850/12427: [ 753.042688][ T31] 4 locks held by dhcpcd-run-hook/12422: [ 753.042701][ T31] 1 lock held by syz.3.1852/12432: [ 753.042712][ T31] 1 lock held by syz.3.1852/12436: [ 753.042728][ T31] #0: ffffffff8fbd9580 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 753.042782][ T31] 1 lock held by syz.3.1852/12439: [ 753.042793][ T31] #0: ffffffff8fbd9580 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x722/0xbe0 [ 753.042843][ T31] 1 lock held by syz.3.1852/12442: [ 753.042854][ T31] #0: ffffffff8fbd9580 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x722/0xbe0 [ 753.042903][ T31] 1 lock held by syz.4.1854/12441: [ 753.042920][ T31] #0: ffffffff8fbd9580 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x722/0xbe0 [ 753.042970][ T31] 1 lock held by syz.4.1854/12445: [ 753.042980][ T31] #0: ffffffff8fbd9580 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 753.043035][ T31] 4 locks held by kworker/u8:0/12448: [ 753.043047][ T31] 4 locks held by kworker/u8:2/12449: [ 753.043059][ T31] 4 locks held by kworker/u8:3/12450: [ 753.043073][ T31] [ 753.043080][ T31] ============================================= [ 753.043080][ T31] [ 753.043100][ T31] NMI backtrace for cpu 1 [ 753.043121][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 753.043170][ T31] Tainted: [L]=SOFTLOCKUP [ 753.043183][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 753.043205][ T31] Call Trace: [ 753.043211][ T31] [ 753.043220][ T31] dump_stack_lvl+0xe8/0x150 [ 753.043248][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 753.043267][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 753.043294][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 753.043315][ T31] sys_info+0x135/0x170 [ 753.043331][ T31] watchdog+0xfd3/0x1030 [ 753.043358][ T31] ? watchdog+0x1c9/0x1030 [ 753.043384][ T31] kthread+0x388/0x470 [ 753.043404][ T31] ? __pfx_watchdog+0x10/0x10 [ 753.043423][ T31] ? __pfx_kthread+0x10/0x10 [ 753.043444][ T31] ret_from_fork+0x514/0xb70 [ 753.043472][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 753.043497][ T31] ? __switch_to+0xc79/0x1410 [ 753.043521][ T31] ? __pfx_kthread+0x10/0x10 [ 753.043542][ T31] ret_from_fork_asm+0x1a/0x30 [ 753.043574][ T31] [ 753.043580][ T31] Sending NMI from CPU 1 to CPUs 0: [ 753.043606][ C0] NMI backtrace for cpu 0 [ 753.043624][ C0] CPU: 0 UID: 0 PID: 3427 Comm: kworker/R-bat_e Tainted: G L syzkaller #0 PREEMPT(full) [ 753.043645][ C0] Tainted: [L]=SOFTLOCKUP [ 753.043650][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 753.043659][ C0] Workqueue: bat_events batadv_dat_purge [ 753.043683][ C0] RIP: 0010:__lock_acquire+0xca/0x2cf0 [ 753.043706][ C0] Code: 4c 89 cf 31 d2 4c 89 cb e8 f3 f0 ff ff 48 85 c0 0f 84 76 13 00 00 49 89 d9 8b 0d e1 70 87 18 48 8b 54 24 08 8b 92 48 0b 00 00 <85> c9 0f 94 c1 83 fa 30 40 0f 93 c6 40 20 ce 40 80 fe 01 0f 84 21 [ 753.043718][ C0] RSP: 0018:ffffc90000006ab8 EFLAGS: 00000086 [ 753.043730][ C0] RAX: ffffffff93ccc928 RBX: 0000000000000000 RCX: 0000000000000000 [ 753.043740][ C0] RDX: 0000000000000007 RSI: 0000000000000000 RDI: ffff8880b863cb90 [ 753.043750][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8880b863cb90 [ 753.043759][ C0] R10: dffffc0000000000 R11: fffffbfff202539f R12: 0000000000000000 [ 753.043770][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 753.043779][ C0] FS: 0000000000000000(0000) GS:ffff88812543c000(0000) knlGS:0000000000000000 [ 753.043791][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 753.043801][ C0] CR2: 0000200000098000 CR3: 000000000e54a000 CR4: 00000000003526f0 [ 753.043815][ C0] Call Trace: [ 753.043820][ C0] [ 753.043829][ C0] ? __ip_vs_conn_in_get+0xa6/0x10f0 [ 753.043847][ C0] ? __ip_vs_service_find+0x1c3/0x8e0 [ 753.043860][ C0] ? lock_acquire+0x106/0x350 [ 753.043883][ C0] ? enqueue_to_backlog+0x19c/0xee0 [ 753.043903][ C0] lock_acquire+0x106/0x350 [ 753.043922][ C0] ? enqueue_to_backlog+0x19c/0xee0 [ 753.043947][ C0] _raw_spin_lock+0x2e/0x40 [ 753.043963][ C0] ? enqueue_to_backlog+0x19c/0xee0 [ 753.043982][ C0] enqueue_to_backlog+0x19c/0xee0 [ 753.044006][ C0] netif_rx_internal+0x120/0x560 [ 753.044023][ C0] ? __pfx_netif_rx_internal+0x10/0x10 [ 753.044042][ C0] __netif_rx+0x78/0xc0 [ 753.044061][ C0] loopback_xmit+0x43a/0x660 [ 753.044079][ C0] dev_hard_start_xmit+0x2cd/0x830 [ 753.044103][ C0] __dev_queue_xmit+0x1557/0x3840 [ 753.044126][ C0] ? __dev_queue_xmit+0x28b/0x3840 [ 753.044143][ C0] ? ipv4_synproxy_hook+0x293/0xd80 [ 753.044162][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 753.044183][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 753.044202][ C0] ? __pfx_nf_confirm+0x10/0x10 [ 753.044224][ C0] ? ip_output+0x29f/0x450 [ 753.044239][ C0] ? lock_acquire+0x106/0x350 [ 753.044257][ C0] ? ip_output+0x29f/0x450 [ 753.044275][ C0] ? ip_finish_output2+0xa1e/0x1070 [ 753.044294][ C0] ? ip_finish_output2+0x3c2/0x1070 [ 753.044310][ C0] ip_finish_output2+0xc68/0x1070 [ 753.044328][ C0] ? ip_finish_output2+0x3c2/0x1070 [ 753.044349][ C0] ip_output+0x29f/0x450 [ 753.044364][ C0] ? ip_output+0x5b/0x450 [ 753.044380][ C0] synproxy_send_client_synack+0x8c1/0xe30 [ 753.044403][ C0] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 753.044420][ C0] ? nft_xfrm_get_init+0x178/0x430 [ 753.044437][ C0] ? synproxy_pernet+0x45/0x270 [ 753.044455][ C0] nft_synproxy_eval_v4+0x34a/0x4e0 [ 753.044475][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 753.044493][ C0] ? nf_ip_checksum+0x13c/0x510 [ 753.044514][ C0] nft_synproxy_do_eval+0x305/0x580 [ 753.044534][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 753.044557][ C0] nft_do_chain+0x45e/0x1990 [ 753.044576][ C0] ? __pfx_tcp_conn_schedule+0x10/0x10 [ 753.044593][ C0] ? __pfx_ip_vs_conn_out_get_proto+0x10/0x10 [ 753.044612][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 753.044641][ C0] ? __pfx_nf_nat_inet_fn+0x10/0x10 [ 753.044668][ C0] nft_do_chain_inet+0x29d/0x380 [ 753.044686][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 753.044706][ C0] ? nf_nat_ipv4_local_in+0x223/0x720 [ 753.044723][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 753.044741][ C0] nf_hook_slow+0xc5/0x220 [ 753.044758][ C0] NF_HOOK+0x21f/0x3c0 [ 753.044779][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 753.044799][ C0] ? NF_HOOK+0x9e/0x3c0 [ 753.044817][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 753.044838][ C0] ? ip_rcv_finish_core+0xda3/0x1c00 [ 753.044851][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 753.044874][ C0] ? ip_local_deliver+0x12a/0x1b0 [ 753.044894][ C0] NF_HOOK+0x336/0x3c0 [ 753.044913][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 753.044934][ C0] ? NF_HOOK+0x9e/0x3c0 [ 753.044954][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 753.044977][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 753.045000][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 753.045021][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 753.045042][ C0] ? process_backlog+0x3eb/0x1950 [ 753.045058][ C0] process_backlog+0xaa3/0x1950 [ 753.045082][ C0] __napi_poll+0xae/0x340 [ 753.045096][ C0] ? skb_defer_free_flush+0x233/0x260 [ 753.045113][ C0] net_rx_action+0x627/0xf70 [ 753.045135][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 753.045158][ C0] ? try_to_wake_up+0x7f2/0x1380 [ 753.045181][ C0] handle_softirqs+0x22a/0x840 [ 753.045205][ C0] ? do_softirq+0x76/0xd0 [ 753.045229][ C0] ? batadv_dat_purge+0x2da/0x3c0 [ 753.045245][ C0] do_softirq+0x76/0xd0 [ 753.045266][ C0] [ 753.045271][ C0] [ 753.045277][ C0] __local_bh_enable_ip+0xf8/0x130 [ 753.045299][ C0] batadv_dat_purge+0x2da/0x3c0 [ 753.045317][ C0] ? process_scheduled_works+0xa70/0x1860 [ 753.045340][ C0] process_scheduled_works+0xb5d/0x1860 [ 753.045376][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 753.045397][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 753.045423][ C0] rescuer_thread+0x827/0x1130 [ 753.045443][ C0] ? rescuer_thread+0xbb/0x1130 [ 753.045466][ C0] kthread+0x388/0x470 [ 753.045483][ C0] ? __pfx_rescuer_thread+0x10/0x10 [ 753.045498][ C0] ? __pfx_kthread+0x10/0x10 [ 753.045516][ C0] ret_from_fork+0x514/0xb70 [ 753.045540][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 753.045561][ C0] ? __switch_to+0xc79/0x1410 [ 753.045581][ C0] ? __pfx_kthread+0x10/0x10 [ 753.045599][ C0] ret_from_fork_asm+0x1a/0x30 [ 753.045621][ C0] [ 769.183781][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 769.183805][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 769.183831][ T31] Tainted: [L]=SOFTLOCKUP [ 769.183838][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 769.183849][ T31] Call Trace: [ 769.183857][ T31] [ 769.183867][ T31] vpanic+0x56c/0xa60 [ 769.183898][ T31] ? __pfx___schedule+0x10/0x10 [ 769.183921][ T31] ? __pfx_vpanic+0x10/0x10 [ 769.183955][ T31] panic+0xc5/0xd0 [ 769.183979][ T31] ? __pfx_panic+0x10/0x10 [ 769.184004][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 769.184033][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 769.184056][ T31] watchdog+0x102c/0x1030 [ 769.184084][ T31] ? watchdog+0x1c9/0x1030 [ 769.184111][ T31] kthread+0x388/0x470 [ 769.184131][ T31] ? __pfx_watchdog+0x10/0x10 [ 769.184149][ T31] ? __pfx_kthread+0x10/0x10 [ 769.184172][ T31] ret_from_fork+0x514/0xb70 [ 769.184200][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 769.184226][ T31] ? __switch_to+0xc79/0x1410 [ 769.184252][ T31] ? __pfx_kthread+0x10/0x10 [ 769.184273][ T31] ret_from_fork_asm+0x1a/0x30 [ 769.184306][ T31] [ 769.184655][ T31] Kernel Offset: disabled