last executing test programs: 1m36.700811644s ago: executing program 1 (id=2): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) pivot_root(0x0, 0x0) fchmodat(0xffffffffffffff9c, 0x0, 0xffffff6f) 1m36.427839221s ago: executing program 1 (id=6): fsopen(&(0x7f0000000000)='mqueue\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000780)={0x29e9c934, 0x3, 0x7f, 0x404}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010a0000000000000000020000000c0000800800", @ANYRES16=r0], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) 1m36.159312057s ago: executing program 1 (id=7): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r1, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) 1m35.219627909s ago: executing program 1 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x3c5093, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) 1m34.906551567s ago: executing program 1 (id=16): setresgid(0x0, 0xee01, 0x0) setuid(0xee01) r0 = semget$private(0x0, 0x6, 0x1b5) semop(r0, &(0x7f0000000040)=[{0x0, 0xff43}], 0x1) getgroups(0x2, &(0x7f0000000000)=[0x0, 0xffffffffffffffff]) setfsgid(r1) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000bc0)={{0x1, 0xee00, 0x0, 0x0, 0x0, 0x1, 0xc}, 0x4857, 0xa80d, 0x0, 0x0, 0x0, 0x0, 0x7ff}) semop(r0, &(0x7f00000000c0)=[{0x4}], 0x1) 1m34.449970858s ago: executing program 1 (id=20): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x22020600) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0x2, 0x8, 0x80, 0x8, 0x3, 0x10007e, 0x20000006, 0x54, 0x6, 0x10000, 0x80005, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x26, 0xd, 0x1, 0x6, 0x7, 0xe661, 0x4, 0x7, 0x6, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0x12, 0x0, 0x800080ee, 0xa, 0x1b, 0x1, 0x9, 0x200, 0x3e, 0x3, 0x6, 0xca9, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x10001, 0x5, 0x6, 0x6, 0x5, 0x1, 0x40], [0x10000007, 0x9, 0x80000130, 0x8004, 0x5, 0xfffffff3, 0x2, 0xc8, 0x6, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x42f, 0xe, 0x312, 0x78, 0x1, 0x0, 0x2, 0x7, 0x7fff, 0x6, 0x4400, 0x401, 0x6, 0x1, 0xfc, 0x5, 0x1000005, 0x5f31, 0xd, 0x40000101, 0x1, 0x4, 0xffff80f3, 0x8, 0x6, 0xa, 0x9, 0x6, 0x47, 0x8220, 0x1, 0xfe000000, 0xffff, 0xfffffe01, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x7, 0x3, 0xbc45, 0x48c93694, 0x43, 0x9], [0x7, 0x2, 0x0, 0x2, 0xfffffffe, 0x100, 0x8d2, 0xb42a, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x5, 0x8, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0xd, 0x800003, 0x200, 0x400080, 0x3, 0x1, 0x29503faf, 0x2, 0xa2, 0x7, 0xa9, 0x85, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x129, 0x4, 0x1, 0x6, 0x0, 0x2, 0x21c, 0x120000, 0x3, 0x0, 0x80aaed, 0x4, 0x24], [0x9, 0x40bb33, 0x7ffffffd, 0x9, 0x5, 0x93a, 0x9, 0x0, 0x100, 0xb9, 0x1eb, 0x1ff, 0x2, 0x57, 0x4, 0x6a, 0x101, 0x10000, 0x4, 0x7fff, 0x1000, 0x7f, 0x2, 0xa362, 0x1, 0x0, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000001, 0x7, 0x4, 0xc8, 0xfffffffd, 0xfffff000, 0x4010080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0xa1, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d69b, 0x10, 0x5, 0x7, 0x1, 0x269d, 0x0, 0x4, 0x928, 0xb1e, 0xc7, 0x0, 0xffff2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 1m34.090992246s ago: executing program 32 (id=20): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x22020600) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0x2, 0x8, 0x80, 0x8, 0x3, 0x10007e, 0x20000006, 0x54, 0x6, 0x10000, 0x80005, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x26, 0xd, 0x1, 0x6, 0x7, 0xe661, 0x4, 0x7, 0x6, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0x12, 0x0, 0x800080ee, 0xa, 0x1b, 0x1, 0x9, 0x200, 0x3e, 0x3, 0x6, 0xca9, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x10001, 0x5, 0x6, 0x6, 0x5, 0x1, 0x40], [0x10000007, 0x9, 0x80000130, 0x8004, 0x5, 0xfffffff3, 0x2, 0xc8, 0x6, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x42f, 0xe, 0x312, 0x78, 0x1, 0x0, 0x2, 0x7, 0x7fff, 0x6, 0x4400, 0x401, 0x6, 0x1, 0xfc, 0x5, 0x1000005, 0x5f31, 0xd, 0x40000101, 0x1, 0x4, 0xffff80f3, 0x8, 0x6, 0xa, 0x9, 0x6, 0x47, 0x8220, 0x1, 0xfe000000, 0xffff, 0xfffffe01, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x7, 0x3, 0xbc45, 0x48c93694, 0x43, 0x9], [0x7, 0x2, 0x0, 0x2, 0xfffffffe, 0x100, 0x8d2, 0xb42a, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x5, 0x8, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0xd, 0x800003, 0x200, 0x400080, 0x3, 0x1, 0x29503faf, 0x2, 0xa2, 0x7, 0xa9, 0x85, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x129, 0x4, 0x1, 0x6, 0x0, 0x2, 0x21c, 0x120000, 0x3, 0x0, 0x80aaed, 0x4, 0x24], [0x9, 0x40bb33, 0x7ffffffd, 0x9, 0x5, 0x93a, 0x9, 0x0, 0x100, 0xb9, 0x1eb, 0x1ff, 0x2, 0x57, 0x4, 0x6a, 0x101, 0x10000, 0x4, 0x7fff, 0x1000, 0x7f, 0x2, 0xa362, 0x1, 0x0, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000001, 0x7, 0x4, 0xc8, 0xfffffffd, 0xfffff000, 0x4010080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0xa1, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d69b, 0x10, 0x5, 0x7, 0x1, 0x269d, 0x0, 0x4, 0x928, 0xb1e, 0xc7, 0x0, 0xffff2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 59.414095003s ago: executing program 2 (id=231): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x32cc0000) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000200)={0xaa, 0x2cc}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000010000/0x1000)=nil, 0x1000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) readv(r0, &(0x7f0000000700)=[{&(0x7f0000000180)=""/57, 0x39}], 0x1) 57.624960966s ago: executing program 2 (id=247): socket$inet6(0xa, 0x800000000000002, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB="050000"], 0x48}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="050000000109"], 0x80}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYRES16=r0], 0x48}}, 0x40800) 57.419216601s ago: executing program 2 (id=251): r0 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r1 = fanotify_init(0x200, 0x0) r2 = memfd_create(&(0x7f0000000500)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x1c\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\x83\x11\v}k+\xeb\xc3\xc0O\xae\xd2\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb901nEy\x82\x83\x80\xd3O\x00|hP\x00\x00\x00\x00\x00\x00\x00\x05\x86\xfe\xd9\xa5\xc6\nSy\xa3N\xba-]\'q\xc6\xfb\x02\x9a\xa9Z\xa8\x80Bx\xbd74\xcf\"\xa5\xea$\x95\xfd\x06T\xef\x89\xe4j\x06\xdc\x15\xe7\xc3\xb5H\xf7\xdc\xee\x182\xab\xe2?\"\xbewm\x9d\xd8x\xd92\xeeS/\xd2\xcd[\x9dcO1\xcb\x12lZ$\xa7\x9d\xf8b\xf6}\xc5``\xfe0\x8a\'v-\x99`?\x97\x8c\xdd\xd6\xfa\xa2\x06>\xf3\xe2uI\xe65C\xdb\x84\xe6eU\xe8RK\xd6=s\xcd\x9d\x1f#3\xc5\x16\xd0\xbbD\xc5\xde\xc8/\v\xa5W\xbep\x87\x15\x10\xcdm\xa7\x93\x01\x1c,9V8\xdc\xfd\xb7\xc0\xfc\x04\x00p\xad\x12\xb2\xbf\xfbFZ\x1a\f\x99\x05\xe4\x1eP\xed\x87\x89\xbeo\xfbv\xb6\x8a\xee\xf6Oc8\xaf\x11[\xc3\x98w-\xf0\xb2z\xc7\xaf;\x92\xad4\x1b\x92L\x97<\xbdh\x80\xf2\xc0\xd0n)K\xf2#Ncp\xe4\xb4\xfb\x94\x18\xc2-TWA\x13\xfe\xea\xad\v\xc4\xa5\x02\xf9\xed]\xf4\\\x01\xab\xdc\xb6\xcdP\x93\xf2\xc3\x96\xf2\xc0\xd6-x\xd5\xd6\xc7\x9d\xa5\x1f\xd2t\xd7\x8f}b\x9749\xd4a7\x18\xe0\x91KV7[\xb8\x8dL\xc8\xc8\x8f>sbE\xf5\xa7\xdb|\xb0m\x16c\x84\r\"\xf2\x92s\xeb\xaf\x1c\x00\xf4\x8dL\xa5\x10\x89FB\xfb8\xf9\x9d\xcbm\x1c\x91\xe9fd$5\xdc\xad\xec\xef\x90\xd9\xefX\xd2m\x9e\xec\x94w\xb3\xf9\xd9\x0eu-z\x81\xbb\xa6\xc0\x00\xa1\xd9\xcbI\xda\xa3\b\x9e@\xb8\xc8k\xdeQ/\xb8X\x9c\xff4Np~\xc4\xc1_\x1c#zX\a\xd41\x1c\x7fH\x91\xd9k\x05\x1f\n\b\b\x88\xd6\xcf4i\xa0B\xe7\x9c\x9c\xe6\xcax\xca\xa1E#6\xe9\xf31W\xd0\x1bY3/\x00I#\xfa\xb0\f\xd5!\x9fR[\x0e\xdb`\xdb\x82M\'k\x16(\xfa\xc2\xec\x96e\\Q\xe9\x19\xe1u\x86\xcb\xc3\xb0\xb8\x19\xb9l\x1fk!R\xb1P\x8b\xda\xffE\x89\x97\n\x17m\xd10\x1a\xe7Qz\xd8\bi\x8dRw+\xa1^N\xaf\x1b\x1dg\x8f$\xbe\x93\x8d\x8b\xfd\r\xee<\x84\x95\x82)TH\xcac9\x98\x13WW@;\xb4\xd5\x0f\xa1\xb3xX(\x80\xe8\x89\xed e.\xe04\xba\x9c=\xc6\x04\f\xbf\x06\xce5\xf99GD8@\xd2\r\xd0\xdf@\xe3\xbe\"qq#]\x86W\tA\xa7\x91\x85\xae\x9c\x8dO\xa6\xa3\xf9i\x83\xc5\xa8C\x164\xef\xa4\\\a\xaa%\x94!3k]\xd5\xbe\'U\xf17', 0x1) r3 = dup(r2) fanotify_mark(r1, 0x1, 0x48000047, r3, 0x0) r4 = dup(r0) write$binfmt_elf32(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="7f454c464a030103ff0700000000000002000300040000003e03000038000000d600000097700000fe03200001"], 0x3e) execveat(r4, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 57.061899949s ago: executing program 2 (id=257): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000030000000200000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x20000000000000fe, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x45a0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r0}, &(0x7f0000000080), &(0x7f00000001c0)=r3}, 0x20) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x7, 0x0, 0x6, 0x0, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}}}, 0x0) 56.925786802s ago: executing program 2 (id=260): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 56.668229229s ago: executing program 2 (id=263): r0 = io_uring_setup(0x5d06, &(0x7f0000000100)={0x0, 0x97a4, 0x2, 0x3, 0x192}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r1, &(0x7f0000000100)='$e', 0x2, 0x20008005, &(0x7f00000000c0)={0x2, 0x4e20}, 0x10) readv(r1, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/210, 0xd2}], 0x1) setsockopt$sock_int(r1, 0x1, 0xa, &(0x7f0000000140)=0x6, 0x4) recvfrom(r1, &(0x7f0000000380)=""/102, 0xfffffffffffffe66, 0x736, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 41.573534998s ago: executing program 33 (id=263): r0 = io_uring_setup(0x5d06, &(0x7f0000000100)={0x0, 0x97a4, 0x2, 0x3, 0x192}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r1, &(0x7f0000000100)='$e', 0x2, 0x20008005, &(0x7f00000000c0)={0x2, 0x4e20}, 0x10) readv(r1, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/210, 0xd2}], 0x1) setsockopt$sock_int(r1, 0x1, 0xa, &(0x7f0000000140)=0x6, 0x4) recvfrom(r1, &(0x7f0000000380)=""/102, 0xfffffffffffffe66, 0x736, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 27.66881398s ago: executing program 0 (id=436): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x80800) r1 = syz_ublk_setup_io_uring(0x1e, &(0x7f0000000040)={0x0, 0x7765, 0x0, 0x2, 0x158}, &(0x7f0000000300)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255, 0x0, r1}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed80, 0x1, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x1, 0x401f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x1, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00'], 0x48) 26.120562277s ago: executing program 0 (id=442): socket$nl_route(0x10, 0x3, 0x0) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x4b291000) sendmsg$unix(0xffffffffffffffff, 0x0, 0x11) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="6000000002060300000000000000000007000000140007800500150002000000080012400000000414000300686173683a69702c706f72742c697000050005000200000005000400050000000900020073797a31000000000500010007"], 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x5c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010100}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x5064}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) 23.524386739s ago: executing program 0 (id=454): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000450000000010"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r4}, 0xc) socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000002c0)={r4, r2}, 0xc) 23.267876994s ago: executing program 0 (id=456): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000000)='./file0\x00', 0x800000, &(0x7f0000000380)=ANY=[], 0x1, 0x14fd, &(0x7f0000002a80)="$eJzs3AuYjtXaOPB1r7UexjTpbZLDsO51P7xpsEyS5JCQQ5IkSZJTQtIkSUJiyClpSEKOk+QwhOQwjUnjfD7knDTZ0iRJSEhY/0u7ve2929/X9/33/v991zf377rWNeue573v937mnmve53mvmfmu56h6LerXbkZE4l8Cf/6QIoSIEUIME0JcJ4QIhBCV4ivFXz5eQEHKv/Yk7N/r4fSr3QG7mnj+eRvPP2/j+edtPP+8jeeft/H88zaef97G82csL9s+p9j1vPLu4vf/8zJ+/f9fJLf85K82lr+x138jheeft/H88zaef97G88/beP55G8//f79a/8kxnn/exvNnLC/bDlqI/wHvQ/O6Outqf/8xxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGMsbzvkrtBDiL/ur3RdjjDHGGGOMMcb+fXz+q90BY4wxxhhjjDHG/t8DIYUSWgQin8gvYkQBESuuEXHiWlFQXCci4noRL24QhcSNorAoIoqKYiJBFBclhBEorCARipKilIiKm0RpcbNIFGVEWVFOOFFeJIlbRAVxq6gobhOVxO2isrhDVBFVRTVRXdwpaoi7RE1RS9QWd4s6oq6oJ+qLe0QDca9oKO4TjcT9orF4QDQRD4qm4iHRTDwsmotHRAvxqGgpHhOtRGvRRrQV7f6v8l8SfcXLop/oL1LEADFQvCIGicFiiBgqholXxXDxmhghXhepYqQYJd4Qo8WbYox4S4wV48R48baYICaKSWKymCKmijTxjpgm3hXTxXtihpgpZonZIl3MEXPF+2KemC8WiA/EQvGhWCQWiyViqcgQH4lMsUxkiY/FcvGJyBYrxEqxSqwWa8RasU6sFxvERrFJbBZbxFaxTWwXn4odYqfYJXaLPWKv2Cc+E/vF5+KA+ELkiC//m/ln/yG/FwgQIEGCBg35IB/EQAzEQizEQRwUhIIQgQjEQzwUgkJQGApDUSgKCZAAJaAEICAQEJSEkhCFKJSG0pAIiVAWyoIDB0mQBBXgVqgIFaESVILKUBmqQFWoCtWhOtSAGlATakJtqA11oA7Ug3pwD9wD90JDaAiNoBE0hsbQBJpAU2gKzaAZNIfm0AJaQEtoCa2gFbSBNtAO2kF7aA8doAN0gk7QGTpDF+gCyZAMXaErdINu0B26Qw/oAT2hJ/SC3tAbXoKX4GV4GfpDHTkABsJAGASDYAgMhaHwKgyH1+A1eB1SYSSMgjfgDXgTxsAZGAvjYDyMhxpyIkyCyUByKqRBGkyDaTAdpsMMmAkzYTakwxyYC3NhHsyH+fABLIQP4UNYDIthKWRABmTCMsiCLFgOZyEbVsBKWAWrYQ2shnWwHtbBRtgEG2ELbIFtsA0+hU9hJ+yE3bAb9sJe+Aw+g8/hc0iFHMiBg3AQDsEhOAyHIRdy4QgcgaNwFI7BMTgOx+EEnIRTcBJOw2k4A2fhHJyD83AeLsALCd8031tmQ6qQl2mpZT6ZT8bIGBkrY2WcjJMFZUEZkREZL+NlIVlIFpaFZVFZVCbIBFlClpAoUZIMZUlZUkZlVJaWpWWiTJRlZVnppJNJMklWkBVkRVlRVpK3y8ryDllFVpUdXXVZXdaQnVxNWUvWlrVlHVlX1pP1ZX3ZQDaQDWVD2Ug2ko1lY9lEPiibygEwBB6WlyfTQo6ElnIUtJKtZRvZVr4Jj8v2cgx0kB1lJ/mkHAdjoYts75LlM7KrnATd5HNyMjwve8ip0FO+KHvJ3rKPfEn2lR1cP9lfzoABcqCcDYPkYDlEDpXzoK68PLF68nWZKkfKUfINuRTelGPkW3KsHCfHy7flBDlRTpKT5RQ5VabJd+Q0+a6cLt+TM+RMOUvOlulyjpwr35fz5Hy5QH4gF8oP5SK5WC6RS2WG/EhmymUyS34sl8tPZLZcIVfKVXK1XCPXynVyvdwgN8pNcrPcIrfKbXK7/FTukDvlLrlb7pF75T75mdwvP5cH5BcyR34pD8o/yUPyK3lYfi1z5TfyiPxWHpXfyWPye3lc/iBPyJPylPxRnpY/yTPyrDwnf5bn5S/ygrwoL0kvhQIllVJaBSqfyq9iVAEVq65RcepaVVBdpyLqehWvblCF1I2qsCqiiqpiKkEVVyWUUaisIhX+9htj/VVpdbNKVGVUWVVOOVVeJalbVAV1q6qoblOV1O2qsrpDVVFVVTVVXd2paqi7VE1VS9VWd6s6qq6qp+qre1QDda9qqO5TjdT9qrF6QDVRD6qm6iHVTD2smqtHVAv1qGqpHlOtVGvVRrVV7dTjqr16QnVQHVUn9aTqrJ5SXdTTKlk9o7qqZ1U39Zzqrp5XPdQLqqd6UfVSvVUfdVFdUl71U/1VihqgBqpX1CA1WA1RQ9Uw9aoarl5TI9TrKlWNVKPUG2q0elONUW+psWqcGq/eVhPURDVJTVZT1FSVpt5R09S7arp6T81QM9UsNVulqzlqyG+VFvwX8t/9J/kjfn32bWq7+lTtUDvVLrVb7VF71T61T+1X+9UBdUDlqBx1UB1Uh9QhdVgdVrkqVx1RR9RRdVQdU8fUcXVcnVAn1c/qR3Va/aTOqLPqrPpZnVfn1YXfvgZCg5Zaaa0DnU/n1zG6gI7V1+g4fa0uqK/TEX29jtc36EL6Rl1YF9FFdTGdoIvrEtpo1FaTDnVJXUpH9U26tL5ZJ+oyuqwup50ur5P0Lf9y/h/110630+11e91Bd9CddCfdWXfWXXQXnayTdVfdVXfT3XR33V330D10T91T99K9dB/dR/fVfXU/3U+n6BQ9UL+iB+nBeogeqofpV/VwPVyP0CN0qk7Vo/QoPVqP1mP0GD1Wj9Xj9Xg9QU/Qk/QkPUVP0Wk6TU/T0/R0PV3P0DP0LD1Lp+t0PVfP1fP0PL1AL9AL9UK9SC/SS/QSnaEzdKbO1Fk6Sy/Xy3W2XqFX6FV6lV6j1+h1ep3eoDfoTXqT3qK36Gy9XW/XO/QOvUvv0nv0Hr1P79P79X59QB/QOTpHH9QH9SF9SB/Wh3WuztVH9BF9VB/Vx/QxfVwf1yf0CX1Kn9Kn9Wl9Rp/R5/Q5fV6f1xf0BX1JX7p82RfIQAY60EG+IF8QE8QEsUFsEBfEBQWDgkEkiATxQXxQKLgxKBwUCYoGxYKEoHhQIjABBjagIAxKBqWCaHBTUDq4OUgMygRlg3KBC8oHScEtQYXg1qBicFtQKbg9qBzcEVQpIIJqQfXgzqBGcFdQM6gV1A7uDuoEdYN6Qf3gnqBBcG/QMLgvaBTcHzQOHgiaBA8GTYOHgmbBw0Hz4JGgRfBo0DJ4LGgVtA7aBG2Ddv9YP6j6L9T3/kyRJ1w/09+kmAFmoHnFDDKDzRAz1Awzr5rh5jUzwrxuUs1IM8q8YUabN80Y85YZa8aZ8eZtM8FMNJPMZDPFTDVp5h0zzbxrppv3zAwz08wys026mWPmmvfNPDPfLDAfmIXmQ7PILDZLzFKTYT4ymWaZyTIfm+XmE5NtVpiVZpVZbdaYtWadWW82mI1mk9lstpitZpvZbj41O8xOs8vsNnvMXrPPfGb2m8/NAfOFyTFfmoPmT+aQ+cocNl+bXPONOWK+NUfNd+aY+d4cNz+YE+akOWV+NKfNT+aMOWvOmZ/NefOLuWAumkvGX764v/zyjho15sN8GIMxGIuxGIdxWBALYgQjGI/xWAgLYWEsjEWxKCZgApbAEngZIWFJLIlRjGJpLI2JmIhlsSw6dJiESVgBK2BFrIiVsBJWxspYBatgNayGd+KdeBfehbWwFt6Nd2NdrIv1sT42wAbYEBtiI2yEjbExNsEm2BSbYjNshs2xObbAFtgSW2IrbIVtsA22w3bYHttjB+yAnbATdsbO2AW7YDImY1fsit2wG3bH7tgDe2BP7Im9sBf2wT7YF/tiP+yHKZiCA3EgDsJBOASH4DAchsNxOI7AEZiKqTgKR+FoHI1jcAyOxXE4Ht/GCTgRJ+FknIJTMQ3TcBpOw+k4HWfgDJyFszAd03EuzsV5OA8X4AJciAtxES7CJbgEMzADMzETszALl+NyzMZsXIkrcTWuxrW4FtfjetyIG3EzbsatuBW343bcgTtwF+7CPbgH9+E+3I/78QAewBzMwYN4EA/hITyMhzEXc/EIHsGjeBSP4TE8jsfxBJ7AU3gKT+NpPINn8Byew/P4C17Ai3gJPcZYKWLtNTbOXmsL2utsjC1g/zYuaovZBFvclrDGFrZF/i5Ga22iLWPL2nLW2fI2yd7yu7iKrWqr2er2TlvD3mVr/i5uYO+1De19tpG939a39/xd3Ng+YJvYR21T+5htZlvb5ratbWEftS3tY7aVbW3b2La2s33KdrFP22T7jO1qn/1dnGmX2fV2g91oN9n99nN7zv5sj9rv7Hn7i+1n+9th9lU73L5mR9jXbaod+bt4vH3bTrAT7SQ72U6xU38Xz7KzbbqdY+fa9+08O/93cYb9yC60WXaRXWyX2KW/xpd7yrIf2+X2E5ttV9iVdpVdbdfYtXbdX3tdZbfYrXab3Wc/szvsTrvL7rZ77N5f48vnccB+YXPsl/aI/dYesl/Zw/aYzbXf/BpfPr9j9nt73P5gT9iT9pT90Z62P9kz9uyv53/53H+0F+0l660gIEmKNAWUj/JTDBWgWLqG4uhaKkjXUYSup3i6gQrRjVSYilBRKkYJVJxKkCEkS0QhlaRSFKWbqDTdTIlUhspSOXJUnpLoFqpAt1JFuo0q0e1Ume6gKlSVqlF1upNq0F1Uk2pRbbqb6lBdqkf16R5qQPdSQ7qPGtH91JgeoCb0IDWlh6gZPUzN6RFqQY9SS3qMWlFrakNtqR09Tu3pCepAHakTPUmd6SnqQk9TMj1DXelZ6kbPUXd6nnrQC9STXqRe1Jv60EvUl16mftSfUmgADaRXaBANpiE0lIbRqzScXqMR9Dql0kgaRW/QaHqTxtBbNJbG0Xh6mybQRJpEk2kKTaU0eoem0bs0nd6jGTSTZtFsSqc5NJfep3k0nxbQB7SQPqRFtJiW0FLKoI8ok5ZRFn1My+kTyqYVtJJW0WpaQ2tpHa2nDbSRNtFm2kJbaRttp09pB+2kXbSb9tBe2kef0X76nA7QF5RDX9JB+hMdoq/oMH1NufQNHaFv6Sh9R8foezpOP9AJOkmn6Ec6TT/RGTpL5+hnOk+/0AW6SJfIkwghlKEKdRiE+cL8YUxYIIwNrwnjwmvDguF1YSS8PowPbwgLhTeGhcMiYdGwWJgQFg9LhCbE0IYUhmHJsFQYDW8KS4c3h4lhmbBsWC50YfkwKbwlrBDeGlYMbwsrhbeHlcM7wiph1fDR+6uHd4Y1wrvCmmGtsHZ4d1gnrBvWC+uH94QNwnvDhuF9YaPw/rBi+EDYJHwwbBo+FDYLHw6bh4+ELcJHw5bhY2GrsHXYJmwbtgsfD9uHT4Qdwo5hp/DJsHP4VNglfDpMDp8Ju4bP/uHxlHBAODB8JXwl9P4+tSS6NJoR/SiaGV0WzYp+HF0e/SSaHV0RXRldFV0dXRNdG10XXR/dEN0Y3RTdHN0S3RrdFvW+fn7hwEmnnHaBy+fyuxhXwMW6a1ycu9YVdNe5iLvexbsbXCF3oyvsiriirphLcMVdCWccOuvIha6kK+Wi7iZX2t3sEl0ZV9aVc86Vd0murWvn2rn27gnXwXV0ndyT7kn3lHvKPe2eds+4ru5Z180957q7510P94J7wb3oernero97yfV1L7t+rr9LcSluoBvoBrlBbogb4oa5YW64G+5GuBEu1aW6UW6UG+1GuzFujBvrxrrxbryb4Ca4SW6Sm+KmuDSX5qa5aW66m+5muBlulpvl0l26m+vmunlunlvgFriFiQvdIrfILXFLXIbLcJku02W5LLfcLXfZLtutdCvdarfarXVr3Xq33m10G91mt9ltdVvddrfd7XA73C63y+1xe9w+t8/td/vdAXfA5bgcd9AddIfcIXfYfe1y3TfuiPvWHXXfuWPue3fc/eBOuJPulPvRnXY/uTPurDvnfnbn3S/ugrvoLjnv0iLvRKZF3o1Mj7wXmRGZGZkVmR1Jj8yJzI28H5kXmR9ZEPkgsjDyYWRRZHFkSWRpJCPyUSQzsiySFfk4sjzySSQ7siKyMrIqsjqyJuJ98R2hL+lL+ai/yZf2N/tEX8aX9eW88+V9kr/FV/C3+or+Nl/J3+4r+zt8FV/VV/OP+Va+tW/j2/p2/nHf3j/hO/iOvpN/0nf2T/ku/mmf7J/xXf2zvpt/znf3z/se/gXf07/oe/nevo9/yff1L/t+vr9P8QP8QP+KH+QH+yF+qB/mX/XD/Wt+hH/dp/qRfpR/w4/2b/ox/i0/1o/z4/3bfoKf6Cf5yX6Kn+rT/Dt+mn/XT/fv+Rl+pp/lZ/t0P8fP9e/7eX6+X+A/8Av9h36RX+yX+KU+w3/kM/0yn+U/9sv9Jz7br/Ar/Sq/2q/xa/06v95v8Bv9Jr/Zb/Fb/Ta/3X/qd/idfpff7ff4vX6f/8zv95/7A/4Ln+O/9Af9n/wh/5U/7L/2uf4bf8R/64/67/wx/70/7n/wJ/xJf8r/6E/7n/wZf9af8z/78/4Xf8Ff9Jf4b9YYY4wxxv5L1B8cH/BPPid/W5cNFEJcu7NY7j/W3Fz4z/vBMqFzRAjxTP+eD/9l1amTkpLy22OzlQhKLRZCRK7k5xNX4hWik3hKJIuOosI/7W+w7H2e/qB+9HYhYv/auRAx4i/x39a/9T+o//iT4zMrh+fi/5P6i4VILHUlp4C4El+pX/E/qF+k/R/0X+CrNCE6/E1OnLgSX6mfJJ4Qz4rkv3skY4wxxhhjjDH2Z4Nlte5/dP98+f48QV/JyS+uxH90f84YY4wxxhhjjLGr7/nefZ5+PDm5Y3fe8IY3vPnr5mr/ZGKMMcYYY4z9u1256L/anTDGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY3nX/49/J3a1z5ExxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhi72v5PAAAA//+nkUE+") creat(&(0x7f0000000580)='./bus\x00', 0x9e) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000000100)='?', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1e1101, 0x5c) 22.432064834s ago: executing program 0 (id=459): socket$can_bcm(0x1d, 0x2, 0x2) socket$can_bcm(0x1d, 0x2, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x10}}], 0x50}, 0x40002002) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000300000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r3}, 0xc) 21.677941563s ago: executing program 0 (id=462): r0 = memfd_create(&(0x7f00000006c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJBu\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xef`i\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5\b\b<\x96:\x1b\x9f\x883~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x9a\x84\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0x78) r1 = fanotify_init(0x200, 0x1000) r2 = dup(r0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = fcntl$dupfd(r2, 0x406, r3) fanotify_mark(r1, 0x1, 0x800000a, r4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendfile(r5, r2, &(0x7f0000000040)=0x8, 0x2bb) 21.193341634s ago: executing program 34 (id=462): r0 = memfd_create(&(0x7f00000006c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJBu\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xef`i\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5\b\b<\x96:\x1b\x9f\x883~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x9a\x84\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0x78) r1 = fanotify_init(0x200, 0x1000) r2 = dup(r0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = fcntl$dupfd(r2, 0x406, r3) fanotify_mark(r1, 0x1, 0x800000a, r4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendfile(r5, r2, &(0x7f0000000040)=0x8, 0x2bb) 7.188713188s ago: executing program 4 (id=530): socket$nl_sock_diag(0x10, 0x3, 0x4) read$eventfd(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000480)='./file0\x00', 0x18000, &(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES16, @ANYRESOCT, @ANYRES8=0x0, @ANYRES32=0x0, @ANYRES64, @ANYRESDEC=0x0], 0x1, 0x304, &(0x7f0000000bc0)="$eJzs3M9PE2kYwPGnPyhtCZTDZje7yYZ3dy/rZQLVs9IYSIxNJEiNPxKTAabadGxJp8HUGJGTV+PNf8AD4ciNRPkHuHjTixdvXEw8yME4ptMZSssUpLSUH99PQubhfd5nOm9byDMNL1u3Xz7KZy0tq5clGFUSEBHZFhmWoHgC7jHoxBHZ7blcGPj64e+bd+5eT6XTE9NKTaZmLiaVUkMjbx8/jbnT1vtlc/j+1pfk583fN//c+jHzMGepnKUKxbLS1WzxU1mfNQ01n7PymlJTpqFbhsoVLKNUyxdr+axZXFioKL0wPxhfKBmWpfRCReWNiioXVblUUaEHeq6gNE1Tg3HBQTIr09N6qs3iuQ5fDLqkVErpIRGJ7clkVnpyQQAAoKea+/+gqE72/6v/bpQHbq0Nuf3/esSv/7/0sXauhv4/KiK+/b/3+L79v364/n9vR3RK2XZbZUfq/3EyjET2DAXqYTVZSulx9+fXsXxvddQJ6P8BAAAAAAAAAAAAAAAAAAAAADgNtm07Ydt2wjt6X/0iEnU2ltS+9ykNiciVHlwyOugIrz/OgPrGvfCQiPliMbOYqR3dCRsiYjqvf0K+O+8HVzX2dh6pqmF5Zy659UuLmZCTSWUlJ6YYMiaJPmmut+3Ja+mJMVXTWN8n8d31SUnIb/71Sd/6iPz/3656TRLyfk6KYsq8u2HOq382ptTVG+mm+pgzDwAAAACAs0BTO3zv3zWtVb5Wv3N/Pdr0+UCofn896nt/Hpa/wr1dOwAAAAAA54VVeZLXTdMo7QSDItI4EpPmOZ0Mwl06s7fCX63y/paheyvdJ/AevCEVdQc7/rQEDvG0tAiC0k7VSHU1qin1z7LP2vcLvI+NWs2RqXF35HXLOd0J/nj15lvnTnh5LXrAStsPQvu/AfqO57cPAAAAgONUb/q9kfHeXhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOfQcfx3tF6vEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgpfgYAAP//2a0C7Q==") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) fdatasync(r0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 6.449891086s ago: executing program 5 (id=536): syz_usb_connect(0x3, 0x2d, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='addr\x00', &(0x7f0000000180)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000240)='vers\x00', &(0x7f0000000280)='3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000340)='mountproto\x00', &(0x7f0000000380)='udp\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='timeo\x00', &(0x7f0000000400)='1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 6.079718164s ago: executing program 3 (id=538): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) close(0x3) 5.575632827s ago: executing program 4 (id=539): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000080000000d"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=@base={0xb, 0x7, 0x3, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000000800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 5.233674344s ago: executing program 3 (id=540): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r2, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ppoll(&(0x7f0000000000)=[{r1, 0xa43c}, {r0, 0x4221}], 0x2, 0x0, 0x0, 0x0) recvmmsg$unix(r0, &(0x7f0000003c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10000, 0x0) 4.823506485s ago: executing program 4 (id=542): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time\x00', 0x26e1, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="12000000070000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0xfb1585202ff31891}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x10000, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendmsg$inet(r5, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) 4.693399587s ago: executing program 3 (id=543): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a0101000000dd000000000a0000070900010073797a31000000000900030073597a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000020000380100000800c00018006000100d10300000c000080080003400000000214000000110001"], 0xb0}, 0x1, 0x0, 0x0, 0x14}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180060001000000000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c733d8a370000001006000000000000", @ANYRES32=0x0, @ANYBLOB="262d0300b5cd01002c0012800e00010069703665727370616e0000001800028014"], 0x4c}, 0x1, 0x0, 0x0, 0x4040014}, 0x200440c4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c0100000d0a010800000000000000000a0000010900020073797a31000000000900010073797a310000000000010380fc"], 0x12c}, 0x1, 0x0, 0x0, 0x4008805}, 0x8000) 4.223570008s ago: executing program 3 (id=545): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000180)='./file0\x00', 0x200000, &(0x7f0000000080)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYRESOCT], 0x1, 0x392, &(0x7f0000001000)="$eJzs3T1vW2UUAOATt/mExBkQEiDEq24sVhL+QCPUSohIoFCj0gFxS5xixY0j2wpyhaADEiv/gL1iZENC/IEMsLOxZWHsUNXIX6mdul+kyaXq80jRPfZ7jvO+tnx1FuscXv3x5s52s7SdtaJwMUUhIgp3I5Z7Ud/U4FroxTMx6na8W7z619uffHbtw/WNjUubKV1ev/LeWkpp6Z3fvv7m5wu/t1759JelX2fjYPnzw3/W/j54/eCNw/tXvqo2U7WZduutlKXr9Xoru16rpK1qc6eU0se1StaspOpus9IYW9+u1ff22inb3Vpc2GtUms2U7bbTTqWdWvXUarRTdiOr7qZSqZQWF4InKd/Z3MzW+/HcY/IuntWGOAWNxnrW/Q7PPrRSvpPLhgCAXJ20/595qv7/WmGk/5+LR/b/06H/fy6mny5ttP//zy/C/1y3/58ZfH/H6f8BAAAAAAAAAAAAAOBFcLfTKXY6neLw2hn+SHjwOOftccoe+vyP/eW9P07XyA/35iJqP+yX98v9a399fTuqUYtKrEQx7nVvC0P9+PIHG5dWUs9yLN78rld/4Y+I8rnx+tUoxvLk+tV+fTqqj+51OhZG69fii3htcv3axPqZWPlppL4Uxfjzy6hHLbZ6t7cH9d+upvT+RxvH6md7eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8HEpp6K3oz73fL0fMx/5gfn/pQcLy+Hz8fv3RfP2VKMa9yfP5VybO5z8fb57P9+wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNRs39rJarVK46yC4cz/3jMzw+DRVVP99NvHluZjPHn2Sa9zwqDwTFXzg0NOWLrf6XR6wY3vn/tW5872ozxJMB0Rj8npDN7Ak/+vVyNi9Jlz4zmzEXGqJ13qBoX83/BnDvK4GwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEC+joZ+dx9M5b0bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8tJs39rJarVK4xSDvM8IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwIvk3AAD//8s8Cyw=") r1 = inotify_init1(0x80000) inotify_add_watch(r1, &(0x7f0000000200)='.\x00', 0x1000401) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x85) lseek(r2, 0x104, 0x1) getdents64(r2, 0x0, 0x4f) 4.106437081s ago: executing program 4 (id=546): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2a}]}, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x28}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x7a, &(0x7f00000004c0)=ANY=[], 0x0) 4.014882033s ago: executing program 5 (id=547): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1c8) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff097b00000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f00000008c0)='./file0\x00', &(0x7f0000000240), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@nodevmap}]}}) r3 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') pread64(r3, &(0x7f0000002240)=""/237, 0xed, 0x4eb) 3.862357027s ago: executing program 6 (id=548): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) 3.672710881s ago: executing program 5 (id=549): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffa}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000280)=ANY=[], 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) 3.405508348s ago: executing program 6 (id=550): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000010000000000000000000000a5000000a000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xb9) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x7, 0x8, 0x22}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="05"], 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xe, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) listen(r3, 0xb) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000840)=r2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000011dc0)={{r4}, &(0x7f0000011d40), &(0x7f0000011d80)=r2}, 0x20) 3.387222828s ago: executing program 3 (id=551): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x5, 0x4, 0x4, 0x8}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000600850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000ac0)={{r0}, &(0x7f0000000a40), &(0x7f0000000a80)='%pS \x00'}, 0x20) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 3.227169022s ago: executing program 5 (id=552): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x3, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r1, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000002c00)=[{&(0x7f0000001500)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)="08e0ac8fb1d99df61d7b518d0a62", 0xe}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f00000005c0)="f5fbfd4f1595317700ff55f1f960ff70fba64053ef1c952b8561071ccfbed96b7227eaaf92a1358afc148a8aafa58b2444561acf9a5114b207019da8518fea9fd189e3616ec0ad37f86f431d6f4f1fbe1b0e3e640ac2b1f7ff33cf28d27c40513b6cee87fbd144c842c5c7b6752ea19efcfca738ac5207318c1bc30db2a727ce9a82303920eb2a3b0aa99902f8423e754843e7d6ceb06048a8d918680c042a42370dc807a398af793f4b1a3107c3771474ba13d826ce5634d33c485f3f97cffc9ea1e026f4327e96d5a40268c75358061e75633ebe43e946f2bad55973c81fff7d4843dd1db36180dd3b5692f98ace6805c67a9e20216aac908b9a6111c6", 0xfe}], 0x5}}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000001580)="ce90bfdb", 0x68}, {&(0x7f00000007c0)="f2e659", 0x3}, {&(0x7f0000002e40)="d4", 0x1}], 0x3}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f0000001680)="d8", 0x1}, {&(0x7f0000001600)="f2964dd1", 0x4}, {&(0x7f0000000580)="b8a2f6", 0x3}, {&(0x7f00000002c0)="7940e900e0377757a9edc0d9376c21328ad2f7584fe4c8b712b3e5e08ecff5258151bd9eea7b4ce21f67ab51922ce035987127fda5812df903188e321419610f4beb6cdf6fa073876157c4f1d2054439d8db3f4d937872de928b62741fd60e6b56979ad883f89a02e24a577275bfb498b7a127abd0eb099e704d18d63dad611b45acfc3b8dc5457c8383d7d8621942e8e2ce6e4017dd6e5ed9732e739be6593c3b033524669ce17c3b822a6953eb11a20921220000000000000000", 0xbb}, {&(0x7f0000000280)="87", 0x1}], 0x7}}, {{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000880)="87", 0x1}, {&(0x7f0000000900)="11e09017", 0xfffffec4}], 0x2}}], 0x4, 0x4000000) sendmsg$unix(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000004c0)="e6", 0x1}], 0x1, 0x0, 0x0, 0xc000}, 0x40041c0) 3.040443547s ago: executing program 4 (id=553): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @loopback, 0x3}, 0x1c) 2.997858278s ago: executing program 6 (id=554): r0 = inotify_init() r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r2, 0x0) connect$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.833913432s ago: executing program 3 (id=555): r0 = socket$inet_sctp(0x2, 0x5, 0x84) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) listen(r0, 0x9) readv(r0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/4082, 0xff2}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0xc369d000) 2.698031275s ago: executing program 7 (id=464): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000001c0)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300), &(0x7f0000000400)=ANY=[@ANYBLOB="80000000ffffffffffff080211000001080211000001000000000000000000006400010072046d65736871070101000000000025030001017606050000000100030101010102"], 0x46) 2.676445736s ago: executing program 6 (id=556): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x10) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./bus\x00', 0x3c9c9b, 0x0, 0x0, 0x0, &(0x7f0000000140)) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x81) readahead(r0, 0x6, 0x1) 2.374660352s ago: executing program 4 (id=557): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) r1 = timerfd_create(0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002ac0)={0x1a, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xfffff}, 0x80) read(r1, &(0x7f0000002180)=""/262, 0x106) timerfd_settime(r1, 0x3, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) 2.361563293s ago: executing program 6 (id=558): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$inet(0x2, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000180)=0x6, 0x4) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) 2.182737937s ago: executing program 5 (id=559): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ff}, [@call={0x85, 0x0, 0x0, 0xae}, @printk={@llu, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x20000, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r3}, &(0x7f0000000280), &(0x7f0000000240)=r0}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 1.931099163s ago: executing program 5 (id=560): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120100001d9167204f17316a3f26010203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 1.584551542s ago: executing program 7 (id=561): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000070000000200000007"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000010018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000b98cad95850000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$inet(r3, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x8000) 1.151174762s ago: executing program 7 (id=562): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0x8, {"a2e3ad214fc752f91b5d36f70b06d038e7ff7fc6e5539b385d098b089b3b08381a090890e0878f0e1ac6e7049b3344959b609a240c872adb988f7e0319520100ffe8d178708c523c921b1b5b31310d095d0636cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08c4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e800ba9abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40d4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889632b3570243f989cce3803f465e41e610c2021d653a5520094ec79553299388b0000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a4d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a72eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c2d88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d606495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07840900000000000000f5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b19bb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0545359bafffa452370000000010403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae2d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e709000000000000004fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83000000000000010058b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c000003716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff7544130700000000000000f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc6c71737b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b93903000000000000001c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f9354b9094f22b625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c558069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae0000000000000007eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c73144f8e4a737afae5136651b1b9bd522d6039947329710309d83fdd9d8b4ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c10613d17ca51075f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb401000000608d6f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655bff4801784c416b22f73d32d678e2724f43f1fe687c7e8a605fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d7000bdbfc43c10ec23ea6283994a7dde4dcb61fea6b611fb1d6245939241a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f4820000000000000900a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78cd7d79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2e0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77900b5f07722e47afed367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15f2dbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af500ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000eeffffffffffffff00000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) bind$can_raw(r1, &(0x7f0000000000), 0x10) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r2, 0x65, 0x1, &(0x7f0000000080), 0x1d0) bind$can_raw(r2, &(0x7f00000001c0), 0x10) dup3(r0, r1, 0x80000) 737.878882ms ago: executing program 7 (id=563): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x6, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r1}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @call={0x85, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r1, r2, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r0}, 0x20) sendmmsg$inet(r0, &(0x7f00000022c0)=[{{0x0, 0x0, &(0x7f0000001c40)=[{&(0x7f0000000c00)="060183e8ecb6", 0x6}], 0x1}}], 0x1, 0x11) 368.484671ms ago: executing program 7 (id=564): io_setup(0x8, &(0x7f0000000540)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000001c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x1}) socket$packet(0x11, 0x3, 0x300) sendmsg$NL80211_CMD_DEL_INTERFACE(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) 0s ago: executing program 6 (id=565): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./bus\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYRES8=0x0, @ANYRESDEC], 0x1, 0x30e, &(0x7f0000000f00)="$eJzs3E1rE10UwPGTNEnTlHayeHhEQXrRjW6GNu7FIC2IAUttxBcQp81EQ8akZEIlIrZduXEhfggXpcvuCtov0I07V27cdSO4sAtxJDOTl7aJrWnSWPv/QZlD7j0z9+Y24dyBzPbdN0/zWVvPGmUJRpUERER2ROISlJqAfwy6cUSaLcvl4W+fzt++d/9mMpWanFFqKjl7JaGUGh17/+zFkN9tY1C24g+3vya+bP2/dXb75+yTnK1ytioUy8pQc8XPZWPOMlUmZ+d1paYt07BNlSvYZslrd5ZELFNlreLCQkUZhcxIbKFk2rYyChWVNyuqXFTlUkUZj41cQem6rkZigoOkV2dmjGSHyfNdHgx6pFRKGgMiMrSvJb3alwEBAIC+8uv/erUfrJb0ndT/oZb1/9qFzfLwnfVRv/7fiFTrf5Gm+v9R41ymygTr9X9URBr1f9HbH3S7/t9fEZ1sr3cvjjhOPYy06n+k+h8nRLX+j/mfX9fKg7VxN6D+BwAAAAAAAAAAAAAAAAAAAADgJNhxHM1xHM07DvivOtqgiETdX5B47X0eJnpk9/o3/lj/06Hx4I7QqIj1ajG9mPaOfodNEbHElHHR5If7/+CrxpFl5XZSVXH5YC35+UuLae+7JJmVnJs/IZrE9+Y7ztSN1OSE8uzOD0usOT8hmvzXOj+xNz9cPUbk0sWmfF00+TgvRbEk4/8yrpb/ckKp67dSe64/5PYDAAAAAOBfoKu6+v59sLld39/u7Y+9dm9/HZLW9we8/fV4y/19SM6F+jVrAAAAAABOF7vyPG9YllnqUbAiIj2+RJugNsPDZtUekNumT0AC7Zq6ENQu3ll6dWxdG0/4UO9YsKOhjkX+cFFaBrXbRu36yHQnZ3Y0kaO+h2fevvv++z7enTGRw5zw6nr0gJl2GkQOmmn42L6AAAAAABybRtFfe+VafwcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMApdByP4uv3HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC/xa8AAAD//46ZAFE=") ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_udp_int(r0, 0x11, 0xb, &(0x7f0000000200)=0x6, 0x4) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x4, 0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xe4776000) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e24, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000300)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x68, 0x0, 0x0, 0x88, 0x0, @remote, @local}, {0xfffe, 0x4e24, 0x4d, 0x0, @wg=@initiation={0x1, 0x4, "497a1d08fd3d0ee007022798bb6374ed840b4f36f41fc4d035e9ebe414aa958d", "4bbef5e4007898221aa606d083cd59745493938f1e2de8fdadd3823fedd2c01b2aff03050a4ca5d10fd1b6b06f47ea42", "ef7c9d6a98e3943f6892078bb952854743fe4dddd2e7c0ce70a4ac7d", {"a851525b16af17fe87acbae2ab0b233d", "01422d01cd53c3abe94331d0b7918724"}}}}}}}, 0x0) kernel console output (not intermixed with test programs): .102664][ T76] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.136194][ T76] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.165500][ T76] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.174341][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 85.181952][ T4293] Bluetooth: hci0: command 0x0419 tx timeout [ 85.188025][ T4293] Bluetooth: hci2: command 0x0419 tx timeout [ 85.199923][ T4291] Bluetooth: hci3: command 0x0419 tx timeout [ 85.199946][ T4292] Bluetooth: hci4: command 0x0419 tx timeout [ 85.220562][ T76] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.228628][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 85.244538][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 85.256912][ T4272] device veth0_macvtap entered promiscuous mode [ 85.269428][ T4293] Bluetooth: hci1: command 0x0419 tx timeout [ 85.298762][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 85.336655][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 85.375132][ T4272] device veth1_macvtap entered promiscuous mode [ 85.446114][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.467562][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.484415][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.496744][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.515105][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.526983][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.545460][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.556276][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.576083][ T4272] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.596958][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.616429][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.627858][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.643212][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.657034][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.674042][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.687630][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.703924][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.723394][ T4272] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.741536][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 85.764005][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 85.775335][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 85.785895][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 85.796075][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 85.806643][ T4376] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8'. [ 85.872376][ T4272] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.883169][ T4272] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.892793][ T4272] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.908978][ T4272] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.087383][ T76] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.104324][ T76] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.133692][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 86.243028][ T4337] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.258755][ T4337] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.279704][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 86.326769][ T4393] ======================================================= [ 86.326769][ T4393] WARNING: The mand mount option has been deprecated and [ 86.326769][ T4393] and is ignored by this kernel. Remove the mand [ 86.326769][ T4393] option from the mount to silence this warning. [ 86.326769][ T4393] ======================================================= [ 86.551891][ T26] cfg80211: failed to load regulatory.db [ 87.508838][ T4415] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 88.011200][ T4293] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.019758][ T4293] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.032257][ T4293] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.044480][ T4293] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.055274][ T4293] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 88.063778][ T4293] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.345353][ T4431] FAULT_INJECTION: forcing a failure. [ 88.345353][ T4431] name failslab, interval 1, probability 0, space 0, times 1 [ 88.390049][ T4431] CPU: 1 PID: 4431 Comm: syz.3.28 Not tainted syzkaller #0 [ 88.397339][ T4431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 88.407454][ T4431] Call Trace: [ 88.410780][ T4431] [ 88.413759][ T4431] dump_stack_lvl+0x188/0x24e [ 88.418500][ T4431] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 88.424202][ T4431] ? show_regs_print_info+0x12/0x12 [ 88.429454][ T4431] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 88.435160][ T4431] should_fail_ex+0x390/0x4c0 [ 88.439901][ T4431] should_failslab+0x5/0x20 [ 88.444538][ T4431] slab_pre_alloc_hook+0x59/0x300 [ 88.449622][ T4431] kmem_cache_alloc+0x56/0x2f0 [ 88.454419][ T4431] ? __kernfs_new_node+0xe1/0x7f0 [ 88.459487][ T4431] __kernfs_new_node+0xe1/0x7f0 [ 88.464400][ T4431] ? kernfs_new_node+0x250/0x250 [ 88.469382][ T4431] ? sysfs_create_dir_ns+0x12c/0x290 [ 88.474709][ T4431] kernfs_new_node+0x148/0x250 [ 88.479507][ T4431] __kernfs_create_file+0x47/0x2e0 [ 88.484657][ T4431] sysfs_add_file_mode_ns+0x233/0x2f0 [ 88.490067][ T4431] sysfs_create_file_ns+0x128/0x1b0 [ 88.495303][ T4431] ? sysfs_add_bin_file_mode_ns+0x200/0x200 [ 88.501239][ T4431] device_add+0x554/0x1050 [ 88.505692][ T4431] ? input_register_device+0x854/0x12d0 [ 88.511274][ T4431] input_register_device+0xa53/0x12d0 [ 88.516684][ T4431] ? input_ff_create+0x24e/0x2e0 [ 88.521658][ T4431] uinput_create_device+0x53e/0x680 [ 88.526898][ T4431] uinput_ioctl_handler+0x7a0/0x13d0 [ 88.532212][ T4431] ? uinput_release+0x50/0x50 [ 88.536929][ T4431] ? bpf_lsm_file_ioctl+0x5/0x10 [ 88.541902][ T4431] ? security_file_ioctl+0x7c/0xa0 [ 88.547039][ T4431] ? uinput_poll+0x120/0x120 [ 88.551653][ T4431] __se_sys_ioctl+0xfa/0x170 [ 88.556276][ T4431] do_syscall_64+0x4c/0xa0 [ 88.560719][ T4431] ? clear_bhb_loop+0x60/0xb0 [ 88.565442][ T4431] ? clear_bhb_loop+0x60/0xb0 [ 88.570173][ T4431] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 88.576099][ T4431] RIP: 0033:0x7fc046d9e199 [ 88.580546][ T4431] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.600176][ T4431] RSP: 002b:00007fc047c28028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 88.608619][ T4431] RAX: ffffffffffffffda RBX: 00007fc047025fa0 RCX: 00007fc046d9e199 [ 88.616636][ T4431] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 [ 88.624628][ T4431] RBP: 00007fc046e358e0 R08: 0000000000000000 R09: 0000000000000000 [ 88.632645][ T4431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.640639][ T4431] R13: 00007fc047026038 R14: 00007fc047025fa0 R15: 00007ffc8d2a1fd8 [ 88.648650][ T4431] [ 88.871250][ T4437] Illegal XDP return value 1709965356 on prog (id 9) dev syz_tun, expect packet loss! [ 89.083894][ T4304] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.135423][ T4421] chnl_net:caif_netlink_parms(): no params data found [ 89.209924][ T4304] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.412397][ T4304] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.528591][ T4304] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.593798][ T4421] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.613573][ T4421] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.634049][ T4421] device bridge_slave_0 entered promiscuous mode [ 89.690614][ T4421] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.710105][ T4421] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.724998][ T4421] device bridge_slave_1 entered promiscuous mode [ 89.726713][ T4451] syz.4.34 (4451) used greatest stack depth: 16272 bytes left [ 89.867178][ T4421] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.908588][ T4421] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.042923][ T4421] team0: Port device team_slave_0 added [ 90.076726][ T4421] team0: Port device team_slave_1 added [ 90.140491][ T4293] Bluetooth: hci2: command 0x0409 tx timeout [ 90.284046][ T4421] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.318669][ T4421] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.411530][ T4421] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.506833][ T4465] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.515376][ T4465] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.578574][ T4465] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.586354][ T4465] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.594390][ T4465] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.601784][ T4465] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.715347][ T4465] team0: Port device bridge0 added [ 90.854952][ T4467] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.887073][ T4467] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.042929][ T4421] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.050905][ T4421] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.116174][ T4421] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.353636][ T4421] device hsr_slave_0 entered promiscuous mode [ 91.384913][ T4421] device hsr_slave_1 entered promiscuous mode [ 91.412822][ T4421] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.445503][ T4421] Cannot create hsr debugfs directory [ 91.450225][ T4487] FAULT_INJECTION: forcing a failure. [ 91.450225][ T4487] name failslab, interval 1, probability 0, space 0, times 0 [ 91.451081][ T4487] CPU: 0 PID: 4487 Comm: syz.4.44 Not tainted syzkaller #0 [ 91.451103][ T4487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 91.451116][ T4487] Call Trace: [ 91.451123][ T4487] [ 91.451132][ T4487] dump_stack_lvl+0x188/0x24e [ 91.451166][ T4487] ? show_regs_print_info+0x12/0x12 [ 91.451194][ T4487] ? load_image+0x410/0x410 [ 91.451230][ T4487] ? __might_sleep+0xd0/0xd0 [ 91.451252][ T4487] ? __lock_acquire+0x7ea0/0x7ea0 [ 91.451288][ T4487] should_fail_ex+0x390/0x4c0 [ 91.451324][ T4487] should_failslab+0x5/0x20 [ 91.451344][ T4487] slab_pre_alloc_hook+0x59/0x300 [ 91.451390][ T4487] ? tomoyo_encode+0x28a/0x550 [ 91.451420][ T4487] __kmem_cache_alloc_node+0x4f/0x270 [ 91.451451][ T4487] ? tomoyo_encode+0x28a/0x550 [ 91.451479][ T4487] __kmalloc+0xa3/0x240 [ 91.451503][ T4487] tomoyo_encode+0x28a/0x550 [ 91.451538][ T4487] tomoyo_realpath_from_path+0x578/0x5c0 [ 91.451571][ T4487] ? tomoyo_domain+0xd2/0x120 [ 91.451605][ T4487] ? tomoyo_mkdev_perm+0x1f5/0x5a0 [ 91.451633][ T4487] tomoyo_mkdev_perm+0x21e/0x5a0 [ 91.451670][ T4487] ? tomoyo_path_perm+0x610/0x610 [ 91.451726][ T4487] ? _raw_spin_unlock+0x24/0x40 [ 91.451747][ T4487] ? __d_add+0x4e2/0x7e0 [ 91.451773][ T4487] ? d_set_d_op+0x25b/0x370 [ 91.451796][ T4487] ? hook_path_mknod+0x157/0x520 [ 91.451826][ T4487] ? simple_lookup+0xc1/0xf0 [ 91.451864][ T4487] tomoyo_path_mknod+0xf8/0x190 [ 91.451893][ T4487] ? hook_path_mkdir+0x460/0x460 [ 91.451923][ T4487] ? tomoyo_path_symlink+0xf0/0xf0 [ 91.451957][ T4487] ? kern_path_create+0x50/0x50 [ 91.451987][ T4487] security_path_mknod+0xec/0x140 [ 91.452015][ T4487] do_mknodat+0x245/0x4d0 [ 91.452050][ T4487] ? do_o_path+0x200/0x200 [ 91.633241][ T4487] ? getname_flags+0x206/0x500 [ 91.638070][ T4487] __x64_sys_mknodat+0xa5/0xc0 [ 91.642890][ T4487] do_syscall_64+0x4c/0xa0 [ 91.647363][ T4487] ? clear_bhb_loop+0x60/0xb0 [ 91.652094][ T4487] ? clear_bhb_loop+0x60/0xb0 [ 91.656828][ T4487] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 91.662770][ T4487] RIP: 0033:0x7f671839e199 [ 91.667235][ T4487] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.686905][ T4487] RSP: 002b:00007f6719252028 EFLAGS: 00000246 ORIG_RAX: 0000000000000103 [ 91.695366][ T4487] RAX: ffffffffffffffda RBX: 00007f6718625fa0 RCX: 00007f671839e199 [ 91.703382][ T4487] RDX: 0000000000006000 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 91.711417][ T4487] RBP: 00007f67184358e0 R08: 0000000000000000 R09: 0000000000000000 [ 91.719435][ T4487] R10: 0000000000000708 R11: 0000000000000246 R12: 0000000000000000 [ 91.727444][ T4487] R13: 00007f6718626038 R14: 00007f6718625fa0 R15: 00007ffd7335c438 [ 91.735486][ T4487] [ 92.219596][ T4293] Bluetooth: hci2: command 0x041b tx timeout [ 92.399450][ T4487] ERROR: Out of memory at tomoyo_realpath_from_path. [ 92.558094][ T4421] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 92.615068][ T4421] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 92.804205][ T4421] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 92.826065][ T4421] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 92.902209][ T4304] device hsr_slave_0 left promiscuous mode [ 92.923173][ T4304] device hsr_slave_1 left promiscuous mode [ 92.950268][ T4304] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 92.967982][ T4304] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 92.980228][ T4304] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 92.998896][ T4304] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 93.015692][ T4304] device bridge_slave_1 left promiscuous mode [ 93.028711][ T4304] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.055006][ T4304] device bridge_slave_0 left promiscuous mode [ 93.069296][ T4304] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.126704][ T4304] device veth1_macvtap left promiscuous mode [ 93.142887][ T4304] device veth0_macvtap left promiscuous mode [ 93.154148][ T4304] device veth1_vlan left promiscuous mode [ 93.162634][ T4304] device veth0_vlan left promiscuous mode [ 93.713496][ T4509] loop3: detected capacity change from 0 to 32768 [ 93.877865][ T4509] JBD2: Ignoring recovery information on journal [ 93.982384][ T4509] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 94.299441][ T4293] Bluetooth: hci2: command 0x040f tx timeout [ 94.346913][ T27] audit: type=1800 audit(1791377743.679:2): pid=4509 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.48" name="file1" dev="loop3" ino=17058 res=0 errno=0 [ 94.385639][ T4304] team0 (unregistering): Port device team_slave_1 removed [ 94.451302][ T4304] team0 (unregistering): Port device team_slave_0 removed [ 94.510333][ T4304] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 94.560168][ T4304] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 94.606373][ T4285] ocfs2: Unmounting device (7,3) on (node local) [ 94.810619][ T4539] loop3: detected capacity change from 0 to 4096 [ 94.983986][ T4539] EXT4-fs: Ignoring removed bh option [ 95.000738][ T4539] EXT4-fs (loop3): Test dummy encryption mode enabled [ 95.016358][ T4539] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 95.135551][ T4304] bond0 (unregistering): Released all slaves [ 95.217972][ T4520] netlink: 144 bytes leftover after parsing attributes in process `syz.4.49'. [ 95.247034][ T4539] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 95.270536][ T4534] netlink: 12 bytes leftover after parsing attributes in process `syz.2.52'. [ 95.523219][ T4285] EXT4-fs (loop3): unmounting filesystem. [ 95.624020][ T4421] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.707808][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 95.732947][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 95.780642][ T4421] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.834440][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 95.864697][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 95.894450][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.901676][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.954369][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 95.986199][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 96.027750][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 96.055960][ T4327] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.063169][ T4327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.119665][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 96.164951][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 96.228601][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 96.246925][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 96.270631][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 96.293099][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 96.334535][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 96.365003][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 96.379881][ T4283] Bluetooth: hci2: command 0x0419 tx timeout [ 96.400361][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 96.419162][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 96.429400][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 96.438996][ T4421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 97.067381][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 97.087430][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 97.119509][ T4421] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.889519][ T4603] loop2: detected capacity change from 0 to 2048 [ 97.968506][ T4603] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 98.084477][ T4284] EXT4-fs (loop2): unmounting filesystem. [ 98.111828][ T4611] netlink: 'syz.4.64': attribute type 1 has an invalid length. [ 98.137006][ T4611] netlink: 'syz.4.64': attribute type 2 has an invalid length. [ 98.185270][ T4611] netlink: 216 bytes leftover after parsing attributes in process `syz.4.64'. [ 98.315968][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 98.325808][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 98.335625][ T4293] Bluetooth: hci3: Invalid handle: 0xed88 > 0x0eff [ 98.366846][ T4421] device veth0_vlan entered promiscuous mode [ 98.380704][ T4421] device veth1_vlan entered promiscuous mode [ 98.387774][ T4304] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 98.412661][ T4304] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 98.432947][ T4304] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 98.452848][ T4304] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 98.474800][ T4304] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 98.499998][ T4614] batman_adv: batadv0: Adding interface: syzkaller0 [ 98.537177][ T4614] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.570589][ T4614] batman_adv: batadv0: Interface activated: syzkaller0 [ 98.624512][ T4421] device veth0_macvtap entered promiscuous mode [ 98.657705][ T4613] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 98.703234][ T4613] batman_adv: batadv0: Removing interface: syzkaller0 [ 98.725567][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 98.745089][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 98.771166][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 99.789241][ C1] sched: RT throttling activated [ 99.931766][ T4421] device veth1_macvtap entered promiscuous mode [ 100.073772][ T4421] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 100.142403][ T4421] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.166432][ T4421] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 100.197800][ T4421] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.223744][ T4421] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 100.254964][ T4421] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.287319][ T4421] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 100.318557][ T4421] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.351466][ T4421] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.409030][ T4644] device vlan2 entered promiscuous mode [ 100.419588][ T4644] device bridge0 entered promiscuous mode [ 100.455402][ T4647] bridge0: port 3(vlan3) entered blocking state [ 100.486299][ T4649] netlink: 'syz.0.73': attribute type 8 has an invalid length. [ 100.495003][ T4649] netlink: 4 bytes leftover after parsing attributes in process `syz.0.73'. [ 100.509561][ T4649] netlink: 8 bytes leftover after parsing attributes in process `syz.0.73'. [ 100.533679][ T4647] bridge0: port 3(vlan3) entered disabled state [ 100.543957][ T4647] device vlan3 entered promiscuous mode [ 100.584241][ T4647] bridge0: mtu less than device minimum [ 100.595706][ T4304] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 100.615968][ T4304] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 100.658235][ T4421] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 100.686029][ T4421] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.731913][ T4421] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 100.764224][ T4421] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.796365][ T4421] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 100.809386][ T4421] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.828736][ T4421] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 100.859387][ T4421] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.894449][ T4421] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.918873][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 100.932627][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 100.967014][ T4421] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.987289][ T4421] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.007869][ T4421] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.028127][ T4421] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.111279][ T4640] loop2: detected capacity change from 0 to 40427 [ 101.154697][ T4640] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 101.199187][ T4640] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 101.226487][ T4640] F2FS-fs (loop2): invalid crc value [ 101.268755][ T4337] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.296286][ T4337] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.317867][ T4640] F2FS-fs (loop2): Found nat_bits in checkpoint [ 101.332207][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 101.435561][ T76] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.453761][ T76] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.484866][ T4304] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 101.559432][ T4640] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 101.567032][ T4640] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 101.830010][ T4679] netlink: 24 bytes leftover after parsing attributes in process `syz.5.21'. [ 102.784207][ T4705] netlink: 'syz.4.86': attribute type 4 has an invalid length. [ 102.851383][ T4711] syz.4.86 uses obsolete (PF_INET,SOCK_PACKET) [ 102.893188][ T4710] Bluetooth: MGMT ver 1.22 [ 102.962614][ T4711] netlink: 'syz.4.86': attribute type 4 has an invalid length. [ 103.230530][ T4727] FAULT_INJECTION: forcing a failure. [ 103.230530][ T4727] name fail_futex, interval 1, probability 0, space 0, times 1 [ 103.269605][ T4727] CPU: 1 PID: 4727 Comm: syz.4.91 Not tainted syzkaller #0 [ 103.276929][ T4727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 103.287039][ T4727] Call Trace: [ 103.290363][ T4727] [ 103.293333][ T4727] dump_stack_lvl+0x188/0x24e [ 103.298073][ T4727] ? security_file_alloc+0x30/0x110 [ 103.303320][ T4727] ? alloc_empty_file+0x90/0x180 [ 103.308308][ T4727] ? show_regs_print_info+0x12/0x12 [ 103.313557][ T4727] ? load_image+0x410/0x410 [ 103.318133][ T4727] ? mark_lock+0x94/0x320 [ 103.322527][ T4727] should_fail_ex+0x390/0x4c0 [ 103.327269][ T4727] get_futex_key+0x1b1/0x1000 [ 103.332035][ T4727] ? futex_setup_timer+0xc0/0xc0 [ 103.337039][ T4727] futex_wake+0x123/0x4f0 [ 103.341432][ T4727] ? futex_wake_mark+0x150/0x150 [ 103.346428][ T4727] ? percpu_counter_add_batch+0x135/0x150 [ 103.352223][ T4727] do_futex+0x2e2/0x320 [ 103.356432][ T4727] ? __ia32_sys_get_robust_list+0x100/0x100 [ 103.362390][ T4727] ? __lock_acquire+0x7ea0/0x7ea0 [ 103.367477][ T4727] __se_sys_futex+0x381/0x410 [ 103.372230][ T4727] ? __x64_sys_futex+0xf0/0xf0 [ 103.377026][ T4727] ? __x64_sys_futex+0x1d/0xf0 [ 103.381820][ T4727] do_syscall_64+0x4c/0xa0 [ 103.386271][ T4727] ? clear_bhb_loop+0x60/0xb0 [ 103.390978][ T4727] ? clear_bhb_loop+0x60/0xb0 [ 103.395685][ T4727] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 103.401603][ T4727] RIP: 0033:0x7f671839e199 [ 103.406048][ T4727] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.425861][ T4727] RSP: 002b:00007f67192520e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 103.434320][ T4727] RAX: ffffffffffffffda RBX: 00007f6718625fa8 RCX: 00007f671839e199 [ 103.442344][ T4727] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f6718625fac [ 103.450434][ T4727] RBP: 00007f6718625fa0 R08: 000abe9df392e5c8 R09: 0000000000000000 [ 103.458451][ T4727] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 103.466472][ T4727] R13: 00007f6718626038 R14: 00007ffd7335c350 R15: 00007ffd7335c438 [ 103.474493][ T4727] [ 103.634372][ T4735] loop2: detected capacity change from 0 to 2048 [ 103.701553][ T4735] loop2: p1 p3 p4 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 [ 103.704854][ T4735] loop2: p1 start 262144 is beyond EOD, truncated [ 103.829206][ T4735] loop2: p3 start 33554432 is beyond EOD, truncated [ 103.848021][ T4735] loop2: p5 start 262144 is beyond EOD, truncated [ 103.858128][ T4735] loop2: p6 start 33554432 is beyond EOD, truncated [ 103.867270][ T3730] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 103.937203][ T4735] loop2: p7 start 262144 is beyond EOD, truncated [ 103.978673][ T4735] loop2: p8 start 33554432 is beyond EOD, truncated [ 104.054929][ T4735] loop2: p9 start 262144 is beyond EOD, truncated [ 104.095142][ T4735] loop2: p10 start 33554432 is beyond EOD, truncated [ 104.106834][ T3730] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 104.134043][ T3730] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 104.160456][ T4747] loop4: detected capacity change from 0 to 128 [ 104.166523][ T4735] loop2: p11 start 262144 is beyond EOD, truncated [ 104.179218][ T3730] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 104.188548][ T3730] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 104.216980][ T4735] loop2: p12 start 33554432 is beyond EOD, truncated [ 104.235512][ T4735] loop2: p13 start 262144 is beyond EOD, truncated [ 104.242643][ T3730] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 104.271525][ T4747] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 104.290560][ C1] vcan0: j1939_tp_rxtimer: 0xffff888057179c00: rx timeout, send abort [ 104.332764][ T4747] ext4 filesystem being mounted at /22/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 104.364553][ T3730] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 104.364627][ T4735] loop2: p14 start 33554432 is beyond EOD, truncated [ 104.381620][ T4735] loop2: p15 start 262144 is beyond EOD, truncated [ 104.388350][ T4735] loop2: p16 start 33554432 is beyond EOD, truncated [ 104.408505][ T4747] EXT4-fs (loop4): re-mounted. Quota mode: none. [ 104.416229][ T4735] loop2: p17 start 262144 is beyond EOD, truncated [ 104.423250][ T3730] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 104.470615][ T4735] loop2: p18 start 33554432 is beyond EOD, truncated [ 104.479527][ T3730] usb 4-1: Product: syz [ 104.489716][ T3730] usb 4-1: Manufacturer: syz [ 104.503161][ T4747] EXT4-fs (loop4): unmounting filesystem. [ 104.561415][ T4735] loop2: p19 start 262144 is beyond EOD, truncated [ 104.589376][ T4735] loop2: p20 start 33554432 is beyond EOD, truncated [ 104.591226][ T3730] cdc_wdm 4-1:1.0: skipping garbage [ 104.639035][ T4735] loop2: p21 start 262144 is beyond EOD, truncated [ 104.655073][ T3730] cdc_wdm 4-1:1.0: skipping garbage [ 104.668557][ T4735] loop2: p22 start 33554432 is beyond EOD, truncated [ 104.729385][ T4735] loop2: p23 start 262144 is beyond EOD, truncated [ 104.731923][ T3730] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 104.735959][ T4735] loop2: p24 start 33554432 is beyond EOD, [ 104.782964][ T3730] cdc_wdm 4-1:1.0: Unknown control protocol [ 104.800003][ C1] vcan0: j1939_tp_rxtimer: 0xffff888057179c00: abort rx timeout. Force session deactivation [ 104.817503][ T4735] truncated [ 104.838252][ T4735] loop2: p25 start 262144 is beyond EOD, truncated [ 104.875887][ T4735] loop2: p26 start 33554432 is beyond EOD, truncated [ 104.904878][ T3730] usb 4-1: USB disconnect, device number 2 [ 104.907431][ T4735] loop2: p27 start 262144 is beyond EOD, truncated [ 104.958317][ T4735] loop2: p28 start 33554432 is beyond EOD, truncated [ 104.985659][ T4735] loop2: p29 start 262144 is beyond EOD, truncated [ 105.018624][ T4735] loop2: p30 start 33554432 is beyond EOD, truncated [ 105.041077][ T4735] loop2: p31 start 262144 is beyond EOD, truncated [ 105.069341][ T4735] loop2: p32 start 33554432 is beyond EOD, truncated [ 105.077861][ T4735] loop2: p33 start 262144 is beyond EOD, truncated [ 105.125884][ T4735] loop2: p34 start 33554432 is beyond EOD, truncated [ 105.149478][ T4735] loop2: p35 start 262144 is beyond EOD, truncated [ 105.158140][ T4770] netlink: 197348 bytes leftover after parsing attributes in process `syz.5.103'. [ 105.174431][ T4735] loop2: p36 start 33554432 is beyond EOD, truncated [ 105.193977][ T4735] loop2: p37 start 262144 is beyond EOD, truncated [ 105.206076][ T4772] bond0: (slave ip6tnl1): refused to change device type [ 105.232013][ T4735] loop2: p38 start 33554432 is beyond EOD, truncated [ 105.249373][ T4735] loop2: p39 start 262144 is beyond EOD, truncated [ 105.276876][ T4735] loop2: p40 start 33554432 is beyond EOD, truncated [ 105.319334][ T4735] loop2: p41 start 262144 is beyond EOD, truncated [ 105.325926][ T4735] loop2: p42 start 33554432 is beyond EOD, truncated [ 105.365435][ T4735] loop2: p43 start 262144 is beyond EOD, truncated [ 105.399350][ T4735] loop2: p44 start 33554432 is beyond EOD, truncated [ 105.406123][ T4735] loop2: p45 start 262144 is beyond EOD, truncated [ 105.442610][ T4735] loop2: p46 start 33554432 is beyond EOD, truncated [ 105.478093][ T4735] loop2: p47 start 262144 is beyond EOD, truncated [ 105.498809][ T4783] netlink: 20 bytes leftover after parsing attributes in process `syz.0.107'. [ 105.515580][ T4735] loop2: p48 start 33554432 is beyond EOD, truncated [ 105.534711][ T4735] loop2: p49 start 262144 is beyond EOD, truncated [ 105.557913][ T4783] netlink: 48 bytes leftover after parsing attributes in process `syz.0.107'. [ 105.567086][ T4735] loop2: p50 start 33554432 is beyond EOD, truncated [ 105.593940][ T4735] loop2: p51 start 262144 is beyond EOD, truncated [ 105.616192][ T4788] netlink: 20 bytes leftover after parsing attributes in process `syz.0.107'. [ 105.626923][ T4735] loop2: p52 start 33554432 is beyond EOD, truncated [ 105.636096][ T4735] loop2: p53 start 262144 is beyond EOD, truncated [ 105.654047][ T4783] netlink: 4 bytes leftover after parsing attributes in process `syz.0.107'. [ 105.669401][ T4735] loop2: p54 start 33554432 is beyond EOD, truncated [ 105.676156][ T4735] loop2: p55 start 262144 is beyond EOD, truncated [ 105.696324][ T4783] netlink: 20 bytes leftover after parsing attributes in process `syz.0.107'. [ 105.709340][ T4735] loop2: p56 start 33554432 is beyond EOD, truncated [ 105.726217][ T4735] loop2: p57 start 262144 is beyond EOD, truncated [ 105.737156][ T4735] loop2: p58 start 33554432 is beyond EOD, truncated [ 105.790292][ T4735] loop2: p59 start 262144 is beyond EOD, truncated [ 105.811435][ T4735] loop2: p60 start 33554432 is beyond EOD, truncated [ 105.852366][ T4735] loop2: p61 start 262144 is beyond EOD, truncated [ 105.876106][ T4735] loop2: p62 start 33554432 is beyond EOD, truncated [ 105.909677][ T4735] loop2: p63 start 262144 is beyond EOD, truncated [ 105.916268][ T4735] loop2: p64 start 33554432 is beyond EOD, truncated [ 105.949506][ T4735] loop2: p65 start 262144 is beyond EOD, truncated [ 105.969489][ T4735] loop2: p66 start 33554432 is beyond EOD, truncated [ 105.990286][ T4735] loop2: p67 start 262144 is beyond EOD, truncated [ 106.030075][ T4735] loop2: p68 start 33554432 is beyond EOD, truncated [ 106.129551][ T4735] loop2: p69 start 262144 is beyond EOD, truncated [ 106.265713][ T4735] loop2: p70 start 33554432 is beyond EOD, truncated [ 106.421020][ T4735] loop2: p71 start 262144 is beyond EOD, truncated [ 106.526592][ T4735] loop2: p72 start 33554432 is beyond EOD, truncated [ 106.646815][ T4735] loop2: p73 start 262144 is beyond EOD, truncated [ 106.754020][ T4735] loop2: p74 start 33554432 is beyond EOD, truncated [ 106.862793][ T4735] loop2: p75 start 262144 is beyond EOD, truncated [ 106.967606][ T4735] loop2: p76 start 33554432 is beyond EOD, truncated [ 107.055590][ T4735] loop2: p77 start 262144 is beyond EOD, truncated [ 107.070222][ T4735] loop2: p78 start 33554432 is beyond EOD, truncated [ 107.079652][ T4735] loop2: p79 start 262144 is beyond EOD, truncated [ 107.104433][ T4735] loop2: p80 start 33554432 is beyond EOD, truncated [ 107.159330][ T4735] loop2: p81 start 262144 is beyond EOD, truncated [ 107.185170][ T4735] loop2: p82 start 33554432 is beyond EOD, truncated [ 107.206764][ T4735] loop2: p83 start 262144 is beyond EOD, truncated [ 107.235800][ T4735] loop2: p84 start 33554432 is beyond EOD, truncated [ 107.263485][ T4735] loop2: p85 start 262144 is beyond EOD, truncated [ 107.283705][ T4735] loop2: p86 start 33554432 is beyond EOD, truncated [ 107.306433][ T4735] loop2: p87 start 262144 is beyond EOD, truncated [ 107.332497][ T4735] loop2: p88 start 33554432 is beyond EOD, truncated [ 107.362104][ T4735] loop2: p89 start 262144 is beyond EOD, truncated [ 107.391718][ T4735] loop2: p90 start 33554432 is beyond EOD, truncated [ 107.414315][ T4735] loop2: p91 start 262144 is beyond EOD, truncated [ 107.439589][ T4735] loop2: p92 start 33554432 is beyond EOD, truncated [ 107.446364][ T4735] loop2: p93 start 262144 is beyond EOD, truncated [ 107.524755][ T4735] loop2: p94 start 33554432 is beyond EOD, truncated [ 107.572437][ T4735] loop2: p95 start 262144 is beyond EOD, truncated [ 107.607876][ T4735] loop2: p96 start 33554432 is beyond EOD, truncated [ 107.639648][ T4735] loop2: p97 start 262144 is beyond EOD, truncated [ 107.646326][ T4735] loop2: p98 start 33554432 is beyond EOD, truncated [ 107.679650][ T4735] loop2: p99 start 262144 is beyond EOD, truncated [ 107.703313][ T4735] loop2: p100 start 33554432 is beyond EOD, truncated [ 107.729005][ T4735] loop2: p101 start 262144 is beyond EOD, truncated [ 107.774807][ T4735] loop2: p102 start 33554432 is beyond EOD, truncated [ 107.795281][ T4735] loop2: p103 start 262144 is beyond EOD, truncated [ 107.803778][ T4836] loop5: detected capacity change from 0 to 7 [ 107.815616][ T4735] loop2: p104 start 33554432 is beyond EOD, truncated [ 107.832345][ T4735] loop2: p105 start 262144 is beyond EOD, truncated [ 107.841015][ T4735] loop2: p106 start 33554432 is beyond EOD, truncated [ 107.848342][ T4735] loop2: p107 start 262144 is beyond EOD, truncated [ 107.855228][ T4735] loop2: p108 start 33554432 is beyond EOD, truncated [ 107.874289][ T4836] loop5: [ 107.877294][ T4836] loop5: partition table partially beyond EOD, truncated [ 107.894678][ T4735] loop2: p109 start 262144 is beyond EOD, truncated [ 107.912887][ T4735] loop2: p110 start 33554432 is beyond EOD, truncated [ 107.949752][ T4735] loop2: p111 start 262144 is beyond EOD, truncated [ 107.994415][ T4735] loop2: p112 start 33554432 is beyond EOD, truncated [ 108.009830][ T4735] loop2: p113 start 262144 is beyond EOD, truncated [ 108.026027][ T4735] loop2: p114 start 33554432 is beyond EOD, truncated [ 108.040485][ T4735] loop2: p115 start 262144 is beyond EOD, truncated [ 108.047275][ T4735] loop2: p116 start 33554432 is beyond EOD, truncated [ 108.063853][ T4735] loop2: p117 start 262144 is beyond EOD, truncated [ 108.078699][ T4735] loop2: p118 start 33554432 is beyond EOD, truncated [ 108.093482][ T4735] loop2: p119 start 262144 is beyond EOD, truncated [ 108.101424][ T4735] loop2: p120 start 33554432 is beyond EOD, truncated [ 108.108324][ T4735] loop2: p121 start 262144 is beyond EOD, truncated [ 108.120975][ T4735] loop2: p122 start 33554432 is beyond EOD, truncated [ 108.127918][ T4735] loop2: p123 start 262144 is beyond EOD, truncated [ 108.154720][ T4735] loop2: p124 start 33554432 is beyond EOD, truncated [ 108.178377][ T4735] loop2: p125 start 262144 is beyond EOD, truncated [ 108.194353][ T4845] Set syz1 is full, maxelem 2 reached [ 108.202069][ T4735] loop2: p126 start 33554432 is beyond EOD, truncated [ 108.216918][ T4735] loop2: p127 start 262144 is beyond EOD, truncated [ 108.237115][ T4735] loop2: p128 start 33554432 is beyond EOD, truncated [ 108.259048][ T4735] loop2: p129 start 262144 is beyond EOD, truncated [ 108.279374][ T4357] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 108.283324][ T4735] loop2: p130 start 33554432 is beyond EOD, truncated [ 108.329409][ T4735] loop2: p131 start 262144 is beyond EOD, truncated [ 108.354923][ T4735] loop2: p132 start 33554432 is beyond EOD, truncated [ 108.371901][ T4735] loop2: p133 start 262144 is beyond EOD, truncated [ 108.378583][ T4735] loop2: p134 start 33554432 is beyond EOD, truncated [ 108.414625][ T4735] loop2: p135 start 262144 is beyond EOD, truncated [ 108.433833][ T4735] loop2: p136 start 33554432 is beyond EOD, truncated [ 108.442585][ T4735] loop2: p137 start 262144 is beyond EOD, truncated [ 108.465747][ T4735] loop2: p138 start 33554432 is beyond EOD, truncated [ 108.478384][ T4735] loop2: p139 start 262144 is beyond EOD, truncated [ 108.486528][ T4735] loop2: p140 start 33554432 is beyond EOD, truncated [ 108.490395][ T4357] usb 4-1: Using ep0 maxpacket: 16 [ 108.504650][ T4357] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 108.530823][ T4357] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 108.535369][ T4735] loop2: p141 start 262144 is beyond EOD, truncated [ 108.554859][ T4357] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 108.576260][ T4735] loop2: p142 start 33554432 is beyond EOD, truncated [ 108.595237][ T4357] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.603538][ T4735] loop2: p143 start 262144 is beyond EOD, truncated [ 108.622359][ T4735] loop2: p144 start 33554432 is beyond EOD, truncated [ 108.639865][ T4735] loop2: p145 start 262144 is beyond EOD, truncated [ 108.641948][ T4357] usb 4-1: Product: syz [ 108.646511][ T4735] loop2: p146 start 33554432 is beyond EOD, truncated [ 108.646534][ T4735] loop2: p147 start 262144 is beyond EOD, truncated [ 108.646553][ T4735] loop2: p148 start 33554432 is beyond EOD, truncated [ 108.646573][ T4735] loop2: p149 start 262144 is beyond EOD, [ 108.681007][ T4357] usb 4-1: Manufacturer: syz [ 108.702885][ T4357] usb 4-1: SerialNumber: syz [ 108.718155][ T4735] truncated [ 108.724666][ T4735] loop2: p150 start 33554432 is beyond EOD, truncated [ 108.744913][ T4735] loop2: p151 start 262144 is beyond EOD, truncated [ 108.766677][ T4735] loop2: p152 start 33554432 is beyond EOD, truncated [ 108.773727][ T4735] loop2: p153 start 262144 is beyond EOD, truncated [ 108.781979][ T4735] loop2: p154 start 33554432 is beyond EOD, truncated [ 108.788963][ T4735] loop2: p155 start 262144 is beyond EOD, truncated [ 108.795695][ T4735] loop2: p156 start 33554432 is beyond EOD, truncated [ 108.802656][ T4735] loop2: p157 start 262144 is beyond EOD, truncated [ 108.809408][ T4735] loop2: p158 start 33554432 is beyond EOD, truncated [ 108.816342][ T4735] loop2: p159 start 262144 is beyond EOD, truncated [ 108.823255][ T4735] loop2: p160 start 33554432 is beyond EOD, truncated [ 108.830274][ T4735] loop2: p161 start 262144 is beyond EOD, truncated [ 108.836992][ T4735] loop2: p162 start 33554432 is beyond EOD, truncated [ 108.843955][ T4735] loop2: p163 start 262144 is beyond EOD, truncated [ 108.850734][ T4735] loop2: p164 start 33554432 is beyond EOD, truncated [ 108.857678][ T4735] loop2: p165 start 262144 is beyond EOD, truncated [ 108.860122][ T4321] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 108.866427][ T4735] loop2: p166 start 33554432 is beyond EOD, truncated [ 108.879524][ T4735] loop2: p167 start 262144 is beyond EOD, truncated [ 108.890954][ T4735] loop2: p168 start 33554432 is beyond EOD, truncated [ 108.898280][ T4735] loop2: p169 start 262144 is beyond EOD, truncated [ 108.908874][ T4735] loop2: p170 start 33554432 is beyond EOD, truncated [ 108.916587][ T4735] loop2: p171 start 262144 is beyond EOD, truncated [ 108.923575][ T4735] loop2: p172 start 33554432 is beyond EOD, truncated [ 108.930941][ T4735] loop2: p173 start 262144 is beyond EOD, truncated [ 108.947922][ T4735] loop2: p174 start 33554432 is beyond EOD, truncated [ 108.955483][ T4357] usb 4-1: 0:2 : does not exist [ 108.971337][ T4357] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 109.020888][ T4357] usb 4-1: USB disconnect, device number 3 [ 109.026983][ T4735] loop2: p175 start 262144 is beyond EOD, truncated [ 109.038853][ T4735] loop2: p176 start 33554432 is beyond EOD, truncated [ 109.046316][ T4735] loop2: p177 start 262144 is beyond EOD, truncated [ 109.070099][ T4735] loop2: p178 start 33554432 is beyond EOD, truncated [ 109.082024][ T4321] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.084404][ T4735] loop2: p179 start 262144 is beyond EOD, truncated [ 109.136083][ T4735] loop2: p180 start 33554432 is beyond EOD, truncated [ 109.136226][ T4321] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 109.159364][ T4735] loop2: p181 start 262144 is beyond EOD, truncated [ 109.179041][ T4868] netlink: 'syz.4.129': attribute type 4 has an invalid length. [ 109.187214][ T4735] loop2: p182 start 33554432 is beyond EOD, truncated [ 109.197139][ T4735] loop2: p183 start 262144 is beyond EOD, truncated [ 109.208627][ T4321] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 109.217583][ T4735] loop2: p184 start 33554432 is beyond EOD, truncated [ 109.244641][ T4321] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 109.257976][ T4870] netlink: 'syz.4.129': attribute type 4 has an invalid length. [ 109.268432][ T4321] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.272042][ T4735] loop2: p185 start 262144 is beyond EOD, truncated [ 109.296391][ T4872] loop5: detected capacity change from 0 to 256 [ 109.308815][ T4735] loop2: p186 start 33554432 is beyond EOD, truncated [ 109.317281][ T4735] loop2: p187 start 262144 is beyond EOD, truncated [ 109.327206][ T4321] usb 1-1: config 0 descriptor?? [ 109.341503][ T4857] udevd[4857]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 109.370067][ T4735] loop2: p188 start 33554432 is beyond EOD, truncated [ 109.391017][ T4735] loop2: p189 start 262144 is beyond EOD, truncated [ 109.406813][ T4735] loop2: p190 start 33554432 is beyond EOD, truncated [ 109.444256][ T4735] loop2: p191 start 262144 is beyond EOD, truncated [ 109.475870][ T4735] loop2: p192 start 33554432 is beyond EOD, truncated [ 109.483188][ T4735] loop2: p193 start 262144 is beyond EOD, truncated [ 109.490267][ T4735] loop2: p194 start 33554432 is beyond EOD, truncated [ 109.497165][ T4735] loop2: p195 start 262144 is beyond EOD, truncated [ 109.511799][ T4875] TCP: tcp_parse_options: Illegal window scaling value 254 > 14 received [ 109.531742][ T4735] loop2: p196 start 33554432 is beyond EOD, truncated [ 109.538592][ T4735] loop2: p197 start 262144 is beyond EOD, truncated [ 109.564754][ T4735] loop2: p198 start 33554432 is beyond EOD, truncated [ 109.587779][ T4735] loop2: p199 start 262144 is beyond EOD, truncated [ 109.615820][ T4735] loop2: p200 start 33554432 is beyond EOD, truncated [ 109.636994][ T4735] loop2: p201 start 262144 is beyond EOD, truncated [ 109.654960][ T4735] loop2: p202 start 33554432 is beyond EOD, truncated [ 109.676897][ T4735] loop2: p203 start 262144 is beyond EOD, truncated [ 109.702341][ T4735] loop2: p204 start 33554432 is beyond EOD, truncated [ 109.709779][ T4735] loop2: p205 start 262144 is beyond EOD, truncated [ 109.716642][ T4735] loop2: p206 start 33554432 is beyond EOD, truncated [ 109.731871][ T4735] loop2: p207 start 262144 is beyond EOD, truncated [ 109.738813][ T4735] loop2: p208 start 33554432 is beyond EOD, truncated [ 109.762397][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 109.765208][ T4735] loop2: p209 start 262144 is beyond EOD, truncated [ 109.778344][ T4735] loop2: p210 start 33554432 is beyond EOD, truncated [ 109.793253][ T4735] loop2: p211 start 262144 is beyond EOD, truncated [ 109.803170][ T4735] loop2: p212 start 33554432 is beyond EOD, truncated [ 109.803245][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 109.818603][ T4735] loop2: p213 start 262144 is beyond EOD, truncated [ 109.834928][ T4735] loop2: p214 start 33554432 is beyond EOD, truncated [ 109.844365][ T4735] loop2: p215 start 262144 is beyond EOD, truncated [ 109.855571][ T4735] loop2: p216 start 33554432 is beyond EOD, truncated [ 109.864880][ T4735] loop2: p217 start 262144 is beyond EOD, truncated [ 109.874079][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 109.880863][ T4735] loop2: p218 start 33554432 is beyond EOD, truncated [ 109.884383][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 109.906067][ T4735] loop2: p219 start 262144 is beyond EOD, truncated [ 109.916189][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 109.928589][ T4735] loop2: p220 start 33554432 is beyond EOD, truncated [ 109.932424][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 109.953232][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 109.953767][ T4735] loop2: p221 start 262144 is beyond EOD, [ 109.973490][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 109.973869][ T4735] truncated [ 109.997709][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 109.998266][ T4735] loop2: p222 start 33554432 is beyond EOD, truncated [ 110.018474][ T4735] loop2: p223 start 262144 is beyond EOD, truncated [ 110.025338][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 110.030258][ T4735] loop2: p224 start 33554432 is beyond EOD, truncated [ 110.048668][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 110.051398][ T4735] loop2: p225 start 262144 is beyond EOD, [ 110.063883][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 110.072659][ T4735] truncated [ 110.085666][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 110.093953][ T4735] loop2: p226 start 33554432 is beyond EOD, truncated [ 110.103726][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 110.109585][ T4735] loop2: p227 start 262144 is beyond EOD, truncated [ 110.119664][ T4321] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 110.136174][ T4735] loop2: p228 start 33554432 is beyond EOD, truncated [ 110.143476][ T4321] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 110.181791][ T4735] loop2: p229 start 262144 is beyond EOD, truncated [ 110.195079][ T4321] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 110.198529][ T4735] loop2: p230 start 33554432 is beyond EOD, truncated [ 110.229037][ T4735] loop2: p231 start 262144 is beyond EOD, truncated [ 110.289419][ T4735] loop2: p232 start 33554432 is beyond EOD, truncated [ 110.298370][ T4735] loop2: p233 start 262144 is beyond EOD, truncated [ 110.328878][ T4735] loop2: p234 start 33554432 is beyond EOD, truncated [ 110.358607][ T4735] loop2: p235 start 262144 is beyond EOD, truncated [ 110.381078][ T4735] loop2: p236 start 33554432 is beyond EOD, truncated [ 110.397549][ T4735] loop2: p237 start 262144 is beyond EOD, truncated [ 110.412844][ T4735] loop2: p238 start 33554432 is beyond EOD, truncated [ 110.426456][ T4735] loop2: p239 start 262144 is beyond EOD, truncated [ 110.438619][ T4735] loop2: p240 start 33554432 is beyond EOD, truncated [ 110.445803][ T4735] loop2: p241 start 262144 is beyond EOD, truncated [ 110.452710][ T4735] loop2: p242 start 33554432 is beyond EOD, truncated [ 110.462542][ T4735] loop2: p243 start 262144 is beyond EOD, truncated [ 110.479055][ T4735] loop2: p244 start 33554432 is beyond EOD, truncated [ 110.486218][ T4735] loop2: p245 start 262144 is beyond EOD, truncated [ 110.526810][ T4735] loop2: p246 start 33554432 is beyond EOD, truncated [ 110.533830][ T4735] loop2: p247 start 262144 is beyond EOD, truncated [ 110.545736][ T4735] loop2: p248 start 33554432 is beyond EOD, truncated [ 110.571105][ T4735] loop2: p249 start 262144 is beyond EOD, truncated [ 110.594691][ T4735] loop2: p250 start 33554432 is beyond EOD, truncated [ 110.611013][ T4735] loop2: p251 start 262144 is beyond EOD, truncated [ 110.625606][ T4735] loop2: p252 start 33554432 is beyond EOD, truncated [ 110.649701][ T4735] loop2: p253 start 262144 is beyond EOD, truncated [ 110.667881][ T4735] loop2: p254 start 33554432 is beyond EOD, truncated [ 110.709741][ T4735] loop2: p255 start 262144 is beyond EOD, truncated [ 111.044318][ T4906] netlink: 12 bytes leftover after parsing attributes in process `syz.4.140'. [ 111.348730][ T4921] loop2: detected capacity change from 0 to 512 [ 111.398664][ T4921] FAT-fs (loop2): bogus logical sector size 0 [ 111.424588][ T4921] FAT-fs (loop2): Can't find a valid FAT filesystem [ 111.986925][ T4945] netlink: 7 bytes leftover after parsing attributes in process `syz.3.146'. [ 112.639109][ T4336] usb 1-1: USB disconnect, device number 2 [ 113.302620][ T4984] 9pnet_fd: p9_fd_create_tcp (4984): problem connecting socket to 127.0.0.1 [ 113.335473][ T4984] 9pnet_fd: p9_fd_create_tcp (4984): problem connecting socket to 127.0.0.1 [ 114.229454][ T26] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 114.383413][ T5025] TCP: request_sock_subflow_v4: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 114.436434][ T26] usb 1-1: not running at top speed; connect to a high speed hub [ 114.454509][ T26] usb 1-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 114.479411][ T26] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 64 [ 114.497797][ T26] usb 1-1: config 1 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 6 [ 114.516182][ T26] usb 1-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 114.525795][ T26] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.566643][ T5015] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 114.584602][ T5017] syz.3.166 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=1, oom_score_adj=1000 [ 114.586890][ T26] keyspan 1-1:1.0: Keyspan 2 port adapter converter detected [ 114.616007][ T26] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 114.635916][ T26] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 88 [ 114.642450][ T5017] CPU: 0 PID: 5017 Comm: syz.3.166 Not tainted syzkaller #0 [ 114.650920][ T5017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 114.661030][ T5017] Call Trace: [ 114.664341][ T5017] [ 114.667307][ T5017] dump_stack_lvl+0x188/0x24e [ 114.672065][ T5017] ? show_regs_print_info+0x12/0x12 [ 114.674078][ T26] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 6 [ 114.677303][ T5017] ? load_image+0x410/0x410 [ 114.689455][ T5017] dump_header+0xd8/0x820 [ 114.693850][ T5017] out_of_memory+0xe9a/0x1220 [ 114.698581][ T5017] ? mutex_lock_nested+0x10/0x10 [ 114.703576][ T5017] ? unregister_oom_notifier+0x20/0x20 [ 114.709096][ T5017] mem_cgroup_out_of_memory+0x2c0/0x390 [ 114.714700][ T5017] ? mem_cgroup_oom_trylock+0x210/0x210 [ 114.720315][ T5017] ? do_raw_spin_unlock+0x11d/0x230 [ 114.725596][ T5017] try_charge_memcg+0xc9d/0x17c0 [ 114.730620][ T5017] ? percpu_ref_put+0x180/0x180 [ 114.735541][ T5017] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 114.741317][ T5017] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 114.747356][ T5017] ? percpu_ref_tryget+0x15/0x180 [ 114.752440][ T5017] ? percpu_ref_tryget+0x15/0x180 [ 114.757540][ T5017] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 114.763311][ T5017] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 114.769086][ T5017] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 114.774968][ T5017] obj_cgroup_charge+0x36a/0x620 [ 114.779964][ T5017] ? obj_cgroup_charge+0xe9/0x620 [ 114.785038][ T5017] ? mod_objcg_mlstate+0x320/0x320 [ 114.790204][ T5017] ? percpu_ref_tryget+0x15/0x180 [ 114.795284][ T5017] ? get_obj_cgroup_from_current+0xd0/0x280 [ 114.801230][ T5017] ? get_obj_cgroup_from_current+0xd0/0x280 [ 114.807175][ T5017] ? __bitmap_weight+0xa8/0xf0 [ 114.811991][ T5017] pcpu_alloc+0x21c/0x16b0 [ 114.816475][ T5017] mem_cgroup_css_alloc+0x255/0x13b0 [ 114.821817][ T5017] cgroup_apply_control_enable+0x3cc/0xb00 [ 114.827687][ T5017] cgroup_mkdir+0xc7f/0xe70 [ 114.832252][ T5017] ? css_task_iter_end+0x280/0x280 [ 114.837433][ T5017] ? kernfs_iop_permission+0x26d/0x350 [ 114.842946][ T5017] ? css_task_iter_end+0x280/0x280 [ 114.848104][ T5017] kernfs_iop_mkdir+0x23d/0x3d0 [ 114.853014][ T5017] vfs_mkdir+0x386/0x570 [ 114.857315][ T5017] do_mkdirat+0x1d8/0x440 [ 114.861698][ T5017] ? vfs_mkdir+0x570/0x570 [ 114.866169][ T5017] __x64_sys_mkdirat+0x85/0x90 [ 114.870980][ T5017] do_syscall_64+0x4c/0xa0 [ 114.875447][ T5017] ? clear_bhb_loop+0x60/0xb0 [ 114.880171][ T5017] ? clear_bhb_loop+0x60/0xb0 [ 114.884894][ T5017] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 114.890836][ T5017] RIP: 0033:0x7fc046d9e199 [ 114.895318][ T5017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.914976][ T5017] RSP: 002b:00007fc047c28028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 114.923484][ T5017] RAX: ffffffffffffffda RBX: 00007fc047025fa0 RCX: 00007fc046d9e199 [ 114.931499][ T5017] RDX: 0000000000000020 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 114.939597][ T5017] RBP: 00007fc046e358e0 R08: 0000000000000000 R09: 0000000000000000 [ 114.947599][ T5017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.955605][ T5017] R13: 00007fc047026038 R14: 00007fc047025fa0 R15: 00007ffc8d2a1fd8 [ 114.963633][ T5017] [ 114.995923][ T5032] process 'syz.4.171' launched './file1' with NULL argv: empty string added [ 115.010291][ T26] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 115.079334][ T5017] memory: usage 0kB, limit 0kB, failcnt 19 [ 115.108064][ T5017] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 115.169629][ T5017] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 115.176591][ T5017] Memory cgroup stats for /syz3/test: [ 115.177333][ T5017] anon 0 [ 115.177333][ T5017] file 0 [ 115.177333][ T5017] kernel 0 [ 115.177333][ T5017] kernel_stack 0 [ 115.177333][ T5017] pagetables 0 [ 115.177333][ T5017] sec_pagetables 0 [ 115.177333][ T5017] percpu 0 [ 115.177333][ T5017] sock 0 [ 115.177333][ T5017] vmalloc 0 [ 115.177333][ T5017] shmem 0 [ 115.177333][ T5017] zswap 0 [ 115.177333][ T5017] zswapped 0 [ 115.177333][ T5017] file_mapped 0 [ 115.177333][ T5017] file_dirty 0 [ 115.177333][ T5017] file_writeback 0 [ 115.177333][ T5017] swapcached 0 [ 115.177333][ T5017] anon_thp 0 [ 115.177333][ T5017] file_thp 0 [ 115.177333][ T5017] shmem_thp 0 [ 115.177333][ T5017] inactive_anon 0 [ 115.177333][ T5017] active_anon 0 [ 115.177333][ T5017] inactive_file 0 [ 115.177333][ T5017] active_file 0 [ 115.177333][ T5017] unevictable 0 [ 115.177333][ T5017] slab_reclaimable 0 [ 115.177333][ T5017] slab_unreclaimable 0 [ 115.177333][ T5017] slab 0 [ 115.177333][ T5017] workingset_refault_anon 0 [ 115.468797][ T955] usb 1-1: USB disconnect, device number 3 [ 115.532400][ T955] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 115.568537][ T5017] Out of memory and no killable processes... [ 115.593642][ T955] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 115.626376][ T955] keyspan 1-1:1.0: device disconnected [ 115.811952][ T5054] capability: warning: `syz.2.175' uses deprecated v2 capabilities in a way that may be insecure [ 115.987502][ T5061] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.995051][ T5061] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.067416][ T5063] netlink: 2028 bytes leftover after parsing attributes in process `syz.4.177'. [ 116.087672][ T5063] netlink: 24 bytes leftover after parsing attributes in process `syz.4.177'. [ 116.137602][ T5067] device vlan3 left promiscuous mode [ 116.158705][ T5067] bridge0: port 3(vlan3) entered disabled state [ 116.197271][ T5067] device bridge_slave_1 left promiscuous mode [ 116.213753][ T5067] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.228684][ T5067] device bridge_slave_0 left promiscuous mode [ 116.243539][ T5067] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.246286][ T5111] fuse: Bad value for 'fd' [ 117.517332][ T5124] netlink: 8 bytes leftover after parsing attributes in process `syz.5.193'. [ 117.696821][ T5129] netlink: 24 bytes leftover after parsing attributes in process `syz.4.196'. [ 117.939886][ T22] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 118.038351][ T27] audit: type=1326 audit(1791377767.369:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5135 comm="syz.0.198" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7fc00000 [ 118.139476][ T22] usb 4-1: Using ep0 maxpacket: 16 [ 118.158678][ T22] usb 4-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 118.198557][ T22] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.222202][ T22] usb 4-1: config 0 descriptor?? [ 118.251215][ T22] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 118.858440][ T27] audit: type=1326 audit(1791377768.189:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5135 comm="syz.0.198" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fdebc797f17 code=0x7fc00000 [ 118.883521][ T5155] netlink: 4 bytes leftover after parsing attributes in process `syz.5.203'. [ 118.919928][ T27] audit: type=1326 audit(1791377768.189:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5135 comm="syz.0.198" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fdebc73f519 code=0x7fc00000 [ 118.967759][ T5155] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 118.977142][ T5155] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 118.986024][ T5155] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 118.994836][ T5155] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 119.004921][ T27] audit: type=1326 audit(1791377768.189:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5135 comm="syz.0.198" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7fdebc73f5dd code=0x7fc00000 [ 119.044911][ T27] audit: type=1326 audit(1791377768.189:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5135 comm="syz.0.198" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fdebc79e199 code=0x7fc00000 [ 119.095577][ T5155] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.105391][ T5155] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.114624][ T5155] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.123592][ T5155] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.138811][ T27] audit: type=1326 audit(1791377768.469:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5157 comm="syz.0.204" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 119.176287][ T27] audit: type=1326 audit(1791377768.489:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5157 comm="syz.0.204" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 119.215719][ T27] audit: type=1326 audit(1791377768.499:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5157 comm="syz.0.204" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 119.299653][ T27] audit: type=1326 audit(1791377768.499:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5157 comm="syz.0.204" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 119.349360][ T27] audit: type=1326 audit(1791377768.539:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5157 comm="syz.0.204" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 119.375492][ T5155] netlink: 4 bytes leftover after parsing attributes in process `syz.5.203'. [ 119.404878][ T5155] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 119.414559][ T5155] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 119.423664][ T5155] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 119.432437][ T5155] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 119.525248][ T5155] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.534303][ T5155] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.543624][ T5155] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.552591][ T5155] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.682197][ T5155] Zero length message leads to an empty skb [ 119.891511][ T5177] netlink: 4 bytes leftover after parsing attributes in process `syz.5.211'. [ 119.906184][ T22] gspca_sonixj: i2c_w8 err -71 [ 119.915751][ T5177] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 119.925479][ T5177] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 119.934613][ T5177] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 119.943474][ T5177] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 119.959538][ T22] sonixj: probe of 4-1:0.0 failed with error -71 [ 119.968022][ T22] usb 4-1: USB disconnect, device number 4 [ 119.979784][ T5177] netlink: 4 bytes leftover after parsing attributes in process `syz.5.211'. [ 120.236939][ T5189] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 120.243897][ T5189] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.267151][ T5189] vhci_hcd vhci_hcd.0: Device attached [ 120.299529][ T5192] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(5) [ 120.306118][ T5192] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.355332][ T5192] vhci_hcd vhci_hcd.0: Device attached [ 120.387699][ T5189] vhci_hcd vhci_hcd.0: pdev(5) rhport(2) sockfd(8) [ 120.394287][ T5189] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.455235][ T5189] vhci_hcd vhci_hcd.0: Device attached [ 120.464850][ T5192] vhci_hcd vhci_hcd.0: pdev(5) rhport(3) sockfd(7) [ 120.471444][ T5192] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.499448][ T5192] vhci_hcd vhci_hcd.0: Device attached [ 120.532530][ T5189] vhci_hcd vhci_hcd.0: pdev(5) rhport(4) sockfd(10) [ 120.539197][ T5189] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.553077][ T26] usb 43-1: new high-speed USB device number 2 using vhci_hcd [ 120.566081][ T5203] netlink: 4 bytes leftover after parsing attributes in process `syz.3.216'. [ 120.581147][ T5189] vhci_hcd vhci_hcd.0: Device attached [ 120.627902][ T5192] vhci_hcd vhci_hcd.0: pdev(5) rhport(5) sockfd(12) [ 120.634583][ T5192] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.685990][ T5192] vhci_hcd vhci_hcd.0: Device attached [ 120.717209][ T5189] vhci_hcd vhci_hcd.0: pdev(5) rhport(6) sockfd(14) [ 120.723898][ T5189] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.752209][ T5192] vhci_hcd vhci_hcd.0: pdev(5) rhport(7) sockfd(18) [ 120.758904][ T5192] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.824815][ T5192] vhci_hcd vhci_hcd.0: Device attached [ 120.839931][ T5189] vhci_hcd vhci_hcd.0: Device attached [ 120.912953][ T5204] vhci_hcd: connection closed [ 120.913023][ T5200] vhci_hcd: connection closed [ 120.925052][ T11] vhci_hcd: stop threads [ 120.934410][ T5209] vhci_hcd: connection closed [ 120.942961][ T5198] vhci_hcd: connection closed [ 120.945239][ T5207] vhci_hcd: connection closed [ 120.952373][ T5190] vhci_hcd: connection reset by peer [ 120.959522][ T5193] vhci_hcd: connection closed [ 120.962833][ T5195] vhci_hcd: connection closed [ 120.989180][ T11] vhci_hcd: release socket [ 121.027712][ T11] vhci_hcd: disconnect device [ 121.056698][ T11] vhci_hcd: stop threads [ 121.075624][ T5216] loop0: detected capacity change from 0 to 512 [ 121.079373][ T11] vhci_hcd: release socket [ 121.086677][ T11] vhci_hcd: disconnect device [ 121.101778][ T11] vhci_hcd: stop threads [ 121.106109][ T11] vhci_hcd: release socket [ 121.147227][ T11] vhci_hcd: disconnect device [ 121.159682][ T11] vhci_hcd: stop threads [ 121.177392][ T11] vhci_hcd: release socket [ 121.195186][ T5216] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: inode #2: comm syz.0.219: missing EA_INODE flag [ 121.199524][ T11] vhci_hcd: disconnect device [ 121.239747][ T11] vhci_hcd: stop threads [ 121.244059][ T11] vhci_hcd: release socket [ 121.263255][ T5216] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.219: error while reading EA inode 2 err=-117 [ 121.286462][ T5216] EXT4-fs (loop0): 1 orphan inode deleted [ 121.304534][ T11] vhci_hcd: disconnect device [ 121.330077][ T5216] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 121.348735][ T11] vhci_hcd: stop threads [ 121.369382][ T11] vhci_hcd: release socket [ 121.388647][ T11] vhci_hcd: disconnect device [ 121.404796][ T11] vhci_hcd: stop threads [ 121.413722][ T11] vhci_hcd: release socket [ 121.424419][ T11] vhci_hcd: disconnect device [ 121.439675][ T11] vhci_hcd: stop threads [ 121.444035][ T11] vhci_hcd: release socket [ 121.464382][ T5227] overlayfs: failed to clone upperpath [ 121.469478][ T11] vhci_hcd: disconnect device [ 122.091983][ T4274] EXT4-fs (loop0): unmounting filesystem. [ 122.450763][ T5276] loop3: detected capacity change from 0 to 164 [ 123.486758][ T5300] netlink: 'syz.5.242': attribute type 10 has an invalid length. [ 123.563276][ T5300] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 123.620313][ T5301] netlink: 14 bytes leftover after parsing attributes in process `syz.5.242'. [ 123.796913][ T5301] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 123.838492][ T5301] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 123.894472][ T5301] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 123.926543][ T5301] bond0 (unregistering): Released all slaves [ 124.571682][ T5340] netlink: 4 bytes leftover after parsing attributes in process `syz.4.259'. [ 124.739366][ T4336] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 124.845783][ T5350] FAULT_INJECTION: forcing a failure. [ 124.845783][ T5350] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 124.909365][ T5350] CPU: 0 PID: 5350 Comm: syz.0.265 Not tainted syzkaller #0 [ 124.916742][ T5350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 124.926856][ T5350] Call Trace: [ 124.930178][ T5350] [ 124.933164][ T5350] dump_stack_lvl+0x188/0x24e [ 124.937894][ T5350] ? show_regs_print_info+0x12/0x12 [ 124.943150][ T5350] ? load_image+0x410/0x410 [ 124.947798][ T5350] ? __lock_acquire+0x7ea0/0x7ea0 [ 124.952878][ T5350] ? tomoyo_path_number_perm+0x5a4/0x650 [ 124.958600][ T5350] ? tomoyo_path_number_perm+0x205/0x650 [ 124.964277][ T5350] should_fail_ex+0x390/0x4c0 [ 124.968976][ T5350] _copy_from_user+0x2c/0x170 [ 124.973682][ T5350] video_usercopy+0x345/0x1450 [ 124.978506][ T5350] ? video_ioctl2+0x30/0x30 [ 124.983096][ T5350] ? v4l_printk_ioctl+0x130/0x130 [ 124.988201][ T5350] v4l2_ioctl+0x183/0x1d0 [ 124.992589][ T5350] ? v4l2_poll+0x2b0/0x2b0 [ 124.997067][ T5350] __se_sys_ioctl+0xfa/0x170 [ 125.001717][ T5350] do_syscall_64+0x4c/0xa0 [ 125.006202][ T5350] ? clear_bhb_loop+0x60/0xb0 [ 125.010948][ T5350] ? clear_bhb_loop+0x60/0xb0 [ 125.015682][ T5350] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 125.021622][ T5350] RIP: 0033:0x7fdebc79e199 [ 125.026071][ T5350] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.045722][ T5350] RSP: 002b:00007fdeba9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 125.054164][ T5350] RAX: ffffffffffffffda RBX: 00007fdebca25fa0 RCX: 00007fdebc79e199 [ 125.062161][ T5350] RDX: 0000200000000040 RSI: 00000000c0145608 RDI: 0000000000000004 [ 125.070155][ T5350] RBP: 00007fdebc8358e0 R08: 0000000000000000 R09: 0000000000000000 [ 125.078160][ T5350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.086156][ T5350] R13: 00007fdebca26038 R14: 00007fdebca25fa0 R15: 00007fff1084cf68 [ 125.094196][ T5350] [ 125.141230][ T4336] usb 6-1: Using ep0 maxpacket: 32 [ 125.148320][ T4336] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 125.169299][ T4336] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 125.189399][ T4336] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 125.198495][ T4336] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.217815][ T4336] usb 6-1: config 0 descriptor?? [ 125.233045][ T4336] hub 6-1:0.0: USB hub found [ 125.435991][ T4336] hub 6-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 125.669984][ T26] vhci_hcd: vhci_device speed not set [ 125.845256][ T4336] hid-generic 0003:046D:C31C.0002: unknown main item tag 0x0 [ 125.896067][ T4336] hid-generic 0003:046D:C31C.0002: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.5-1/input0 [ 126.497478][ T5338] usb 6-1: reset high-speed USB device number 2 using dummy_hcd [ 126.710169][ T5338] usb 6-1: device firmware changed [ 126.720501][ T4336] usb 6-1: USB disconnect, device number 2 [ 126.919562][ T4336] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 127.119480][ T4336] usb 6-1: Using ep0 maxpacket: 32 [ 127.128779][ T4336] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 127.153632][ T27] kauditd_printk_skb: 34 callbacks suppressed [ 127.153648][ T27] audit: type=1326 audit(1791377776.489:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 127.170626][ T4336] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 127.233911][ T4336] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.00 [ 127.247583][ T27] audit: type=1326 audit(1791377776.489:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 127.283990][ T4336] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.321753][ T4336] usb 6-1: config 0 descriptor?? [ 127.334439][ T4336] hub 6-1:0.0: USB hub found [ 127.340297][ T27] audit: type=1326 audit(1791377776.489:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 127.395317][ T27] audit: type=1326 audit(1791377776.529:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 127.450699][ T27] audit: type=1326 audit(1791377776.529:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 127.536272][ T4336] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 127.553540][ T27] audit: type=1326 audit(1791377776.539:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 127.585238][ T4336] usbhid 6-1:0.0: can't add hid device: -71 [ 127.601736][ T4336] usbhid: probe of 6-1:0.0 failed with error -71 [ 127.646003][ T27] audit: type=1326 audit(1791377776.539:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 127.680845][ T4336] usb 6-1: USB disconnect, device number 3 [ 127.731126][ T27] audit: type=1326 audit(1791377776.539:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 127.785172][ T27] audit: type=1326 audit(1791377776.539:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 127.853592][ T27] audit: type=1326 audit(1791377776.539:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5414 comm="syz.0.283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdebc79e199 code=0x7ffc0000 [ 128.450736][ T5442] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.458230][ T5442] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.513204][ T5442] device bridge_slave_1 left promiscuous mode [ 128.533112][ T5442] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.552912][ T5442] device bridge_slave_0 left promiscuous mode [ 128.559175][ T5442] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.422623][ T5496] overlayfs: failed to clone upperpath [ 129.443638][ T5496] overlayfs: failed to clone upperpath [ 129.952592][ T4357] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 130.172936][ T4357] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 130.204225][ T4357] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 130.242514][ T4357] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 130.280454][ T4357] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 130.316108][ T4357] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 130.349627][ T4357] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.378771][ T4357] usb 1-1: Product: syz [ 130.388905][ T4357] usb 1-1: Manufacturer: syz [ 130.399061][ T4357] usb 1-1: SerialNumber: syz [ 130.431211][ T4357] usb 1-1: config 0 descriptor?? [ 130.649447][ T4357] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 130.878402][ T955] usb 1-1: USB disconnect, device number 4 [ 132.623187][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.629991][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.706046][ T5578] FAULT_INJECTION: forcing a failure. [ 132.706046][ T5578] name failslab, interval 1, probability 0, space 0, times 0 [ 132.759442][ T5578] CPU: 1 PID: 5578 Comm: syz.0.321 Not tainted syzkaller #0 [ 132.766830][ T5578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 132.776927][ T5578] Call Trace: [ 132.780246][ T5578] [ 132.783216][ T5578] dump_stack_lvl+0x188/0x24e [ 132.787952][ T5578] ? show_regs_print_info+0x12/0x12 [ 132.793222][ T5578] ? load_image+0x410/0x410 [ 132.797789][ T5578] ? __lock_acquire+0x7ea0/0x7ea0 [ 132.802875][ T5578] should_fail_ex+0x390/0x4c0 [ 132.807609][ T5578] should_failslab+0x5/0x20 [ 132.812162][ T5578] slab_pre_alloc_hook+0x59/0x300 [ 132.817229][ T5578] ? rcu_is_watching+0x11/0xa0 [ 132.822048][ T5578] ? mempool_create+0x5a/0xc0 [ 132.826806][ T5578] __kmem_cache_alloc_node+0x4f/0x270 [ 132.832244][ T5578] ? mempool_create+0x7d/0xc0 [ 132.836973][ T5578] ? mempool_create+0x5a/0xc0 [ 132.841704][ T5578] ? ceph_msgpool_init+0x180/0x180 [ 132.846858][ T5578] kmalloc_node_trace+0x22/0xe0 [ 132.851755][ T5578] ? msgpool_alloc+0x1b0/0x1b0 [ 132.856555][ T5578] ? ceph_msgpool_init+0x180/0x180 [ 132.861724][ T5578] mempool_create+0x5a/0xc0 [ 132.866285][ T5578] ceph_msgpool_init+0xa3/0x180 [ 132.871188][ T5578] ceph_osdc_init+0x52c/0x8a0 [ 132.875924][ T5578] ceph_create_client+0x242/0x300 [ 132.881000][ T5578] ceph_get_tree+0x1c1/0x1350 [ 132.885729][ T5578] ? bpf_lsm_capable+0x5/0x10 [ 132.890461][ T5578] ? security_capable+0x85/0xb0 [ 132.895357][ T5578] vfs_get_tree+0x88/0x270 [ 132.899860][ T5578] vfs_fsconfig_locked+0x22f/0x400 [ 132.905050][ T5578] __se_sys_fsconfig+0x69e/0x7e0 [ 132.910052][ T5578] ? __x64_sys_fsconfig+0xc0/0xc0 [ 132.915133][ T5578] ? lockdep_hardirqs_on+0x94/0x140 [ 132.920382][ T5578] ? __x64_sys_fsconfig+0x1c/0xc0 [ 132.925501][ T5578] do_syscall_64+0x4c/0xa0 [ 132.929967][ T5578] ? clear_bhb_loop+0x60/0xb0 [ 132.934682][ T5578] ? clear_bhb_loop+0x60/0xb0 [ 132.939400][ T5578] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 132.945333][ T5578] RIP: 0033:0x7fdebc79e199 [ 132.949795][ T5578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.969537][ T5578] RSP: 002b:00007fdeba9f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 132.977986][ T5578] RAX: ffffffffffffffda RBX: 00007fdebca25fa0 RCX: 00007fdebc79e199 [ 132.986006][ T5578] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 132.994014][ T5578] RBP: 00007fdebc8358e0 R08: 0000000000000000 R09: 0000000000000000 [ 133.002029][ T5578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 133.010044][ T5578] R13: 00007fdebca26038 R14: 00007fdebca25fa0 R15: 00007fff1084cf68 [ 133.018111][ T5578] [ 133.242619][ T5593] netlink: 'syz.0.325': attribute type 15 has an invalid length. [ 133.274006][ T5593] netlink: 11594 bytes leftover after parsing attributes in process `syz.0.325'. [ 133.314739][ T5595] netlink: 'syz.0.325': attribute type 11 has an invalid length. [ 133.343981][ T5595] netlink: 'syz.0.325': attribute type 15 has an invalid length. [ 133.373275][ T5595] netlink: 'syz.0.325': attribute type 16 has an invalid length. [ 133.402759][ T5595] netlink: 'syz.0.325': attribute type 21 has an invalid length. [ 133.422469][ T5595] netlink: 'syz.0.325': attribute type 25 has an invalid length. [ 133.442179][ T5595] netlink: 'syz.0.325': attribute type 27 has an invalid length. [ 133.464917][ T5595] netlink: 'syz.0.325': attribute type 28 has an invalid length. [ 133.487340][ T5595] netlink: 'syz.0.325': attribute type 29 has an invalid length. [ 133.512312][ T5595] netlink: 'syz.0.325': attribute type 30 has an invalid length. [ 133.886473][ T5613] netlink: 24 bytes leftover after parsing attributes in process `syz.4.330'. [ 133.955402][ T5613] netlink: 12 bytes leftover after parsing attributes in process `syz.4.330'. [ 135.033535][ T5659] loop5: detected capacity change from 0 to 2048 [ 135.113539][ T5659] GPT:first_usable_lbas don't match. [ 135.129311][ T5659] GPT:34 != 290 [ 135.132840][ T5659] GPT: Use GNU Parted to correct GPT errors. [ 135.138958][ T5659] loop5: p1 p2 p3 [ 135.402133][ T5665] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 135.408773][ T5665] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 135.447955][ T5668] vhci_hcd: xmit failed -107 [ 135.458473][ T5665] vhci_hcd vhci_hcd.0: Device attached [ 135.476790][ T5651] vhci_hcd: stop threads [ 135.484903][ T5651] vhci_hcd: release socket [ 135.507438][ T5651] vhci_hcd: disconnect device [ 135.658766][ T5677] netlink: 24 bytes leftover after parsing attributes in process `syz.3.347'. [ 136.128859][ T5689] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 136.156323][ T5689] netlink: 14 bytes leftover after parsing attributes in process `syz.4.352'. [ 136.267616][ T5689] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 136.293599][ T5689] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 136.340461][ T5689] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 136.367047][ T5689] bond0 (unregistering): Released all slaves [ 136.449293][ T955] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 136.641243][ T955] usb 1-1: config 0 has an invalid interface number: 50 but max is 0 [ 136.654720][ T955] usb 1-1: config 0 has no interface number 0 [ 136.669295][ T955] usb 1-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 136.699963][ T955] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 136.729672][ T955] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.739606][ T955] usb 1-1: Product: syz [ 136.750667][ T955] usb 1-1: Manufacturer: syz [ 136.758708][ T955] usb 1-1: SerialNumber: syz [ 136.771433][ T955] usb 1-1: config 0 descriptor?? [ 136.802605][ T955] yurex 1-1:0.50: USB YUREX device now attached to Yurex #0 [ 136.941957][ T5710] 9pnet: p9_errstr2errno: server reported unknown error 0x00000000 [ 137.016034][ T5714] loop5: detected capacity change from 0 to 128 [ 137.043095][ T5714] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 137.059153][ T5714] ext4 filesystem being mounted at /55/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 137.193506][ T4421] EXT4-fs (loop5): unmounting filesystem. [ 137.214751][ T27] kauditd_printk_skb: 83 callbacks suppressed [ 137.214773][ T27] audit: type=1326 audit(1791377786.549:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5693 comm="syz.3.354" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc046d9e199 code=0x7fc00000 [ 137.313974][ T4336] usb 1-1: USB disconnect, device number 5 [ 137.450292][ T5722] FAULT_INJECTION: forcing a failure. [ 137.450292][ T5722] name failslab, interval 1, probability 0, space 0, times 0 [ 137.463461][ T5722] CPU: 1 PID: 5722 Comm: syz.5.361 Not tainted syzkaller #0 [ 137.470800][ T5722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 137.480896][ T5722] Call Trace: [ 137.484234][ T5722] [ 137.487198][ T5722] dump_stack_lvl+0x188/0x24e [ 137.491930][ T5722] ? show_regs_print_info+0x12/0x12 [ 137.497175][ T5722] ? load_image+0x410/0x410 [ 137.501753][ T5722] should_fail_ex+0x390/0x4c0 [ 137.506501][ T5722] should_failslab+0x5/0x20 [ 137.511056][ T5722] slab_pre_alloc_hook+0x59/0x300 [ 137.516125][ T5722] kmem_cache_alloc+0x56/0x2f0 [ 137.520921][ T5722] ? sctp_get_port_local+0x69b/0x1500 [ 137.526333][ T5722] sctp_get_port_local+0x69b/0x1500 [ 137.531588][ T5722] ? __lock_acquire+0x7ea0/0x7ea0 [ 137.536756][ T5722] ? sctp_do_bind+0x8f0/0x8f0 [ 137.541465][ T5722] ? sctp_bind_addr_match+0x2c/0x2a0 [ 137.546801][ T5722] sctp_do_bind+0x4c0/0x8f0 [ 137.551353][ T5722] sctp_connect_new_asoc+0x266/0x6a0 [ 137.556674][ T5722] ? __sctp_connect+0xd80/0xd80 [ 137.561549][ T5722] ? __local_bh_enable_ip+0x136/0x1c0 [ 137.566944][ T5722] ? bpf_lsm_sctp_bind_connect+0x5/0x10 [ 137.572542][ T5722] ? security_sctp_bind_connect+0x85/0xb0 [ 137.578296][ T5722] sctp_sendmsg+0x1686/0x2940 [ 137.583006][ T5722] ? sctp_getsockopt+0x8a0/0x8a0 [ 137.587971][ T5722] ? __lock_acquire+0x7ea0/0x7ea0 [ 137.593048][ T5722] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 137.599494][ T5722] ? aa_sock_msg_perm+0x94/0x150 [ 137.604473][ T5722] ? inet_sendmsg+0xca/0x2a0 [ 137.609095][ T5722] __sys_sendto+0x497/0x650 [ 137.613624][ T5722] ? __ia32_sys_getpeername+0x80/0x80 [ 137.619041][ T5722] ? __lock_acquire+0x7ea0/0x7ea0 [ 137.624110][ T5722] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 137.630154][ T5722] ? lock_chain_count+0x20/0x20 [ 137.635035][ T5722] __x64_sys_sendto+0xda/0xf0 [ 137.639738][ T5722] do_syscall_64+0x4c/0xa0 [ 137.644233][ T5722] ? clear_bhb_loop+0x60/0xb0 [ 137.648932][ T5722] ? clear_bhb_loop+0x60/0xb0 [ 137.653638][ T5722] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 137.659560][ T5722] RIP: 0033:0x7f0ecfb9e199 [ 137.664006][ T5722] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.683631][ T5722] RSP: 002b:00007f0ed0a58028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 137.692092][ T5722] RAX: ffffffffffffffda RBX: 00007f0ecfe25fa0 RCX: 00007f0ecfb9e199 [ 137.700090][ T5722] RDX: 0000000000034000 RSI: 0000200000000300 RDI: 0000000000000003 [ 137.708085][ T5722] RBP: 00007f0ecfc358e0 R08: 0000200000000000 R09: 000000000000001c [ 137.716075][ T5722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 137.724067][ T5722] R13: 00007f0ecfe26038 R14: 00007f0ecfe25fa0 R15: 00007ffd33eec4f8 [ 137.732072][ T5722] [ 138.242663][ T5731] netlink: 152 bytes leftover after parsing attributes in process `syz.5.364'. [ 138.974015][ T5733] netlink: 12 bytes leftover after parsing attributes in process `syz.5.365'. [ 139.030068][ T4336] yurex 1-1:0.50: USB YUREX #0 now disconnected [ 139.125503][ T5733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 139.272557][ T5735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 139.286045][ T5740] netlink: 60 bytes leftover after parsing attributes in process `syz.4.367'. [ 139.300366][ T5740] unsupported nlmsg_type 40 [ 139.310533][ T5735] bond0: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 139.332940][ T5735] bond0: (slave ip_vti0): Error -95 calling set_mac_address [ 139.542979][ T5742] EXT4-fs warning (device sda1): verify_group_input:180: Cannot read last block (265596) [ 140.776953][ T4283] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 140.787902][ T4283] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 140.815388][ T4283] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 140.835100][ T4283] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 140.843910][ T4283] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 140.851713][ T4283] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 140.978377][ T4804] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.195913][ T4804] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.590039][ T4804] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.793537][ T4804] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.814212][ T5786] fuse: Bad value for 'fd' [ 142.944690][ T4293] Bluetooth: hci3: command 0x0409 tx timeout [ 142.961379][ T5765] chnl_net:caif_netlink_parms(): no params data found [ 143.015805][ T5815] validate_nla: 2 callbacks suppressed [ 143.015819][ T5815] netlink: 'syz.0.395': attribute type 1 has an invalid length. [ 143.036847][ T5815] netlink: 64363 bytes leftover after parsing attributes in process `syz.0.395'. [ 143.979271][ C1] net_ratelimit: 60 callbacks suppressed [ 144.126017][ T5765] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.143285][ T5765] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.174502][ T5765] device bridge_slave_0 entered promiscuous mode [ 144.306193][ T5765] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.318276][ T5765] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.356428][ T5765] device bridge_slave_1 entered promiscuous mode [ 144.363056][ T5848] FAULT_INJECTION: forcing a failure. [ 144.363056][ T5848] name failslab, interval 1, probability 0, space 0, times 0 [ 144.363082][ T5848] CPU: 0 PID: 5848 Comm: syz.3.403 Not tainted syzkaller #0 [ 144.363104][ T5848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 144.363118][ T5848] Call Trace: [ 144.363126][ T5848] [ 144.363135][ T5848] dump_stack_lvl+0x188/0x24e [ 144.363171][ T5848] ? show_regs_print_info+0x12/0x12 [ 144.363199][ T5848] ? load_image+0x410/0x410 [ 144.363237][ T5848] ? __might_sleep+0xd0/0xd0 [ 144.363260][ T5848] ? __lock_acquire+0x7ea0/0x7ea0 [ 144.363295][ T5848] should_fail_ex+0x390/0x4c0 [ 144.363335][ T5848] should_failslab+0x5/0x20 [ 144.432855][ T5848] slab_pre_alloc_hook+0x59/0x300 [ 144.437925][ T5848] ? driver_register+0x32d/0x430 [ 144.442892][ T5848] ? usb_gadget_register_driver_owner+0xf5/0x260 [ 144.449272][ T5848] ? raw_ioctl+0x13a0/0x3cd0 [ 144.453909][ T5848] ? kobject_set_name_vargs+0x5d/0x110 [ 144.459404][ T5848] __kmem_cache_alloc_node+0x4f/0x270 [ 144.464808][ T5848] ? kobject_set_name_vargs+0x5d/0x110 [ 144.470302][ T5848] __kmalloc_node_track_caller+0xa0/0x240 [ 144.476044][ T5848] kstrdup_const+0x56/0x90 [ 144.480488][ T5848] kobject_set_name_vargs+0x5d/0x110 [ 144.485817][ T5848] kobject_init_and_add+0xeb/0x190 [ 144.490966][ T5848] ? kobject_add+0x230/0x230 [ 144.495592][ T5848] ? __raw_spin_lock_init+0x41/0x100 [ 144.500906][ T5848] bus_add_driver+0x1de/0x5d0 [ 144.505616][ T5848] driver_register+0x32d/0x430 [ 144.510407][ T5848] usb_gadget_register_driver_owner+0xf5/0x260 [ 144.516602][ T5848] raw_ioctl+0x13a0/0x3cd0 [ 144.521048][ T5848] ? __kmem_cache_free+0xb6/0x200 [ 144.526112][ T5848] ? tomoyo_path_number_perm+0x205/0x650 [ 144.531771][ T5848] ? tomoyo_path_number_perm+0x5a4/0x650 [ 144.537423][ T5848] ? tomoyo_path_number_perm+0x205/0x650 [ 144.543085][ T5848] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 144.548567][ T5848] ? make_qualifier+0x3b0/0x3b0 [ 144.553465][ T5848] ? __fget_files+0x28/0x460 [ 144.558099][ T5848] ? bpf_lsm_file_ioctl+0x5/0x10 [ 144.563067][ T5848] ? security_file_ioctl+0x7c/0xa0 [ 144.568219][ T5848] ? make_qualifier+0x3b0/0x3b0 [ 144.573101][ T5848] __se_sys_ioctl+0xfa/0x170 [ 144.577720][ T5848] do_syscall_64+0x4c/0xa0 [ 144.582181][ T5848] ? clear_bhb_loop+0x60/0xb0 [ 144.586958][ T5848] ? clear_bhb_loop+0x60/0xb0 [ 144.591730][ T5848] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 144.597655][ T5848] RIP: 0033:0x7fc046d9de2b [ 144.602096][ T5848] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 144.621760][ T5848] RSP: 002b:00007fc047c25f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 144.630203][ T5848] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fc046d9de2b [ 144.638203][ T5848] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 144.646215][ T5848] RBP: 00007fc047c26fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 144.654212][ T5848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 144.662210][ T5848] R13: 0000200000000240 R14: 0000000000000002 R15: 0000000000000000 [ 144.670255][ T5848] [ 144.697028][ T5848] kobject: can not set name properly! [ 144.705867][ T5848] UDC core: USB Raw Gadget: driver registration failed: -12 [ 144.946291][ T5848] misc raw-gadget: fail, usb_gadget_register_driver returned -12 [ 145.019446][ T4293] Bluetooth: hci3: command 0x041b tx timeout [ 145.237459][ T4804] device hsr_slave_0 left promiscuous mode [ 145.269027][ T4804] device hsr_slave_1 left promiscuous mode [ 145.289854][ T4804] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 145.297366][ T4804] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 145.334746][ T4804] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 145.358939][ T4804] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 145.378731][ T4804] device bridge_slave_1 left promiscuous mode [ 145.378870][ T4804] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.441428][ T4804] device bridge_slave_0 left promiscuous mode [ 145.447714][ T4804] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.636025][ T4804] device veth1_macvtap left promiscuous mode [ 145.642886][ T4804] device veth0_macvtap left promiscuous mode [ 145.685775][ T4804] device veth1_vlan left promiscuous mode [ 145.695691][ T4804] device veth0_vlan left promiscuous mode [ 145.800075][ T5874] loop3: detected capacity change from 0 to 1024 [ 145.807605][ T5874] ext4: Unknown parameter 'nouser_xattr' [ 145.857252][ T5878] fuse: Bad value for 'fd' [ 147.101092][ T4293] Bluetooth: hci3: command 0x040f tx timeout [ 149.179342][ T4293] Bluetooth: hci3: command 0x0419 tx timeout [ 149.339273][ C1] net_ratelimit: 63 callbacks suppressed [ 149.639842][ T4804] team0 (unregistering): Port device team_slave_1 removed [ 149.800205][ T4804] team0 (unregistering): Port device team_slave_0 removed [ 149.921283][ T4804] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 150.062635][ T4804] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 150.641909][ T4293] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 151.119963][ T4804] bond0 (unregistering): Released all slaves [ 151.208722][ T5765] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 151.222901][ T5765] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 151.260217][ T5871] netlink: 'syz.0.412': attribute type 1 has an invalid length. [ 151.426976][ T5879] netlink: 'syz.0.412': attribute type 10 has an invalid length. [ 151.452273][ T5879] netlink: 40 bytes leftover after parsing attributes in process `syz.0.412'. [ 151.463124][ T5879] device dummy0 entered promiscuous mode [ 151.472486][ T5888] netlink: 'syz.3.417': attribute type 4 has an invalid length. [ 151.654344][ T5765] team0: Port device team_slave_0 added [ 151.714815][ T5765] team0: Port device team_slave_1 added [ 151.899631][ T5765] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 151.913541][ T5765] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 152.007848][ T5765] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 152.136273][ T5765] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 152.154216][ T5765] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 152.241152][ T5765] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 152.598502][ T5765] device hsr_slave_0 entered promiscuous mode [ 152.664541][ T5765] device hsr_slave_1 entered promiscuous mode [ 152.689482][ T5765] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 152.718480][ T5765] Cannot create hsr debugfs directory [ 154.019022][ T5765] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 154.104725][ T5765] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 154.192182][ T5765] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 154.266764][ T5765] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 154.379332][ C0] net_ratelimit: 51 callbacks suppressed [ 154.787271][ T5765] 8021q: adding VLAN 0 to HW filter on device bond0 [ 154.853783][ T4802] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 154.874363][ T4802] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 154.914320][ T5765] 8021q: adding VLAN 0 to HW filter on device team0 [ 154.956101][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 154.975698][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 155.006008][ T4805] bridge0: port 1(bridge_slave_0) entered blocking state [ 155.013347][ T4805] bridge0: port 1(bridge_slave_0) entered forwarding state [ 155.096570][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 155.154647][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 155.210611][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 155.253065][ T4805] bridge0: port 2(bridge_slave_1) entered blocking state [ 155.260281][ T4805] bridge0: port 2(bridge_slave_1) entered forwarding state [ 155.314494][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 155.327662][ T5986] loop3: detected capacity change from 0 to 2048 [ 155.423153][ T5986] GPT:first_usable_lbas don't match. [ 155.429338][ T5986] GPT:34 != 290 [ 155.432889][ T5986] GPT: Use GNU Parted to correct GPT errors. [ 155.439012][ T5986] loop3: p1 p2 p3 [ 155.457589][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 155.480590][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 155.547111][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 155.597647][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 155.630226][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 155.668910][ T3639] GPT:first_usable_lbas don't match. [ 155.676835][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 155.704084][ T3639] GPT:34 != 290 [ 155.707624][ T3639] GPT: Use GNU Parted to correct GPT errors. [ 155.730003][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 155.742140][ T3639] loop3: p1 p2 p3 [ 155.774054][ T5765] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 155.828613][ T5765] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 155.887238][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 155.919518][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 155.934590][ T5924] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 155.968178][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 156.274451][ T6007] netlink: 'syz.3.444': attribute type 1 has an invalid length. [ 156.376351][ T5979] udevd[5979]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 156.389492][ T5924] udevd[5924]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 156.406907][ T5909] udevd[5909]: inotify_add_watch(7, /dev/loop3p3, 10) failed: No such file or directory [ 156.504573][ T5979] udevd[5979]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 156.518874][ T5909] udevd[5909]: inotify_add_watch(7, /dev/loop3p3, 10) failed: No such file or directory [ 156.544797][ T6007] 8021q: adding VLAN 0 to HW filter on device bond1 [ 156.565659][ T5924] udevd[5924]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 156.768554][ T6003] bond1: (slave veth0_to_bond): making interface the new active one [ 156.813694][ T6003] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 156.885982][ T6010] device bond1 entered promiscuous mode [ 156.899527][ T6010] device veth0_to_bond entered promiscuous mode [ 157.476169][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 157.490432][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 157.512234][ T5765] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 158.329083][ T6047] loop0: detected capacity change from 0 to 256 [ 158.423721][ T6047] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010321, chksum : 0x3a8a43f6, utbl_chksum : 0xe619d30d) [ 158.675721][ T6053] exFAT-fs (loop0): error, invalid access to FAT (entry 0x00000005) bogus content (0x3f3f3f3f) [ 158.747473][ T6053] exFAT-fs (loop0): Filesystem has been set read-only [ 159.001336][ T4274] exFAT-fs (loop0): error, invalid access to FAT (entry 0x00000005) bogus content (0x3f3f3f3f) [ 159.029884][ T4274] exFAT-fs (loop0): error, invalid access to FAT (entry 0x00000005) bogus content (0x3f3f3f3f) [ 159.063309][ T6058] netlink: 'syz.4.457': attribute type 12 has an invalid length. [ 159.151709][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 159.181163][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 159.358362][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 159.375218][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 159.459048][ T5765] device veth0_vlan entered promiscuous mode [ 159.548012][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 159.568941][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 159.602790][ T5765] device veth1_vlan entered promiscuous mode [ 159.703530][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 159.725628][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 159.774163][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 159.817388][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 159.825441][ C1] net_ratelimit: 54 callbacks suppressed [ 160.035819][ T5765] device veth0_macvtap entered promiscuous mode [ 160.085532][ T5765] device veth1_macvtap entered promiscuous mode [ 160.274466][ T4805] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.363847][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 160.402693][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 160.554684][ T4805] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.638246][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.687224][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.710806][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.738131][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.784568][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.825480][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.868292][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.899376][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.925339][ T5765] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 161.008606][ T4805] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.088694][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 161.106950][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 161.222931][ T4805] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.298776][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 161.330570][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.378539][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 161.401222][ T4283] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 161.409978][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.419866][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 161.419915][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.419937][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 161.419953][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.464913][ T5765] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 161.497599][ T4283] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 161.522517][ T4292] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 161.533984][ T4292] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 161.546860][ T4292] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 161.573242][ T4292] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 161.588718][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 161.598720][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 161.635107][ T5765] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.647577][ T5765] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.657874][ T5765] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.668153][ T5765] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 162.135188][ T4804] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 162.147175][ T4804] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 162.307879][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 162.403694][ T4337] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 162.449380][ T4337] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 162.484503][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 163.659538][ T4292] Bluetooth: hci1: command 0x0409 tx timeout [ 164.101733][ T6089] chnl_net:caif_netlink_parms(): no params data found [ 164.869305][ C1] net_ratelimit: 80 callbacks suppressed [ 164.907204][ T6149] netlink: 'syz.4.482': attribute type 1 has an invalid length. [ 165.045368][ T6149] 8021q: adding VLAN 0 to HW filter on device bond0 [ 165.311563][ T6153] bond0: (slave geneve2): making interface the new active one [ 165.342377][ T6153] bond0: (slave geneve2): Enslaving as an active interface with an up link [ 165.351440][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 165.739624][ T4292] Bluetooth: hci1: command 0x041b tx timeout [ 165.784295][ T6178] loop3: detected capacity change from 0 to 8192 [ 165.856410][ T6089] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.864558][ T6178] loop3: p1 p2 < > p3 p4 < p5 > [ 165.876132][ T6178] loop3: partition table partially beyond EOD, truncated [ 165.888957][ T6089] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.904054][ T6178] loop3: p1 size 1342439424 extends beyond EOD, truncated [ 165.930730][ T6089] device bridge_slave_0 entered promiscuous mode [ 165.985076][ T6178] loop3: p2 start 16384 is beyond EOD, truncated [ 166.006252][ T6178] loop3: p3 start 67108864 is beyond EOD, truncated [ 166.016941][ T6178] loop3: p5 size 1342439424 extends beyond EOD, truncated [ 166.045629][ T6089] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.079307][ T6089] bridge0: port 2(bridge_slave_1) entered disabled state [ 166.087826][ T6089] device bridge_slave_1 entered promiscuous mode [ 166.177831][ T4805] device hsr_slave_0 left promiscuous mode [ 166.207297][ T4805] device hsr_slave_1 left promiscuous mode [ 166.235004][ T4805] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 166.254943][ T4805] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 166.273542][ T4805] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 166.286524][ T4805] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 166.367702][ T5909] udevd[5909]: inotify_add_watch(7, /dev/loop3p5, 10) failed: No such file or directory [ 166.368201][ T5979] udevd[5979]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 166.394149][ T4805] device veth1_macvtap left promiscuous mode [ 166.406879][ T5924] udevd[5924]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 166.426466][ T4805] device veth0_macvtap left promiscuous mode [ 166.434195][ T4805] device veth1_vlan left promiscuous mode [ 166.443371][ T4805] device veth0_vlan left promiscuous mode [ 167.829296][ T4292] Bluetooth: hci1: command 0x040f tx timeout [ 167.854863][ T4805] team0 (unregistering): Port device team_slave_1 removed [ 167.925849][ T4805] team0 (unregistering): Port device team_slave_0 removed [ 167.998226][ T4805] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 168.109966][ T4805] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 169.113871][ T4805] bond0 (unregistering): Released all slaves [ 169.343301][ T6089] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 169.450246][ T6089] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 169.733563][ T6089] team0: Port device team_slave_0 added [ 169.762865][ T6089] team0: Port device team_slave_1 added [ 169.839432][ T4357] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 169.899709][ T4292] Bluetooth: hci1: command 0x0419 tx timeout [ 169.944234][ T6089] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 169.951344][ T6089] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 169.977579][ T6089] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 170.006027][ T6089] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 170.032203][ T4357] usb 4-1: Using ep0 maxpacket: 32 [ 170.039772][ T4357] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 170.059330][ C1] net_ratelimit: 62 callbacks suppressed [ 170.072919][ T4357] usb 4-1: config 0 has no interface number 0 [ 170.079099][ T4357] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 170.091724][ T6089] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 170.168857][ T4357] usb 4-1: config 0 interface 85 has no altsetting 0 [ 170.217178][ T4357] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 170.239321][ T6089] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 170.269358][ T4357] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.313162][ T4357] usb 4-1: Product: syz [ 170.317390][ T4357] usb 4-1: Manufacturer: syz [ 170.317411][ T4357] usb 4-1: SerialNumber: syz [ 170.364680][ T4357] usb 4-1: config 0 descriptor?? [ 170.686661][ T6089] device hsr_slave_0 entered promiscuous mode [ 170.743938][ T6089] device hsr_slave_1 entered promiscuous mode [ 171.023093][ T4357] appletouch 4-1:0.85: Geyser mode initialized. [ 171.049595][ T4357] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.85/input/input6 [ 171.292827][ T4336] usb 4-1: USB disconnect, device number 5 [ 171.352278][ T4336] appletouch 4-1:0.85: input: appletouch disconnected [ 172.028122][ T6089] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 172.102765][ T6089] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 172.166573][ T6089] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 172.230297][ T6089] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 172.496881][ T6284] netlink: 'syz.6.520': attribute type 1 has an invalid length. [ 172.705468][ T6285] netlink: 12 bytes leftover after parsing attributes in process `syz.4.516'. [ 172.894021][ T6089] 8021q: adding VLAN 0 to HW filter on device bond0 [ 172.967467][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 173.010339][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 173.043149][ T6089] 8021q: adding VLAN 0 to HW filter on device team0 [ 173.093671][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 173.140434][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 173.169718][ T4804] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.176856][ T4804] bridge0: port 1(bridge_slave_0) entered forwarding state [ 173.249783][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 173.286034][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 173.334084][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 173.361377][ T4804] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.368532][ T4804] bridge0: port 2(bridge_slave_1) entered forwarding state [ 173.422324][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 173.474826][ T5651] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 173.529490][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 173.572758][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 173.614815][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 173.648750][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 173.694706][ T6089] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 173.735602][ T6089] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 173.773771][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 173.793660][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 173.820243][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 173.841329][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 173.867713][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 173.891465][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 174.097927][ T6316] loop3: detected capacity change from 0 to 1024 [ 174.160523][ T6316] hfsplus: unable to parse mount options [ 174.489787][ T6327] bridge_slave_0: default FDB implementation only supports local addresses [ 175.010324][ T5651] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 175.017909][ T5651] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 175.076104][ T6089] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 175.419249][ C1] net_ratelimit: 55 callbacks suppressed [ 175.565440][ T6356] netlink: 'syz.3.538': attribute type 4 has an invalid length. [ 175.751915][ T6358] netlink: 'syz.3.538': attribute type 4 has an invalid length. [ 176.447650][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 176.473512][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 176.573980][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 176.599187][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 176.645158][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 176.672324][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 176.694405][ T6089] device veth0_vlan entered promiscuous mode [ 176.743273][ T6089] device veth1_vlan entered promiscuous mode [ 176.780861][ T4805] rpcbind: server 127.0.0.1 not responding, timed out [ 176.872482][ T6089] device veth0_macvtap entered promiscuous mode [ 176.895748][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 176.922702][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 176.933123][ T6383] netlink: 196 bytes leftover after parsing attributes in process `syz.3.543'. [ 176.957797][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 176.984363][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 177.015832][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 177.040812][ T6089] device veth1_macvtap entered promiscuous mode [ 177.122949][ T6089] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 177.159567][ T6089] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.181139][ T6089] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 177.249953][ T6089] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.289341][ T6089] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 177.312909][ T6089] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.339867][ T6089] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 177.388614][ T6089] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.404284][ T6089] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 177.461364][ T6089] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 177.477853][ T6391] loop3: detected capacity change from 0 to 512 [ 177.509741][ T6089] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.531056][ T6391] FAT-fs (loop3): Unrecognized mount option "ÿÿÿÿÿ01777777777777777777777" or missing value [ 177.569233][ T6089] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 177.609255][ T6089] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.625676][ T6089] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 177.656789][ T6089] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.684272][ T6089] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 177.708259][ T6089] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.756811][ T6089] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 177.808179][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 177.840372][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 177.870223][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 177.910272][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 177.940658][ T5648] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 177.964256][ T6089] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.992368][ T6089] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.035001][ T6089] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.052464][ T6089] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.325589][ T4804] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 178.349353][ T4804] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 178.386129][ T4804] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 178.521857][ T4804] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 178.553887][ T4804] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 178.599842][ T4802] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 178.894323][ T6425] overlayfs: failed to clone upperpath [ 179.119668][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 179.138290][ T6423] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 179.849561][ T4321] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 180.045093][ T4321] usb 6-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 180.074866][ T4321] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.109670][ T4321] usb 6-1: Product: syz [ 180.113909][ T4321] usb 6-1: Manufacturer: syz [ 180.159419][ T4321] usb 6-1: SerialNumber: syz [ 180.177562][ T4321] usb 6-1: config 0 descriptor?? [ 180.211804][ T4321] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 180.459428][ C0] net_ratelimit: 83 callbacks suppressed [ 181.644130][ T6461] ------------[ cut here ]------------ [ 181.650426][ T6461] WARNING: CPU: 0 PID: 6461 at net/mac80211/chan.c:2017 ieee80211_link_release_channel+0x150/0x180 [ 181.661416][ T6461] Modules linked in: [ 181.665967][ T6461] CPU: 0 PID: 6461 Comm: syz.7.564 Not tainted syzkaller #0 [ 181.673497][ T6461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 181.683779][ T6461] RIP: 0010:ieee80211_link_release_channel+0x150/0x180 [ 181.690768][ T6461] Code: 7c 2d 00 00 74 08 48 89 df e8 2c 2c 18 f8 bf 18 1e 00 00 48 03 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 45 36 81 00 e8 70 d1 c6 f7 <0f> 0b eb c5 48 c7 c1 24 0e 21 8e 80 e1 07 80 c1 03 38 c1 0f 8c 51 [ 181.710501][ T6461] RSP: 0018:ffffc900046d7188 EFLAGS: 00010287 [ 181.716629][ T6461] RAX: ffffffff89bb7510 RBX: ffff8880562ed5a8 RCX: 0000000000080000 [ 181.724740][ T6461] RDX: ffffc9000c951000 RSI: 000000000006b3e1 RDI: 000000000006b3e2 [ 181.732798][ T6461] RBP: 0000000000000000 R08: ffffffff8e20d96f R09: 1ffffffff1c41b2d [ 181.740858][ T6461] R10: dffffc0000000000 R11: fffffbfff1c41b2e R12: ffff8880562eeab0 [ 181.748875][ T6461] R13: 1ffff1100ac5dab5 R14: ffff8880562ee228 R15: dffffc0000000000 [ 181.756942][ T6461] FS: 00007f007c6cc6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 181.765969][ T6461] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.772645][ T6461] CR2: 0000001b34313ff8 CR3: 00000000281bf000 CR4: 00000000003506f0 [ 181.780711][ T6461] Call Trace: [ 181.784035][ T6461] [ 181.787003][ T6461] ? trace_drv_return_void+0x240/0x240 [ 181.792562][ T6461] unregister_netdevice_many_notify+0x13c4/0x1990 [ 181.799023][ T6461] ? unregister_netdevice_many+0x20/0x20 [ 181.804758][ T6461] ? kernfs_remove_by_name_ns+0x113/0x150 [ 181.810597][ T6461] ? __lock_acquire+0x7ea0/0x7ea0 [ 181.815715][ T6461] unregister_netdevice_queue+0x2e5/0x330 [ 181.821578][ T6461] ? list_netdevice+0x640/0x640 [ 181.826483][ T6461] ? kernfs_remove_by_name_ns+0x113/0x150 [ 181.832312][ T6461] _cfg80211_unregister_wdev+0x179/0x590 [ 181.838003][ T6461] ieee80211_if_remove+0x1ad/0x2b0 [ 181.843212][ T6461] ieee80211_del_iface+0x15/0x20 [ 181.848225][ T6461] cfg80211_remove_virtual_intf+0x23a/0x440 [ 181.854199][ T6461] genl_family_rcv_msg_doit+0x22f/0x350 [ 181.854236][ T6461] ? end_current_label_crit_section+0x170/0x170 [ 181.866345][ T6461] ? genl_family_rcv_msg_dumpit+0x3c0/0x3c0 [ 181.872349][ T6461] ? bpf_lsm_capable+0x5/0x10 [ 181.877083][ T6461] ? security_capable+0x85/0xb0 [ 181.882039][ T6461] genl_rcv_msg+0x601/0x790 [ 181.886619][ T6461] ? genl_bind+0x360/0x360 [ 181.891131][ T6461] ? nl80211_new_interface+0x1000/0x1000 [ 181.896869][ T6461] netlink_rcv_skb+0x1ef/0x440 [ 181.901746][ T6461] ? genl_bind+0x360/0x360 [ 181.906239][ T6461] ? netlink_ack+0x1160/0x1160 [ 181.911107][ T6461] ? down_read+0x1a8/0x2d0 [ 181.915584][ T6461] genl_rcv+0x24/0x40 [ 181.919659][ T6461] netlink_unicast+0x7ad/0x920 [ 181.924487][ T6461] netlink_sendmsg+0x8ad/0xbd0 [ 181.929343][ T6461] ? netlink_getsockopt+0x550/0x550 [ 181.934640][ T6461] ? apparmor_socket_sendmsg+0x8a/0x330 [ 181.940292][ T6461] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 181.945623][ T6461] ? security_socket_sendmsg+0x7c/0xa0 [ 181.951174][ T6461] ? netlink_getsockopt+0x550/0x550 [ 181.956443][ T6461] ____sys_sendmsg+0x5ed/0x9a0 [ 181.961339][ T6461] ? __sys_sendmsg_sock+0x30/0x30 [ 181.966435][ T6461] ? __import_iovec+0x306/0x510 [ 181.971431][ T6461] ? import_iovec+0x6f/0xa0 [ 181.976005][ T6461] ___sys_sendmsg+0x2a2/0x360 [ 181.980775][ T6461] ? __sys_sendmsg+0x2a0/0x2a0 [ 181.985642][ T6461] __se_sys_sendmsg+0x1c3/0x2b0 [ 181.990590][ T6461] ? __x64_sys_sendmsg+0x80/0x80 [ 181.995605][ T6461] ? lockdep_hardirqs_on+0x94/0x140 [ 182.000901][ T6461] do_syscall_64+0x4c/0xa0 [ 182.005368][ T6461] ? clear_bhb_loop+0x60/0xb0 [ 182.010172][ T6461] ? clear_bhb_loop+0x60/0xb0 [ 182.014931][ T6461] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 182.020924][ T6461] RIP: 0033:0x7f007b79e199 [ 182.025387][ T6461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 182.045243][ T6461] RSP: 002b:00007f007c6cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 182.053756][ T6461] RAX: ffffffffffffffda RBX: 00007f007ba25fa0 RCX: 00007f007b79e199 [ 182.061813][ T6461] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003 [ 182.069863][ T6461] RBP: 00007f007b8358e0 R08: 0000000000000000 R09: 0000000000000000 [ 182.077873][ T6461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 182.085932][ T6461] R13: 00007f007ba26038 R14: 00007f007ba25fa0 R15: 00007fff09ba9768 [ 182.094008][ T6461] [ 182.097089][ T6461] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 182.104405][ T6461] CPU: 0 PID: 6461 Comm: syz.7.564 Not tainted syzkaller #0 [ 182.111719][ T6461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 182.121826][ T6461] Call Trace: [ 182.125141][ T6461] [ 182.128105][ T6461] dump_stack_lvl+0x188/0x24e [ 182.132826][ T6461] ? memcpy+0x3c/0x60 [ 182.136870][ T6461] ? show_regs_print_info+0x12/0x12 [ 182.142095][ T6461] ? load_image+0x410/0x410 [ 182.146642][ T6461] panic+0x2d3/0x710 [ 182.150583][ T6461] ? bpf_jit_dump+0xd0/0xd0 [ 182.155139][ T6461] __warn+0x2f8/0x4f0 [ 182.159150][ T6461] ? ieee80211_link_release_channel+0x150/0x180 [ 182.165421][ T6461] ? ieee80211_link_release_channel+0x150/0x180 [ 182.171713][ T6461] report_bug+0x2ba/0x4f0 [ 182.176064][ T6461] ? ieee80211_link_release_channel+0x150/0x180 [ 182.182335][ T6461] handle_bug+0x3a/0x70 [ 182.186525][ T6461] exc_invalid_op+0x16/0x40 [ 182.191058][ T6461] asm_exc_invalid_op+0x16/0x20 [ 182.195942][ T6461] RIP: 0010:ieee80211_link_release_channel+0x150/0x180 [ 182.202826][ T6461] Code: 7c 2d 00 00 74 08 48 89 df e8 2c 2c 18 f8 bf 18 1e 00 00 48 03 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 45 36 81 00 e8 70 d1 c6 f7 <0f> 0b eb c5 48 c7 c1 24 0e 21 8e 80 e1 07 80 c1 03 38 c1 0f 8c 51 [ 182.222451][ T6461] RSP: 0018:ffffc900046d7188 EFLAGS: 00010287 [ 182.228539][ T6461] RAX: ffffffff89bb7510 RBX: ffff8880562ed5a8 RCX: 0000000000080000 [ 182.236545][ T6461] RDX: ffffc9000c951000 RSI: 000000000006b3e1 RDI: 000000000006b3e2 [ 182.244539][ T6461] RBP: 0000000000000000 R08: ffffffff8e20d96f R09: 1ffffffff1c41b2d [ 182.252543][ T6461] R10: dffffc0000000000 R11: fffffbfff1c41b2e R12: ffff8880562eeab0 [ 182.260539][ T6461] R13: 1ffff1100ac5dab5 R14: ffff8880562ee228 R15: dffffc0000000000 [ 182.268554][ T6461] ? ieee80211_link_release_channel+0x150/0x180 [ 182.274824][ T6461] ? ieee80211_link_release_channel+0x150/0x180 [ 182.281085][ T6461] ? trace_drv_return_void+0x240/0x240 [ 182.286573][ T6461] unregister_netdevice_many_notify+0x13c4/0x1990 [ 182.293020][ T6461] ? unregister_netdevice_many+0x20/0x20 [ 182.298678][ T6461] ? kernfs_remove_by_name_ns+0x113/0x150 [ 182.304439][ T6461] ? __lock_acquire+0x7ea0/0x7ea0 [ 182.309500][ T6461] unregister_netdevice_queue+0x2e5/0x330 [ 182.315244][ T6461] ? list_netdevice+0x640/0x640 [ 182.320117][ T6461] ? kernfs_remove_by_name_ns+0x113/0x150 [ 182.325865][ T6461] _cfg80211_unregister_wdev+0x179/0x590 [ 182.331586][ T6461] ieee80211_if_remove+0x1ad/0x2b0 [ 182.336724][ T6461] ieee80211_del_iface+0x15/0x20 [ 182.341689][ T6461] cfg80211_remove_virtual_intf+0x23a/0x440 [ 182.347622][ T6461] genl_family_rcv_msg_doit+0x22f/0x350 [ 182.353217][ T6461] ? end_current_label_crit_section+0x170/0x170 [ 182.359515][ T6461] ? genl_family_rcv_msg_dumpit+0x3c0/0x3c0 [ 182.365445][ T6461] ? bpf_lsm_capable+0x5/0x10 [ 182.370170][ T6461] ? security_capable+0x85/0xb0 [ 182.375050][ T6461] genl_rcv_msg+0x601/0x790 [ 182.379592][ T6461] ? genl_bind+0x360/0x360 [ 182.384074][ T6461] ? nl80211_new_interface+0x1000/0x1000 [ 182.389744][ T6461] netlink_rcv_skb+0x1ef/0x440 [ 182.394534][ T6461] ? genl_bind+0x360/0x360 [ 182.398972][ T6461] ? netlink_ack+0x1160/0x1160 [ 182.403779][ T6461] ? down_read+0x1a8/0x2d0 [ 182.408242][ T6461] genl_rcv+0x24/0x40 [ 182.412255][ T6461] netlink_unicast+0x7ad/0x920 [ 182.417066][ T6461] netlink_sendmsg+0x8ad/0xbd0 [ 182.421886][ T6461] ? netlink_getsockopt+0x550/0x550 [ 182.427138][ T6461] ? apparmor_socket_sendmsg+0x8a/0x330 [ 182.432734][ T6461] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 182.438055][ T6461] ? security_socket_sendmsg+0x7c/0xa0 [ 182.443556][ T6461] ? netlink_getsockopt+0x550/0x550 [ 182.448798][ T6461] ____sys_sendmsg+0x5ed/0x9a0 [ 182.453630][ T6461] ? __sys_sendmsg_sock+0x30/0x30 [ 182.458693][ T6461] ? __import_iovec+0x306/0x510 [ 182.463599][ T6461] ? import_iovec+0x6f/0xa0 [ 182.468152][ T6461] ___sys_sendmsg+0x2a2/0x360 [ 182.472867][ T6461] ? __sys_sendmsg+0x2a0/0x2a0 [ 182.477738][ T6461] __se_sys_sendmsg+0x1c3/0x2b0 [ 182.482623][ T6461] ? __x64_sys_sendmsg+0x80/0x80 [ 182.487604][ T6461] ? lockdep_hardirqs_on+0x94/0x140 [ 182.492845][ T6461] do_syscall_64+0x4c/0xa0 [ 182.497295][ T6461] ? clear_bhb_loop+0x60/0xb0 [ 182.502037][ T6461] ? clear_bhb_loop+0x60/0xb0 [ 182.506748][ T6461] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 182.512681][ T6461] RIP: 0033:0x7f007b79e199 [ 182.517127][ T6461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 182.536761][ T6461] RSP: 002b:00007f007c6cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 182.545212][ T6461] RAX: ffffffffffffffda RBX: 00007f007ba25fa0 RCX: 00007f007b79e199 [ 182.553212][ T6461] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003 [ 182.561212][ T6461] RBP: 00007f007b8358e0 R08: 0000000000000000 R09: 0000000000000000 [ 182.569217][ T6461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 182.577219][ T6461] R13: 00007f007ba26038 R14: 00007f007ba25fa0 R15: 00007fff09ba9768 [ 182.585232][ T6461] [ 182.588874][ T6461] Kernel Offset: disabled [ 182.593338][ T6461] Rebooting in 86400 seconds..