last executing test programs: 40.584583991s ago: executing program 0 (id=993): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001fc0)=@delsa={0x28, 0x11, 0x521, 0x70bd27, 0x25dfdbfb, {@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4d2, 0x2, 0x33}}, 0x28}, 0x1, 0x0, 0x0, 0x4050}, 0x8000) 40.556152972s ago: executing program 0 (id=994): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@getnexthop={0x18, 0x6a, 0x501, 0x70bd2d}, 0x18}}, 0x0) 40.327311987s ago: executing program 0 (id=997): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracefs\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./tracefs/dynamic_events\x00', 0x2, 0x0) syz_create_resource$futex(&(0x7f0000000000)=0x1) add_key(&(0x7f00000011c0)='rxrpc\x00', &(0x7f0000001200)={'syz', 0x0}, &(0x7f0000001240)="000000000000000463656c6c000000010000004400000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040102030400000004050607", 0x57, 0xffffffffffffffff) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001500)=ANY=[@ANYBLOB="3c0000001100010025bd7000fedbdf25ffffffff000000000000000000000000000004d400003c0014000d00ffffff"], 0x3c}, 0x1, 0x0, 0x0, 0x24044821}, 0x0) 40.327090287s ago: executing program 0 (id=998): syz_mount_image$msdos(&(0x7f0000000180), &(0x7f00000002c0)='./file1\x00', 0x180c8, &(0x7f0000000300)=ANY=[@ANYBLOB="6e66732c646f74732c636865636b3d7374726963742c646f74732c6572726f72733d72656d6f756e742d726f2c00fc403bb14281bbfb9b8213bd6284536d64789a24dd73b98b3e33cb47fed8a736464bb62e9e891aa832722dfc28bfa4489b3a127a503e72326b737d0f67c97be6f37ef46154dec39ef8718946ffc8cd4d735a0b101c1722477bbe2f923577ea51f7116f17c3ddf5c497fba2d0bb3272d123b31e9461d4e2d65a42e1174fa269de92e463fc1ca202650fe2628e15341e45dce6c0de2367bdb50cc5b2b462e1d45fc3265f1a88561ab6afb1b73a3b340b5c5fc6e601843a59f3cdeb36991cfa985453287d4c9d2d6e21adddc57a607369c682e821b20dc0efd51d12f386f3f8e53c05e696e50c7c3f79b1b0bd7e5cfaf3f63d8949c8dd2fd94aa0f259a4cb9412c30c45f9d4d63d267d2a43f03a47fa56b3"], 0x1, 0x25c, &(0x7f0000000440)="$eJzs3T9rU1EYB+DXNGlCFzuLwwUXp6JOrkEqiAEhkkEnA9UlFeF2iU75GH4CBz+SH6NTcTliT2zaGkWk8dh7nwfCfeGXP+/JhXsynJP76vbb2cG7ozfpy8cYDKroRixSitiNTmxFdmN57JzW23HeIgCA62Y8ng5L98Df+/QHz6nr4bQXEf2fksnnjTQFAAAAAAAAAADAxq1b/x8n1v8DQJNZ/998dT2c7ix/v11k/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQzklKN9NvHqX7AwCunvkfANrH/A8A7WP+B4D2ef7i5dPhaLQ/rqpBxPFiPplP8jHnj5+M9u9Vp3ZXrzqezydbZ/n9nFcX817sLPMHa/PtuHsn59+zR89Gl/J+HGx++AAAAAAAAAAAAAAAAAAAAPBf2KvOrN3fv9ePX+S5Ovf/AJf273fjVvefDQMAAAAAAAAAAAAAAAAAAACutaP3H2bTw8PXdania8oKtzHrR7lP7y1PxhW9YTws/WUWKaLgGWxg8eMK0Sl3cQIAAAAAAAAAAAAAAAAAgJZZbfot3QkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlLO6///miohYpKz0cAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAG+xYAAP//Wv2bkg==") mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc_mnt\x00', 0x1ed) mount(0x0, &(0x7f0000000200)='./proc_mnt\x00', &(0x7f0000000240)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc_mnt/irq/12/smp_affinity\x00', 0x1, 0x6) write$cgroup_netprio_ifpriomap(r0, &(0x7f00000002c0)=ANY=[], 0xfedd) 40.250186999s ago: executing program 0 (id=1003): r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, 0x0, &(0x7f00000000c0)) 39.694598333s ago: executing program 0 (id=1019): r0 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000a00), 0x4) recvmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)=""/175, 0xaf}], 0x1}, 0x40000001}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r0, &(0x7f0000000dc0)={&(0x7f0000000e00)=@id={0x1e, 0x3, 0x1, {0x4e20}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20000884}, 0x4000044) 39.631914584s ago: executing program 32 (id=1019): r0 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000a00), 0x4) recvmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)=""/175, 0xaf}], 0x1}, 0x40000001}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r0, &(0x7f0000000dc0)={&(0x7f0000000e00)=@id={0x1e, 0x3, 0x1, {0x4e20}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20000884}, 0x4000044) 1.927997174s ago: executing program 1 (id=1566): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast1}, 0x2, 0x0, 0x0, 0xffffffff}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r2, 0x40047452, 0x0) 1.905899344s ago: executing program 1 (id=1568): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x80000) readv(r0, 0x0, 0x0) 1.855599335s ago: executing program 1 (id=1570): bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x5, 0x400, 0x6, 0x25994, 0x1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x3}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000400), 0x77, 0x101301) ioctl$USBDEVFS_CONNECTINFO(r2, 0x80045520, 0x0) 1.634300421s ago: executing program 4 (id=1576): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002ef0afb9fdd672bad09dfb78c7699c74e82fa0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 1.590798312s ago: executing program 4 (id=1577): syz_emit_ethernet(0x4e, &(0x7f0000000b00)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, '\x00', 0x18, 0x11, 0xff, @ipv4={'\x00', '\xff\xff', @remote}, @mcast2, {[], {0x4e1d, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x4, 0x1}}}}}}}, 0x0) 1.567130933s ago: executing program 4 (id=1579): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x1d8, 0x65, 0x200, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x8, 0x2}, {0x0, 0x3}, {0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x1a4, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x1, 0xf}}, @TCA_MATCHALL_ACT={0x188, 0x2, [@m_connmark={0x184, 0xa, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x0, 0xffffffffffffffff, 0x9, 0x4}, 0x7}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x5, 0x8, 0x8, 0x3ff}, 0x3}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5, 0x7, 0x3, 0x1800}, 0x8001}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffffb, 0x2, 0x7, 0x7ff}, 0x2}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x200, 0x2, 0x20000000, 0x4, 0x800}, 0x37}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x71c, 0x4, 0x6, 0x41, 0x7}}}]}, {0xaa, 0x6, "68d5f9b35942b1a9b81011af8ef9f58903979090153440330e71926cf16dfa6a95a63229ec1e046036f5951acc832298a090af5f8dd4c4eda121fe5c11e2758323235d7d4065e102fca2803e8455bbe375423a5083d857379e566a6b55eaa2a53c32659a3eed4669754e022d685f3904836ee46af5a86c45f1a6ba4ad03ce912f0b3be3d485456cdbcd0db56ba63218491a6c93c649f1201f2dcdfb54f743ff852af6a7de13c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x4}}}}]}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x8}}]}}]}, 0x1d8}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000040)="120000001200e7ef007b00000000000000a1", 0x12, 0x4044084, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.498991614s ago: executing program 4 (id=1581): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x80000) readv(r0, 0x0, 0x0) 1.430558146s ago: executing program 4 (id=1583): mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0x1c0) syz_mount_image$ext4(&(0x7f0000000a40)='ext4\x00', &(0x7f0000000a80)='./file0/file0\x00', 0x0, &(0x7f0000000ac0), 0x1, 0xbdb, &(0x7f0000001040)="$eJzs3M1rHOcZAPBnRqsP23JXLqXUvVilFBtK17KLTG0KtYtLLz0U2mvBQl4ZofUHkoorWdBV8g+EJP9ALjkkJsGH+OxLArnmkjjXmBwCJihWAiEkCrMfkiztSpa1q1Hk3w9ezfsxM+/zaKSdeWF3A3hhDWc/0ojjEXEliSg2+tOI6KvVBiKq9f2WlxbGv1laGE9iZeVfXyaRRMSTpYXx5rmSxvZIozEQER/9NYmfv7x53pm5+amxSqU83Wifnr1+6/TM3PwfJq+PXStfK984c+5Po2dHz42cH+1Yrt9+dvH+17/5++fV7976/u5Xr72ZxMUYbIytz6OR9a4Nx/Dq72S9QkSMdeD8+0FPI5/1eSaFbQ5KuxwUAABtpeue4X4ZxeiJtYe3Yrz/ca7BAQAAAB2x0hOxAgAAABxwifU/AAAAHHDN9wE8WVoYb5Z835Gwtx5fioihev7LjVIfKUS1th2I3og4/CSJ9R9rTeqH7dpwRDz69Py7WYkWn0PutupiRPyq1fVPavkPNT4JvTH/NCJGOjD/8Ib2Tyn/ix2YP+/8AXgxPbhUv5Ftvv+lq88/0eL+V2hx73oeed//ms9/y5ue/9by72nz/PfPZ5zjTiFutxvL8v/z/b+90yzZ/Nl2V0ntwOPFiF8XWuWfrOaftMn/yjbnTqJ+iuIPt8vt9sk7/5U3Ik5G6/ybkq2/n+j0xGSlPFL/2XKOxQ9H3243f975Z9f/cJv8t7j+A1nfrafO1P5Lff5z+fK9TZ2N3bfPP/2iL/l3rdbX6Pnf2Ozs9JmIvuQfm/vPbp1vc5/mObL8T/126///Vn//2WtCtfG3kaWy2Nhm7Zc2zPmXu3feaxdPc/2X5/W/uvPrX+t75Rnn+N0Hr57a2Nf8fq3169+sZPM/SuprYQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoSiNiMJK0FBFJrZ6mpVLEkYj4RRxOKzdnZn8/cfO/N65mYxFD0ZtOTFbKIxFRrLeTrH2mVl9rn93Q/mNEHIuI14uHau3S+M3K1byTBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYNWRiBiMJC1FRBoRy8U0LZXyjgoAAADouKG8AwAAAAC6zvofAAAADj7rfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrs2IkHD5OIqF44VCuZvsZYb66RAd2W5h0AkJuevAMAclPIOwAgNztc43tcgAMo2WZ8oGVv9urR35V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANifTh5/8DCJiOqFQ7WS6WuM9bY84sQeRgd0U5p3AEBuerYaLOxdHMDee+5/8aOdjQPYe63X+MCLJNlmfGBtn+rTI/1diwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/WewVpK0FBFprZ6mpVLE0YgYit5kYrJSHomIn0XEJ8Xe/qzdn3fQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdNzM3PzUWKVSnn6eSrK7w1VU2lX+vz/C2NtKUqsM5B1GvZL3KxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHmYmZufGqtUytMzeUcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5G1mbn5qrFIpTz9D5d5Odl5XyTtHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADy82MAAAD//1sCDDY=") openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20a02, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() socket$kcm(0x2, 0x3, 0x2) sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000001c0), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000200), 0x10106, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) sendto$inet(r3, &(0x7f00000002c0), 0xffffffffffffff94, 0x20, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000340)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) 1.364049667s ago: executing program 3 (id=1585): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="540000001400b59500000000000000000a000000", @ANYRES32=r0], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r1, &(0x7f0000000340)=[{0x84, 0x77, 0x0, 0x0, @tick=0xffffff3f, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000380)={0x3d2, @time={0xffffff3f, 0xffffff}, 0x3, {0x1, 0xfc}}) 1.337786068s ago: executing program 3 (id=1586): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f000001a6c0)={0x0, 0x0, &(0x7f000001a700)={&(0x7f000001a740)=@newtaction={0xe6c, 0x30, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [{0xe58, 0x1, [@m_pedit={0xe54, 0x1, 0x0, 0x0, {{0xa}, {0xe28, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x0, 0x1000, 0x4, 0x4, 0x5}, 0x1, 0x2}, [{0xdc8, 0xffffffff, 0x1, 0x4, 0x101, 0x4}, {0x1, 0x7ff, 0x8, 0x0, 0x9, 0x2}, {0x401, 0xfdfffff5, 0x4, 0x8, 0x3, 0x8}, {0xaff, 0x9, 0x4, 0x5, 0x3, 0x983c3b9}, {0x11, 0x7, 0xfffff770, 0x9, 0x8c, 0x80000001}, {0x7, 0x9, 0x1, 0x7f, 0x10001, 0x2}, {0x4, 0xe3e, 0x4f, 0x4, 0x6}, {0x8ce, 0x8, 0x2, 0x4, 0x800, 0x8}, {0x3, 0x4, 0x0, 0x7dad, 0x7f, 0x6}, {0x1, 0x361, 0x7, 0x4, 0x2, 0x3}, {0x797e, 0x9, 0x1, 0xf56, 0x1, 0x8}, {0x5, 0x8, 0xff, 0x4ff537c1, 0x5, 0x5}, {0x4, 0xe8c, 0xcbf, 0x4, 0x4, 0x400}, {0x800, 0x4, 0xd4f7, 0x9, 0x400, 0xffffff00}, {0xffffffff, 0x4, 0xe546, 0x0, 0x300, 0xd789}, {0x5, 0x5, 0x6, 0x1, 0x7fffffff, 0x8}, {0x7fffffff, 0x401, 0x1, 0xffffffff, 0x380000, 0x2}, {0x1, 0x10000, 0xffffffff, 0xffffffff, 0x17a, 0x6}, {0xff, 0x3ff, 0x91c7, 0x6cff, 0x40, 0x2}, {0x5, 0xffffff00, 0x0, 0x7f, 0x4010000, 0x10001}, {0x7, 0x5, 0x0, 0x1, 0x8, 0x4}, {0x6a7, 0x7, 0x5aa2, 0xb97, 0xb1fb, 0x4}, {0x9, 0x7fffffff, 0x6ef1, 0x6, 0x1, 0x5}, {0xd, 0x3, 0xb3b0, 0x4, 0x80000000, 0x1}, {0xb, 0x0, 0x10000, 0x6, 0x5, 0xd}, {0x29, 0x7, 0x2, 0x1c0, 0x3, 0x10}, {0x5, 0x2, 0x401, 0x3, 0x0, 0x7a01}, {0x7, 0x1611c00, 0xfffffff3, 0x10000, 0x9, 0x101}, {0x1, 0x7, 0x4, 0x3, 0x7}, {0x3, 0x3, 0x2, 0x9, 0x6, 0x6}, {0x6bc5896b, 0x1, 0xb7, 0x4, 0x2, 0x9323}, {0x0, 0xfffffff8, 0x1, 0x7, 0xfffffff8, 0x480}, {0xf, 0x7, 0x8, 0x1ff, 0x7, 0x3}, {0x4, 0x5, 0x9, 0x2, 0x2, 0x401}, {0x922e, 0x0, 0x1944, 0x3, 0x9, 0x8}, {0x10001, 0xfffffffa, 0x9, 0x2, 0x3ff, 0xffffffff}, {0x2, 0x1eb8dd6d, 0x5, 0x8, 0x1, 0x6}, {0xa4, 0x7ff, 0xff, 0x1, 0xd1e5}, {0x0, 0x20002, 0x0, 0x8, 0x5, 0x101}, {0x1000005, 0x1, 0x6, 0x7fffffff, 0xa, 0x7}, {0x3, 0x4, 0xadf, 0x10, 0x9, 0x5}, {0x4, 0x2, 0x2, 0x2, 0x7fff, 0x8}, {0x3, 0x8, 0x2, 0x38d9, 0x1, 0x4}, {0x0, 0x824c, 0x1, 0x3, 0xfff, 0xa}, {0x5, 0xc, 0x3, 0x80, 0x9, 0x8}, {0x10001, 0x1, 0x7, 0x4, 0x8, 0x7ff}, {0x7, 0xf34a, 0x9, 0x80000000, 0x2, 0x4}, {0x2, 0xe7, 0x8, 0x80000000, 0x0, 0x8001}, {0xb594, 0x0, 0x2, 0x2000, 0x1, 0x5}, {0x0, 0x5, 0x1, 0xbc, 0x8, 0x1}, {0x3, 0x401, 0x1, 0x6, 0x3, 0x80000001}, {0x7, 0xfff, 0x8, 0xb, 0x8, 0x9d6}, {0x56912219, 0x5, 0x3ff, 0xa000, 0xd0e, 0x7510}, {0xd, 0x5, 0xfffffffc, 0x35ca, 0x1ff, 0x5}, {0x4, 0x0, 0x3fc, 0x5, 0x10, 0x4}, {0x0, 0x37, 0x5, 0x10, 0x1, 0x5f5ace3f}, {0xffffffff, 0xfffffffa, 0x227, 0x7fffffff, 0x8b, 0x2}, {0x7, 0x7, 0x0, 0x2, 0xc407, 0x7}, {0x8001, 0xd1, 0xff4, 0xb, 0x0, 0x1}, {0x6, 0xc, 0xb, 0xe7, 0x7}, {0x3, 0x3, 0xffffff46, 0x8, 0x7, 0x8}, {0x7, 0x6, 0x4b48, 0x8, 0x6, 0x7}, {0xe5f, 0x10000, 0x4, 0x4, 0x9, 0xf1}, {0x401, 0xd, 0x3, 0x1, 0x80000000, 0x1}, {0x400, 0x3, 0xe8ce, 0x1, 0x8, 0x10}, {0x5, 0x8ee9, 0x2, 0x3, 0x0, 0xc}, {0x7, 0x24d476e8, 0x10200, 0x80000001, 0x6, 0x600000}, {0x6a8, 0x8, 0x3, 0xfffffffb, 0x8000, 0x9}, {0xab, 0x7, 0x7, 0x3, 0x5}, {0x0, 0xa8, 0x7fffffff, 0xfffffff8, 0x7d, 0x9}, {0x3c, 0x49da5, 0x10, 0x8, 0x6}, {0x200, 0x6, 0x1, 0x1, 0x9, 0x7f}, {0x8, 0xfffffffa, 0x7e2, 0x7a, 0x6, 0x5}, {0x5e, 0x15ec, 0x1ba09691, 0x5, 0x7fffffff, 0x9}, {0x0, 0x5, 0x1, 0x0, 0xfffffffb, 0x4}, {0x40, 0x3, 0x5, 0x3ff, 0x10000, 0x254}, {0x5, 0xd5, 0x80000000, 0xf, 0x101, 0x5ca}, {0x6, 0x1, 0xf, 0x4, 0x9, 0x3cf1}, {0x7, 0x6000, 0x6, 0xff, 0xd42, 0x100}, {0x1, 0xfffe, 0x9, 0x9, 0x7f, 0x1}, {0xf, 0xb, 0x6, 0x8, 0x402, 0x9}, {0x400, 0xbcb, 0x3, 0x9, 0x16b9, 0x3}, {0x1, 0xffffffff, 0x9, 0x1000, 0x80, 0x6}, {0x800, 0x9, 0xff, 0x7fffffff, 0x0, 0xe5}, {0x4, 0x6, 0x4, 0x3ff, 0x3, 0x1000}, {0x80000000, 0x9, 0x6, 0x2, 0x7, 0x5}, {0x80e0470, 0x0, 0x0, 0x1f, 0x2, 0xffff0001}, {0x9, 0x8, 0x4, 0x1, 0x0, 0xfffffffa}, {0xbb3, 0x7, 0x1, 0x7, 0x94, 0x3}, {0x4a, 0xf, 0x7, 0x3, 0xa3, 0x80000000}, {0x5, 0xfff, 0x20080, 0x9, 0x26, 0x10000}, {0x1, 0xfffffffc, 0x8, 0xffff, 0x0, 0x7}, {0x0, 0x7fffffff, 0x800, 0x6, 0x200f, 0x2}, {0xfffffffb, 0x7, 0x6, 0x8, 0x5, 0x3}, {0x5, 0xcf19, 0x8, 0x0, 0xfff, 0xfffffe00}, {0x2, 0x9, 0x2, 0x4, 0x4, 0x800}, {0xc000, 0x4, 0x807fff, 0x4, 0x1, 0x6}, {0xe37, 0x4, 0x1, 0x6, 0x67b9c8db, 0x4}, {0xac, 0xfffffffe, 0x8f, 0x8001, 0xd, 0x26}, {0xfffff800, 0x7, 0xffffffff, 0x2, 0xaa6, 0xd4}, {0x3, 0xffffc055, 0x5b6, 0x8, 0xa9, 0x63e}, {0x8, 0xfffffff8, 0xb, 0x7fd1, 0x100006, 0x1750e18e}, {0x1000, 0x2, 0x1000, 0x6, 0x6887, 0x4}, {0x80000001, 0x5, 0x89bf, 0xc, 0x0, 0x5}, {0x1, 0x18, 0x190, 0x8, 0xc}, {0x41e2e32, 0x6, 0x6, 0x2, 0x0, 0x4}, {0x0, 0x2, 0x5e, 0x1000, 0x6, 0x8}, {0x7, 0x80000000, 0x20000, 0x0, 0x7fffffff}, {0x2, 0x8001, 0x6, 0x3, 0x8, 0xfffffff7}, {0xe20, 0xc, 0x7, 0x9, 0x9, 0x20000009}, {0x6, 0x1000, 0x3, 0xfffffffb, 0x5267, 0x401}, {0x9a, 0x3, 0x8, 0xfffffff9, 0x2, 0x9}, {0x1, 0x8, 0xfffffffc, 0x1}, {0xac5a, 0xfffffffd, 0xa, 0x59f3, 0x2, 0x8}, {0x5, 0xeae, 0x5, 0xc1, 0x2e, 0x8}, {0x7fffffff, 0x9, 0x0, 0xfff, 0x3, 0x10}, {0x80000000, 0x9, 0x8211, 0x800, 0xace, 0xfffffff7}, {0x10000, 0x1e9d, 0xffff8d98, 0xe, 0xfffffffa}, {0x394cf3a4, 0x288, 0x7}, {0x6, 0xf4, 0x9, 0x3, 0x7fff, 0xf}, {0x10001, 0x8, 0x7, 0x2fe, 0x9, 0x4}, {0x7fffffff, 0x1, 0xb, 0x8af, 0x10001, 0xffffff47}, {0x6, 0x6, 0x2, 0x4, 0x0, 0xe}, {0x1, 0x5, 0x9a4, 0x8, 0x8000, 0xfffffbff}, {0x3718, 0x1000000, 0x43, 0x0, 0x46, 0x200}, {0x8, 0x9, 0xffffa3fa, 0x7, 0xcb88, 0x6}, {0x1, 0x4, 0x5, 0x6, 0x2, 0xfffffff9}, {0x5, 0xffffffff, 0x61b, 0x4, 0x4, 0x100}], [{0x4, 0x1}, {0x5}, {0x2, 0x1}, {0x3}, {0x5}, {0x0, 0x1}, {0x5}, {0x2, 0x1}, {}, {0x4, 0x1}, {0x2, 0x1}, {}, {0x4}, {0x5, 0x1}, {0x3, 0x1}, {0x2}, {0x1, 0x1}, {0x3}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x4}, {0x2, 0x1}, {0x1}, {0x3, 0x1}, {0x5}, {0x4}, {0x1, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x5}, {0x2}, {0x2}, {0x0, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {}, {}, {}, {0x5}, {0x1, 0x1}, {0x2}, {0x1, 0x1}, {0x2}, {0x2, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x1}, {}, {0x2, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x3}, {0x2}, {0x3}, {0xdcba8b0d8bd78aa4}, {0x2, 0x1}, {0xac098f8bb5bf767, 0x1}, {}, {0x5, 0x2}, {0x0, 0x1}, {0x4}, {0x4, 0x1}, {0x4, 0x1}, {0x1}, {0x4, 0x33b46010c087959a}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x0, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {}, {0x2}, {0x3}, {0xe41e256834d3e794}, {0x2}, {0xdf8910d898f3408a, 0x1}, {0x0, 0x1}, {0x2}, {0x4, 0x1}, {0x2, 0x1}, {0x3}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x4, 0x1}, {0x3}, {0x4, 0x1}, {0xbbd25ed3eb5771ef}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x1}, {0x2}, {0x5}, {0x2, 0x1}, {0x4}, {0x3, 0x3}, {0x5, 0x1}, {0x3, 0x1}, {0x3}, {0x5}, {0x3}, {0x1, 0x1}, {0x1}, {0x1, 0x1}, {0x5, 0x2}, {0x2}, {0x2, 0x1}, {0x3}, {0x6, 0x1}, {0x5, 0x1}, {}, {}, {0x5}, {0x1}, {0x4}, {0x1}, {0x3}, {}, {}, {0x3, 0xcf7dcf0528e1043}, {0x4}, {0x4, 0x1}, {0x0, 0x1}, {0x1, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x4}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0xe6c}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) 1.303339849s ago: executing program 3 (id=1587): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4004000}, 0x850) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002ef0afb9fdd672bad09dfb78c7699c74e82fa0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 1.286440509s ago: executing program 3 (id=1588): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0xc, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x84}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r2}, 0x14) syz_emit_ethernet(0xfe0, &(0x7f0000000300)=ANY=[], 0x0) 937.731428ms ago: executing program 1 (id=1590): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setresuid(0xee01, 0x0, 0x0) setresuid(0xee00, 0x0, 0x0) 871.06051ms ago: executing program 3 (id=1594): r0 = socket(0xa, 0x800, 0x9) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x2000200, &(0x7f0000000080), 0x7, 0x504, &(0x7f0000001100)="$eJzs3E9sVMcdAODfe15jA6a4lNLi0mJKq1qtaoOhhUOliqqVemilKOSQHC3bIOIFR7YjxRaCRYrIMULKNYpyzDWHXJMol4RTpFzJMRckFHEBctro7b5d767Xi/+tHezvk9aemZ19M7Pz5u28Ga8D2LOGsx9JxEBEPIiIwxGRtmYYrv56+vjm5LPHNyejVC5f/j7JXhZPsnguqfxM42AeGUkj0reT2hNN5heXZnqjOD2Xx8cWrr8xNr+49Ndr1yeuTl+dvjF+8eL5c2cv/H38b+tvVJvysnY9Gbo1e+L4f1+79//JQi29P//d2I6tMhzD7apS8cetLmyHHWoIJ4VOOf/Z/cqwZtn5n3VXb2X8H46e6Nh5wC5SLpfLfas/XSq3urMiBXhhJdHp2XT7KgJss9oHfXb/W3u0mwjs6870Y8c9ulS9Acra/TR/RJysJKYRMZLfwB/qUvnDUYhXSz98kD2yeKEL6xAAAI0+u1SbCbbM/wYjjjXk+1m+hzIYET+PiCMR8YuIOBoRv4xq3l9FxK9bjt8TEeUO5Q+3xFfOP9OHm2thZ9n87x/53tby/C8ad8EGe/LYoYjahHn6TP6ejERv35VrxemzHcr4/N/fvLsyNSlF3v7a/C97ZOXX5oJ5PR4WWhbopiYWJjbX6mWP7kQMFVrbnxQikvpOQDYFPh4RQ1+8v+bjDjaEr/35oxP1SG9zvue3v+Krk+0K2YKtivKHEX+q9n8pmvp/eecu6bw/OdYfxekzY9lZcKZtGfe/vvtSS1L94M9t/yfftR7uPxc+vZyPrM3L+v9Aw/mfpR1sruJgEpHMLy7NTBSL03Pzqxzo9upl3P32nVXvaTZ6/u9LXqmEa/elb00sLMydjdiX/G9l+vjya2vx7HeUqu0fOd1+/B/JX5O9E7+JiOwk/m1E/C6qd4jDUb59KiJ+HxGnV29+fPmvP7y+8fZ3V9b+qbbXv6b+j+X+X1yayVLnmlImitXLWcRySj3QM3PqwbOh9uWvrf/PV0IjeUr761/StNW+shbtA5t8+wAAAOCFkEbEQMNa0kCk6ehodQ3oaBxIi7PzC39JZt+8MVX9jsBgQ97qenBvUlv/HGyIj7fEz+Xrxu/17K/ERydni1M71Gag6mBlzCfpaP1akKajtS/FbM0SM/BT5is/sHc9b/wfu7dNFQG2nc9/2KvmbjVESqtkKvlLGdid1vL5by0Qdqd247/D33O7YYBdomw4w562nvFfaPr3jvcPd6M+wPYpxMv1cLqjNQG2m/k/7Elr+pL8hgPlvvZP9cfKzNHf+YA9sbFq7G9T1o4EspnVjpS+fyOvqv03hVXzRLq+A/ZFPVA/8kb69Mqm35a0Cyd/Od8fW0PmvvUc+eNtGaftAp2vG+MD3bgaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbL0fAwAA//+1kNRC") sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r0, &(0x7f0000000c40)={&(0x7f0000000240), 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x14, 0x0, 0x4, 0x70bd25, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x404c880}, 0x40) r1 = openat(0xffffffffffffff9c, &(0x7f0000001640)='.\x00', 0x0, 0xa) ioctl$FITRIM(r1, 0x40e8662e, &(0x7f0000001680)={0xc362, 0x80, 0x7}) syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_create_resource$futex(&(0x7f0000000e00)=0x1) futex(r2, 0xd, 0x2, 0x0, 0x0, 0x2) futex(r2, 0x5, 0x2, 0x0, r2, 0x1) capset(&(0x7f00000000c0)={0x20080522}, &(0x7f0000000140)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) 664.116914ms ago: executing program 5 (id=1597): setns(0xc9, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) write(r0, &(0x7f0000001280)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000000", 0x29) 663.958204ms ago: executing program 5 (id=1598): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4004000}, 0x850) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002ef0afb9fdd672bad09dfb78c7699c74e82fa0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 652.335235ms ago: executing program 5 (id=1599): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = epoll_create1(0x0) r2 = fcntl$dupfd(r0, 0x0, r1) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000280)={0x10000014}) 611.554605ms ago: executing program 5 (id=1600): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x1, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) recvmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)=""/65, 0x41}], 0x1}}], 0x2, 0x0, 0x0) 581.305866ms ago: executing program 4 (id=1601): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r0, 0x890b, &(0x7f00000014c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0') bind$x25(r0, &(0x7f0000001500), 0x12) connect$x25(r0, &(0x7f0000001540)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) 485.081789ms ago: executing program 3 (id=1603): bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x5, 0x400, 0x6, 0x25994, 0x1, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x3}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000400), 0x77, 0x101301) ioctl$USBDEVFS_CONNECTINFO(r2, 0x80045520, 0x0) 302.192983ms ago: executing program 2 (id=1607): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x1d8, 0x65, 0x200, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x8, 0x2}, {0x0, 0x3}, {0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x1a4, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x1, 0xf}}, @TCA_MATCHALL_ACT={0x188, 0x2, [@m_connmark={0x184, 0xa, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x0, 0xffffffffffffffff, 0x9, 0x4}, 0x7}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x5, 0x8, 0x8, 0x3ff}, 0x3}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5, 0x7, 0x3, 0x1800}, 0x8001}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffffb, 0x2, 0x7, 0x7ff}, 0x2}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x200, 0x2, 0x20000000, 0x4, 0x800}, 0x37}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x71c, 0x4, 0x6, 0x41, 0x7}}}]}, {0xaa, 0x6, "68d5f9b35942b1a9b81011af8ef9f58903979090153440330e71926cf16dfa6a95a63229ec1e046036f5951acc832298a090af5f8dd4c4eda121fe5c11e2758323235d7d4065e102fca2803e8455bbe375423a5083d857379e566a6b55eaa2a53c32659a3eed4669754e022d685f3904836ee46af5a86c45f1a6ba4ad03ce912f0b3be3d485456cdbcd0db56ba63218491a6c93c649f1201f2dcdfb54f743ff852af6a7de13c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x4}}}}]}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x8}}]}}]}, 0x1d8}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000040)="120000001200e7ef007b00000000000000a1", 0x12, 0x4044084, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 301.038843ms ago: executing program 5 (id=1617): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x1, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=@tcp6=r0}, 0x20) recvmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)=""/65, 0x41}], 0x1}}], 0x2, 0x0, 0x0) 252.694454ms ago: executing program 2 (id=1608): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ba3000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f00005e9000/0x1000)=nil, &(0x7f0000a18000/0x2000)=nil, &(0x7f00007fc000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0xfffffffffffffcd7) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, 0x0, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = io_uring_setup(0x1b7e, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x7, @local, 0xa}, 0xffffffffffffffcd) io_uring_enter(r0, 0x8af, 0x6933, 0x1f, 0x0, 0x0) 184.004106ms ago: executing program 2 (id=1609): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4004000}, 0x850) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002ef0afb9fdd672bad09dfb78c7699c74e82fa0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 183.794366ms ago: executing program 2 (id=1610): bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x1, 0xe, &(0x7f0000000980)=ANY=[@ANYBLOB="b7000000ff020100bfa30000000000000703000018feffff720aa9fff8ffffff71a4a9ff0000000072030200000000131d400500000000004704000001ed00006b030000000000001d440000000000007a0a00fe00ffffffc303000010010000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7109000000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a1074649c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c0dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6acdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e50002a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de5c028d6112a0c2d21b2dc98814106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c53218294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb118888876b617398d00a7526103ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fed000000007baa5b6a686b50f0937f778af083e08b7ab6cd9c65ba55f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddc42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293d364b9effa9a9406ac2683e231d4774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479517dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a79e59e1712c8c546768e5722da19fcdb4c2890cda1f96b952511e3a49d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767987d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca485683252b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c32040098e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a0032f37ff559be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1be62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee07751532d5e7d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070f66b2b388f0f744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e2fa3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef907000000f01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e015cb56119df72c7533a48d028a3a981463f25c068d4410dad0c74e2a9478fa3be18a1a27bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb581012fd7a8139166fd5e59c84f4ab07001b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe293308b2a146f12a4c205235924cee765d94b1cc06641247c773ab8d1abbeb03ea68"], &(0x7f0000001380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000013c0), 0x0, 0x10, &(0x7f0000001400), 0xffffffffffffff11, 0x0, 0xffffffffffffffff, 0xfffffffffffffea5}, 0x48) 180.613256ms ago: executing program 2 (id=1611): mq_notify(0xffffffffffffffff, &(0x7f0000000780)={0x110c230000, 0x810001, 0x0, @thr={0x0, 0x0}}) 159.563127ms ago: executing program 2 (id=1612): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3, 0x6, 0x7, 0x200, 0x4, 0x8, 0x8ed, 0x10, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8810) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000600)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xffe0}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4890) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000700)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@getqdisc={0x24, 0x25, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xb}, {0xa, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x200080f1}, 0x4008000) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000000800)={'syzkaller0\x00', @random="2b0100004ec6"}) 100.347558ms ago: executing program 5 (id=1613): mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0x1c0) syz_mount_image$ext4(&(0x7f0000000a40)='ext4\x00', &(0x7f0000000a80)='./file0/file0\x00', 0x0, &(0x7f0000000ac0), 0x1, 0xbdb, &(0x7f0000001040)="$eJzs3M1rHOcZAPBnRqsP23JXLqXUvVilFBtK17KLTG0KtYtLLz0U2mvBQl4ZofUHkoorWdBV8g+EJP9ALjkkJsGH+OxLArnmkjjXmBwCJihWAiEkCrMfkiztSpa1q1Hk3w9ezfsxM+/zaKSdeWF3A3hhDWc/0ojjEXEliSg2+tOI6KvVBiKq9f2WlxbGv1laGE9iZeVfXyaRRMSTpYXx5rmSxvZIozEQER/9NYmfv7x53pm5+amxSqU83Wifnr1+6/TM3PwfJq+PXStfK984c+5Po2dHz42cH+1Yrt9+dvH+17/5++fV7976/u5Xr72ZxMUYbIytz6OR9a4Nx/Dq72S9QkSMdeD8+0FPI5/1eSaFbQ5KuxwUAABtpeue4X4ZxeiJtYe3Yrz/ca7BAQAAAB2x0hOxAgAAABxwifU/AAAAHHDN9wE8WVoYb5Z835Gwtx5fioihev7LjVIfKUS1th2I3og4/CSJ9R9rTeqH7dpwRDz69Py7WYkWn0PutupiRPyq1fVPavkPNT4JvTH/NCJGOjD/8Ib2Tyn/ix2YP+/8AXgxPbhUv5Ftvv+lq88/0eL+V2hx73oeed//ms9/y5ue/9by72nz/PfPZ5zjTiFutxvL8v/z/b+90yzZ/Nl2V0ntwOPFiF8XWuWfrOaftMn/yjbnTqJ+iuIPt8vt9sk7/5U3Ik5G6/ybkq2/n+j0xGSlPFL/2XKOxQ9H3243f975Z9f/cJv8t7j+A1nfrafO1P5Lff5z+fK9TZ2N3bfPP/2iL/l3rdbX6Pnf2Ozs9JmIvuQfm/vPbp1vc5/mObL8T/126///Vn//2WtCtfG3kaWy2Nhm7Zc2zPmXu3feaxdPc/2X5/W/uvPrX+t75Rnn+N0Hr57a2Nf8fq3169+sZPM/SuprYQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoSiNiMJK0FBFJrZ6mpVLEkYj4RRxOKzdnZn8/cfO/N65mYxFD0ZtOTFbKIxFRrLeTrH2mVl9rn93Q/mNEHIuI14uHau3S+M3K1byTBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYNWRiBiMJC1FRBoRy8U0LZXyjgoAAADouKG8AwAAAAC6zvofAAAADj7rfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrs2IkHD5OIqF44VCuZvsZYb66RAd2W5h0AkJuevAMAclPIOwAgNztc43tcgAMo2WZ8oGVv9urR35V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANifTh5/8DCJiOqFQ7WS6WuM9bY84sQeRgd0U5p3AEBuerYaLOxdHMDee+5/8aOdjQPYe63X+MCLJNlmfGBtn+rTI/1diwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/WewVpK0FBFprZ6mpVLE0YgYit5kYrJSHomIn0XEJ8Xe/qzdn3fQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdNzM3PzUWKVSnn6eSrK7w1VU2lX+vz/C2NtKUqsM5B1GvZL3KxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHmYmZufGqtUytMzeUcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5G1mbn5qrFIpTz9D5d5Odl5XyTtHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADy82MAAAD//1sCDDY=") openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20a02, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() socket$kcm(0x2, 0x3, 0x2) sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000001c0), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000200), 0x10106, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000300)='bbr', 0x3) recvfrom$inet(r3, &(0x7f0000000340)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) 69.328919ms ago: executing program 1 (id=1614): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f0000000280)={0x1}, 0x8) sendmmsg$sock(r0, &(0x7f00000002c0)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)="5bd4c339", 0x4}], 0x1, &(0x7f0000000380)=[@timestamping={{0x14, 0x1, 0x25, 0x101}}], 0x18}}], 0x1, 0x0) 0s ago: executing program 1 (id=1615): mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0x1c0) syz_mount_image$ext4(&(0x7f0000000a40)='ext4\x00', &(0x7f0000000a80)='./file0/file0\x00', 0x0, &(0x7f0000000ac0), 0x1, 0xbdb, &(0x7f0000001040)="$eJzs3M1rHOcZAPBnRqsP23JXLqXUvVilFBtK17KLTG0KtYtLLz0U2mvBQl4ZofUHkoorWdBV8g+EJP9ALjkkJsGH+OxLArnmkjjXmBwCJihWAiEkCrMfkiztSpa1q1Hk3w9ezfsxM+/zaKSdeWF3A3hhDWc/0ojjEXEliSg2+tOI6KvVBiKq9f2WlxbGv1laGE9iZeVfXyaRRMSTpYXx5rmSxvZIozEQER/9NYmfv7x53pm5+amxSqU83Wifnr1+6/TM3PwfJq+PXStfK984c+5Po2dHz42cH+1Yrt9+dvH+17/5++fV7976/u5Xr72ZxMUYbIytz6OR9a4Nx/Dq72S9QkSMdeD8+0FPI5/1eSaFbQ5KuxwUAABtpeue4X4ZxeiJtYe3Yrz/ca7BAQAAAB2x0hOxAgAAABxwifU/AAAAHHDN9wE8WVoYb5Z835Gwtx5fioihev7LjVIfKUS1th2I3og4/CSJ9R9rTeqH7dpwRDz69Py7WYkWn0PutupiRPyq1fVPavkPNT4JvTH/NCJGOjD/8Ib2Tyn/ix2YP+/8AXgxPbhUv5Ftvv+lq88/0eL+V2hx73oeed//ms9/y5ue/9by72nz/PfPZ5zjTiFutxvL8v/z/b+90yzZ/Nl2V0ntwOPFiF8XWuWfrOaftMn/yjbnTqJ+iuIPt8vt9sk7/5U3Ik5G6/ybkq2/n+j0xGSlPFL/2XKOxQ9H3243f975Z9f/cJv8t7j+A1nfrafO1P5Lff5z+fK9TZ2N3bfPP/2iL/l3rdbX6Pnf2Ozs9JmIvuQfm/vPbp1vc5/mObL8T/126///Vn//2WtCtfG3kaWy2Nhm7Zc2zPmXu3feaxdPc/2X5/W/uvPrX+t75Rnn+N0Hr57a2Nf8fq3169+sZPM/SuprYQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoSiNiMJK0FBFJrZ6mpVLEkYj4RRxOKzdnZn8/cfO/N65mYxFD0ZtOTFbKIxFRrLeTrH2mVl9rn93Q/mNEHIuI14uHau3S+M3K1byTBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYNWRiBiMJC1FRBoRy8U0LZXyjgoAAADouKG8AwAAAAC6zvofAAAADj7rfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrs2IkHD5OIqF44VCuZvsZYb66RAd2W5h0AkJuevAMAclPIOwAgNztc43tcgAMo2WZ8oGVv9urR35V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANifTh5/8DCJiOqFQ7WS6WuM9bY84sQeRgd0U5p3AEBuerYaLOxdHMDee+5/8aOdjQPYe63X+MCLJNlmfGBtn+rTI/1diwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/WewVpK0FBFprZ6mpVLE0YgYit5kYrJSHomIn0XEJ8Xe/qzdn3fQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdNzM3PzUWKVSnn6eSrK7w1VU2lX+vz/C2NtKUqsM5B1GvZL3KxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHmYmZufGqtUytMzeUcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5G1mbn5qrFIpTz9D5d5Odl5XyTtHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADy82MAAAD//1sCDDY=") openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20a02, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() socket$kcm(0x2, 0x3, 0x2) sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000001c0), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000200), 0x10106, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) sendto$inet(r3, &(0x7f00000002c0), 0xffffffffffffff94, 0x15, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000300)='bbr', 0x3) recvfrom$inet(r3, &(0x7f0000000340)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) kernel console output (not intermixed with test programs): DRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.332468][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.334783][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.339101][ T4334] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.341515][ T4328] device veth1_macvtap entered promiscuous mode [ 33.366987][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.370936][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.372673][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.374416][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.377742][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.379645][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.381912][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.383711][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.405763][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 33.407307][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.409552][ T4329] device veth0_vlan entered promiscuous mode [ 33.412128][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.413447][ T1737] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.415259][ T1737] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.421794][ T4333] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.426000][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 33.427499][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.436889][ T4335] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.439926][ T4328] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.441677][ T4328] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.443316][ T4328] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.445001][ T4328] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.450143][ T4329] device veth1_vlan entered promiscuous mode [ 33.462649][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.464466][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.466232][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.495848][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.497737][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.500897][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.503658][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.506080][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.507679][ T4333] device veth0_vlan entered promiscuous mode [ 33.516624][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.519198][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.538933][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.540714][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.548506][ T1737] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.550415][ T1737] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.554495][ T4329] device veth0_macvtap entered promiscuous mode [ 33.557911][ T4333] device veth1_vlan entered promiscuous mode [ 33.574008][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.576041][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.577749][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.580658][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.582470][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.584193][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.585812][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.587477][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.589230][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.593007][ T4329] device veth1_macvtap entered promiscuous mode [ 33.603065][ T4334] device veth0_vlan entered promiscuous mode [ 33.607358][ T4335] device veth0_vlan entered promiscuous mode [ 33.610919][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.612257][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.614361][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.617954][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.630115][ T4333] device veth0_macvtap entered promiscuous mode [ 33.640456][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.642479][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.645525][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.647724][ T4333] device veth1_macvtap entered promiscuous mode [ 33.654665][ T4335] device veth1_vlan entered promiscuous mode [ 33.661809][ T4334] device veth1_vlan entered promiscuous mode [ 33.670058][ T1615] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.670230][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.671563][ T1615] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.673293][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.677036][ T4329] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.681660][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.683524][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.685152][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.686749][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.689700][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.691353][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.693003][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.694756][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.700847][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.702680][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.705492][ T4329] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.714161][ T4335] device veth0_macvtap entered promiscuous mode [ 33.716088][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.720528][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.722435][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.724221][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.725884][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.737025][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.739060][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.740731][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.742561][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.745214][ T4333] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.747706][ T4329] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.749876][ T4329] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.751481][ T4329] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.753054][ T4329] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.756208][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.757968][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.763160][ T4335] device veth1_macvtap entered promiscuous mode [ 33.769493][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.771206][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.772823][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.774449][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.776836][ T4333] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.787129][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.789280][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.790969][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.802207][ T4335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.805570][ T4335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.807324][ T4335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.812687][ T4335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.814309][ T4335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.817233][ T4335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.820905][ T4335] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.823512][ T4333] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.825115][ T4333] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.826718][ T4333] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.832141][ T4333] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.835539][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.837562][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.867821][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.870174][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.877076][ T4334] device veth0_macvtap entered promiscuous mode [ 33.882301][ T4334] device veth1_macvtap entered promiscuous mode [ 33.891577][ T4335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.893423][ T4335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.895186][ T4335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.897240][ T4335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.899628][ T4335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.901558][ T4335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.904333][ T4335] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.905673][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.907602][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.913766][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.915617][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.926419][ T4335] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.928057][ T4335] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.930301][ T4335] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.931816][ T4335] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.936969][ T1615] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.938524][ T1615] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.941213][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.963470][ T4334] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.965496][ T4334] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.967365][ T4334] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.971834][ T4334] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.973638][ T4334] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.975340][ T4334] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.976935][ T4334] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.980037][ T4334] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.983151][ T4334] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.988959][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.991037][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.031052][ T4334] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.032995][ T4334] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.034630][ T4334] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.036695][ T4334] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.042395][ T4334] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.044316][ T4334] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.046077][ T4334] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.047916][ T4334] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.053584][ T4334] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.060240][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.062122][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.072743][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.074365][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.076013][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.105461][ T4449] netlink: 100 bytes leftover after parsing attributes in process `syz.3.8'. [ 34.107505][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.109713][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.112853][ T4334] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.114487][ T4334] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.116011][ T4334] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.117537][ T4334] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.119526][ T4449] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8'. [ 34.119911][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.122547][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.129619][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.131414][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.154160][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.155766][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.157460][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.166155][ T4451] FAULT_INJECTION: forcing a failure. [ 34.166155][ T4451] name failslab, interval 1, probability 0, space 0, times 1 [ 34.170959][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.171883][ T4451] CPU: 0 PID: 4451 Comm: syz.3.9 Not tainted syzkaller #0 [ 34.172375][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.173665][ T4451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 34.175054][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.176769][ T4451] Call trace: [ 34.178652][ T4451] dump_backtrace+0x1c4/0x1f0 [ 34.179531][ T4451] show_stack+0x2c/0x3c [ 34.180324][ T4451] __dump_stack+0x30/0x40 [ 34.181139][ T4451] dump_stack_lvl+0xf4/0x15c [ 34.181993][ T4451] dump_stack+0x1c/0x5c [ 34.182771][ T4451] should_fail_ex+0x3cc/0x524 [ 34.183649][ T4451] __should_failslab+0xc0/0x11c [ 34.184552][ T4451] should_failslab+0x10/0x28 [ 34.185417][ T4451] __kmem_cache_alloc_node+0x7c/0x318 [ 34.186395][ T4451] __kmalloc+0xc4/0x180 [ 34.187132][ T4451] security_sk_alloc+0x54/0x140 [ 34.188012][ T4451] sk_prot_alloc+0xe0/0x1e8 [ 34.188820][ T4451] sk_alloc+0x44/0x3a0 [ 34.189566][ T4451] pfkey_create+0xcc/0x520 [ 34.190369][ T4451] __sock_create+0x448/0x8a8 [ 34.191201][ T4451] __sys_socket+0xc0/0x1b0 [ 34.191999][ T4451] __arm64_sys_socket+0x7c/0x94 [ 34.192882][ T4451] invoke_syscall+0x98/0x290 [ 34.193708][ T4451] el0_svc_common+0x13c/0x258 [ 34.194554][ T4451] do_el0_svc+0x5c/0x134 [ 34.195343][ T4451] el0_svc+0x58/0x12c [ 34.196134][ T4451] el0t_64_sync_handler+0x84/0xf0 [ 34.197042][ T4451] el0t_64_sync+0x18c/0x190 [ 34.268527][ T4345] Bluetooth: hci0: command 0x041b tx timeout [ 34.269691][ T4345] Bluetooth: hci1: command 0x041b tx timeout [ 34.273222][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.274757][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.276302][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.338395][ T4330] Bluetooth: hci3: command 0x041b tx timeout [ 34.339553][ T4330] Bluetooth: hci4: command 0x041b tx timeout [ 34.348429][ T4345] Bluetooth: hci2: command 0x041b tx timeout [ 34.356106][ T4458] tipc: Started in network mode [ 34.357097][ T4458] tipc: Node identity daa2a46daf28, cluster identity 4711 [ 34.363906][ T4458] tipc: Enabled bearer , priority 0 [ 34.369573][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.371103][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.372669][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.407771][ T4466] device syzkaller0 entered promiscuous mode [ 34.463799][ T4469] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11'. [ 34.480179][ T4472] FAULT_INJECTION: forcing a failure. [ 34.480179][ T4472] name failslab, interval 1, probability 0, space 0, times 0 [ 34.488673][ T4472] CPU: 0 PID: 4472 Comm: syz.4.5 Not tainted syzkaller #0 [ 34.490022][ T4472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 34.491806][ T4472] Call trace: [ 34.492367][ T4472] dump_backtrace+0x1c4/0x1f0 [ 34.493250][ T4472] show_stack+0x2c/0x3c [ 34.494124][ T4472] __dump_stack+0x30/0x40 [ 34.494941][ T4472] dump_stack_lvl+0xf4/0x15c [ 34.495752][ T4472] dump_stack+0x1c/0x5c [ 34.496543][ T4472] should_fail_ex+0x3cc/0x524 [ 34.497412][ T4472] __should_failslab+0xc0/0x11c [ 34.498333][ T4472] should_failslab+0x10/0x28 [ 34.499194][ T4472] __kmem_cache_alloc_node+0x7c/0x318 [ 34.500169][ T4472] __kmalloc+0xc4/0x180 [ 34.500936][ T4472] public_key_verify_signature+0x284/0xb30 [ 34.501945][ T4472] x509_check_for_self_signed+0x2dc/0x3c0 [ 34.502980][ T4472] x509_cert_parse+0x4d8/0x6e0 [ 34.503856][ T4472] x509_key_preparse+0x74/0x5c8 [ 34.504747][ T4472] asymmetric_key_preparse+0xcc/0x17c [ 34.505682][ T4472] key_create_or_update+0x394/0x868 [ 34.506561][ T4472] __arm64_sys_add_key+0x40c/0x520 [ 34.507444][ T4472] invoke_syscall+0x98/0x290 [ 34.508261][ T4472] el0_svc_common+0x13c/0x258 [ 34.509080][ T4472] do_el0_svc+0x5c/0x134 [ 34.509825][ T4472] el0_svc+0x58/0x12c [ 34.510530][ T4472] el0t_64_sync_handler+0x84/0xf0 [ 34.511401][ T4472] el0t_64_sync+0x18c/0x190 [ 34.521225][ T4476] Zero length message leads to an empty skb [ 34.527770][ T4476] FAULT_INJECTION: forcing a failure. [ 34.527770][ T4476] name failslab, interval 1, probability 0, space 0, times 0 [ 34.530194][ T4476] CPU: 0 PID: 4476 Comm: syz.2.12 Not tainted syzkaller #0 [ 34.531340][ T4476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 34.532916][ T4476] Call trace: [ 34.533487][ T4476] dump_backtrace+0x1c4/0x1f0 [ 34.534291][ T4476] show_stack+0x2c/0x3c [ 34.535033][ T4476] __dump_stack+0x30/0x40 [ 34.535805][ T4476] dump_stack_lvl+0xf4/0x15c [ 34.536630][ T4476] dump_stack+0x1c/0x5c [ 34.537379][ T4476] should_fail_ex+0x3cc/0x524 [ 34.538231][ T4476] __should_failslab+0xc0/0x11c [ 34.539119][ T4476] should_failslab+0x10/0x28 [ 34.539985][ T4476] kmem_cache_alloc+0x88/0x310 [ 34.540859][ T4476] getname_flags+0xb8/0x458 [ 34.541651][ T4476] getname+0x28/0x38 [ 34.542360][ T4476] do_sys_openat2+0xdc/0x3fc [ 34.543187][ T4476] __arm64_sys_openat+0x11c/0x150 [ 34.544080][ T4476] invoke_syscall+0x98/0x290 [ 34.544905][ T4476] el0_svc_common+0x13c/0x258 [ 34.545734][ T4476] do_el0_svc+0x5c/0x134 [ 34.546475][ T4476] el0_svc+0x58/0x12c [ 34.547187][ T4476] el0t_64_sync_handler+0x84/0xf0 [ 34.548088][ T4476] el0t_64_sync+0x18c/0x190 [ 34.579244][ T4458] tipc: Resetting bearer [ 34.591874][ T4457] tipc: Resetting bearer [ 34.643417][ T4457] tipc: Disabling bearer [ 34.759398][ T4499] FAULT_INJECTION: forcing a failure. [ 34.759398][ T4499] name failslab, interval 1, probability 0, space 0, times 0 [ 34.761644][ T4499] CPU: 0 PID: 4499 Comm: syz.4.19 Not tainted syzkaller #0 [ 34.762884][ T4499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 34.764632][ T4499] Call trace: [ 34.765210][ T4499] dump_backtrace+0x1c4/0x1f0 [ 34.766029][ T4499] show_stack+0x2c/0x3c [ 34.766777][ T4499] __dump_stack+0x30/0x40 [ 34.767606][ T4499] dump_stack_lvl+0xf4/0x15c [ 34.768592][ T4499] dump_stack+0x1c/0x5c [ 34.769467][ T4499] should_fail_ex+0x3cc/0x524 [ 34.770422][ T4499] __should_failslab+0xc0/0x11c [ 34.771404][ T4499] should_failslab+0x10/0x28 [ 34.772324][ T4499] kmem_cache_alloc+0x88/0x310 [ 34.773234][ T4499] security_inode_alloc+0x38/0x11c [ 34.774191][ T4499] inode_init_always+0x6c8/0xb28 [ 34.775111][ T4499] new_inode_pseudo+0x7c/0x1cc [ 34.776004][ T4499] __sock_create+0x138/0x8a8 [ 34.776812][ T4499] __sys_socket+0xc0/0x1b0 [ 34.777577][ T4499] __arm64_sys_socket+0x7c/0x94 [ 34.778424][ T4499] invoke_syscall+0x98/0x290 [ 34.779252][ T4499] el0_svc_common+0x13c/0x258 [ 34.780121][ T4499] do_el0_svc+0x5c/0x134 [ 34.780875][ T4499] el0_svc+0x58/0x12c [ 34.781572][ T4499] el0t_64_sync_handler+0x84/0xf0 [ 34.782450][ T4499] el0t_64_sync+0x18c/0x190 [ 34.828821][ T4499] socket: no more sockets [ 35.322941][ T4519] FAULT_INJECTION: forcing a failure. [ 35.322941][ T4519] name failslab, interval 1, probability 0, space 0, times 0 [ 35.325254][ T4519] CPU: 0 PID: 4519 Comm: syz.4.24 Not tainted syzkaller #0 [ 35.326416][ T4519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 35.328414][ T4519] Call trace: [ 35.329081][ T4519] dump_backtrace+0x1c4/0x1f0 [ 35.330108][ T4519] show_stack+0x2c/0x3c [ 35.330955][ T4519] __dump_stack+0x30/0x40 [ 35.331797][ T4519] dump_stack_lvl+0xf4/0x15c [ 35.332703][ T4519] dump_stack+0x1c/0x5c [ 35.333552][ T4519] should_fail_ex+0x3cc/0x524 [ 35.334456][ T4519] __should_failslab+0xc0/0x11c [ 35.335474][ T4519] should_failslab+0x10/0x28 [ 35.336358][ T4519] kmem_cache_alloc+0x88/0x310 [ 35.337291][ T4519] getname_flags+0xb8/0x458 [ 35.338094][ T4519] getname+0x28/0x38 [ 35.338854][ T4519] do_sys_openat2+0xdc/0x3fc [ 35.339756][ T4519] __arm64_sys_openat+0x11c/0x150 [ 35.340731][ T4519] invoke_syscall+0x98/0x290 [ 35.341677][ T4519] el0_svc_common+0x13c/0x258 [ 35.342616][ T4519] do_el0_svc+0x5c/0x134 [ 35.343520][ T4519] el0_svc+0x58/0x12c [ 35.344362][ T4519] el0t_64_sync_handler+0x84/0xf0 [ 35.345367][ T4519] el0t_64_sync+0x18c/0x190 [ 35.369121][ T4524] FAULT_INJECTION: forcing a failure. [ 35.369121][ T4524] name failslab, interval 1, probability 0, space 0, times 0 [ 35.371809][ T4524] CPU: 1 PID: 4524 Comm: syz.3.23 Not tainted syzkaller #0 [ 35.373168][ T4524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 35.375131][ T4524] Call trace: [ 35.375774][ T4524] dump_backtrace+0x1c4/0x1f0 [ 35.376703][ T4524] show_stack+0x2c/0x3c [ 35.377513][ T4524] __dump_stack+0x30/0x40 [ 35.378444][ T4524] dump_stack_lvl+0xf4/0x15c [ 35.379377][ T4524] dump_stack+0x1c/0x5c [ 35.380206][ T4524] should_fail_ex+0x3cc/0x524 [ 35.381137][ T4524] __should_failslab+0xc0/0x11c [ 35.382092][ T4524] should_failslab+0x10/0x28 [ 35.383008][ T4524] __kmem_cache_alloc_node+0x7c/0x318 [ 35.384034][ T4524] kmalloc_trace+0x48/0x94 [ 35.384882][ T4524] mpi_alloc+0x5c/0x140 [ 35.385703][ T4524] mpi_read_raw_data+0x134/0x758 [ 35.386671][ T4524] rsa_set_pub_key+0x238/0x460 [ 35.387633][ T4524] pkcs1pad_set_pub_key+0xc0/0x1b4 [ 35.388656][ T4524] public_key_verify_signature+0x48c/0xb30 [ 35.389814][ T4524] x509_check_for_self_signed+0x2dc/0x3c0 [ 35.390959][ T4524] x509_cert_parse+0x4d8/0x6e0 [ 35.391847][ T4524] x509_key_preparse+0x74/0x5c8 [ 35.392758][ T4524] asymmetric_key_preparse+0xcc/0x17c [ 35.393769][ T4524] key_create_or_update+0x394/0x868 [ 35.394708][ T4524] __arm64_sys_add_key+0x40c/0x520 [ 35.395702][ T4524] invoke_syscall+0x98/0x290 [ 35.396552][ T4524] el0_svc_common+0x13c/0x258 [ 35.397425][ T4524] do_el0_svc+0x5c/0x134 [ 35.398217][ T4524] el0_svc+0x58/0x12c [ 35.398941][ T4524] el0t_64_sync_handler+0x84/0xf0 [ 35.399848][ T4524] el0t_64_sync+0x18c/0x190 [ 35.421994][ T4530] netlink: 20 bytes leftover after parsing attributes in process `syz.4.25'. [ 35.463309][ T4535] loop3: detected capacity change from 0 to 128 [ 35.525993][ T4539] tipc: Started in network mode [ 35.526970][ T4539] tipc: Node identity a29c2cbdf22, cluster identity 4711 [ 35.529232][ T4539] tipc: Enabled bearer , priority 0 [ 35.531747][ T4539] device syzkaller0 entered promiscuous mode [ 35.992000][ T4547] tipc: Resetting bearer [ 36.000918][ T4538] tipc: Resetting bearer [ 36.059103][ T4538] tipc: Disabling bearer [ 36.186222][ T4554] FAULT_INJECTION: forcing a failure. [ 36.186222][ T4554] name failslab, interval 1, probability 0, space 0, times 0 [ 36.189184][ T4554] CPU: 0 PID: 4554 Comm: syz.0.34 Not tainted syzkaller #0 [ 36.190536][ T4554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 36.192469][ T4554] Call trace: [ 36.193081][ T4554] dump_backtrace+0x1c4/0x1f0 [ 36.193982][ T4554] show_stack+0x2c/0x3c [ 36.194756][ T4554] __dump_stack+0x30/0x40 [ 36.195563][ T4554] dump_stack_lvl+0xf4/0x15c [ 36.196393][ T4554] dump_stack+0x1c/0x5c [ 36.197167][ T4554] should_fail_ex+0x3cc/0x524 [ 36.198003][ T4554] __should_failslab+0xc0/0x11c [ 36.198877][ T4554] should_failslab+0x10/0x28 [ 36.199719][ T4554] kmem_cache_alloc+0x88/0x310 [ 36.200589][ T4554] security_inode_alloc+0x38/0x11c [ 36.201547][ T4554] inode_init_always+0x6c8/0xb28 [ 36.202444][ T4554] new_inode_pseudo+0x7c/0x1cc [ 36.203337][ T4554] __sock_create+0x138/0x8a8 [ 36.204185][ T4554] __sys_socket+0xc0/0x1b0 [ 36.205000][ T4554] __arm64_sys_socket+0x7c/0x94 [ 36.205904][ T4554] invoke_syscall+0x98/0x290 [ 36.206736][ T4554] el0_svc_common+0x13c/0x258 [ 36.207605][ T4554] do_el0_svc+0x5c/0x134 [ 36.208364][ T4554] el0_svc+0x58/0x12c [ 36.209064][ T4554] el0t_64_sync_handler+0x84/0xf0 [ 36.209937][ T4554] el0t_64_sync+0x18c/0x190 [ 36.213867][ T4554] socket: no more sockets [ 36.263199][ T4558] netlink: 20 bytes leftover after parsing attributes in process `syz.4.37'. [ 36.342526][ T4330] Bluetooth: hci1: command 0x040f tx timeout [ 36.343754][ T4330] Bluetooth: hci0: command 0x040f tx timeout [ 36.429811][ T4345] Bluetooth: hci2: command 0x040f tx timeout [ 36.431185][ T4345] Bluetooth: hci4: command 0x040f tx timeout [ 36.432391][ T4345] Bluetooth: hci3: command 0x040f tx timeout [ 36.570505][ T4591] netlink: 20 bytes leftover after parsing attributes in process `syz.0.49'. [ 37.002347][ T4601] loop1: detected capacity change from 0 to 128 [ 37.633420][ T4622] netlink: 20 bytes leftover after parsing attributes in process `syz.3.62'. [ 38.021473][ T4649] netlink: 20 bytes leftover after parsing attributes in process `syz.4.73'. [ 38.571385][ T4330] Bluetooth: hci0: command 0x0419 tx timeout [ 38.572582][ T4330] Bluetooth: hci1: command 0x0419 tx timeout [ 38.573635][ T4330] Bluetooth: hci3: command 0x0419 tx timeout [ 38.574716][ T4330] Bluetooth: hci4: command 0x0419 tx timeout [ 38.588159][ T4345] Bluetooth: hci2: command 0x0419 tx timeout [ 38.864601][ T4698] ======================================================= [ 38.864601][ T4698] WARNING: The mand mount option has been deprecated and [ 38.864601][ T4698] and is ignored by this kernel. Remove the mand [ 38.864601][ T4698] option from the mount to silence this warning. [ 38.864601][ T4698] ======================================================= [ 38.876823][ T4698] FAULT_INJECTION: forcing a failure. [ 38.876823][ T4698] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 38.879678][ T4698] CPU: 1 PID: 4698 Comm: syz.0.84 Not tainted syzkaller #0 [ 38.880899][ T4698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 38.882759][ T4698] Call trace: [ 38.883343][ T4698] dump_backtrace+0x1c4/0x1f0 [ 38.884193][ T4698] show_stack+0x2c/0x3c [ 38.884962][ T4698] __dump_stack+0x30/0x40 [ 38.885718][ T4698] dump_stack_lvl+0xf4/0x15c [ 38.886509][ T4698] dump_stack+0x1c/0x5c [ 38.887229][ T4698] should_fail_ex+0x3cc/0x524 [ 38.888044][ T4698] should_fail+0x14/0x24 [ 38.888790][ T4698] should_fail_usercopy+0x20/0x30 [ 38.889797][ T4698] ucma_write+0x140/0x39c [ 38.890704][ T4698] vfs_write+0x2a8/0x7c8 [ 38.891512][ T4698] ksys_write+0x12c/0x228 [ 38.892307][ T4698] __arm64_sys_write+0x7c/0x90 [ 38.893157][ T4698] invoke_syscall+0x98/0x290 [ 38.894008][ T4698] el0_svc_common+0x13c/0x258 [ 38.894870][ T4698] do_el0_svc+0x5c/0x134 [ 38.895653][ T4698] el0_svc+0x58/0x12c [ 38.896382][ T4698] el0t_64_sync_handler+0x84/0xf0 [ 38.897291][ T4698] el0t_64_sync+0x18c/0x190 [ 38.926195][ T4700] netlink: 20 bytes leftover after parsing attributes in process `syz.0.85'. [ 39.330551][ T4748] netlink: 20 bytes leftover after parsing attributes in process `syz.4.97'. [ 39.455729][ T4760] FAULT_INJECTION: forcing a failure. [ 39.455729][ T4760] name failslab, interval 1, probability 0, space 0, times 0 [ 39.459272][ T4760] CPU: 0 PID: 4760 Comm: syz.2.101 Not tainted syzkaller #0 [ 39.460536][ T4760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 39.462363][ T4760] Call trace: [ 39.462981][ T4760] dump_backtrace+0x1c4/0x1f0 [ 39.463864][ T4760] show_stack+0x2c/0x3c [ 39.464626][ T4760] __dump_stack+0x30/0x40 [ 39.465427][ T4760] dump_stack_lvl+0xf4/0x15c [ 39.466266][ T4760] dump_stack+0x1c/0x5c [ 39.467067][ T4760] should_fail_ex+0x3cc/0x524 [ 39.467939][ T4760] __should_failslab+0xc0/0x11c [ 39.468837][ T4760] should_failslab+0x10/0x28 [ 39.469682][ T4760] __kmem_cache_alloc_node+0x7c/0x318 [ 39.470678][ T4760] kmalloc_trace+0x48/0x94 [ 39.471509][ T4760] __rdma_create_id+0x74/0x548 [ 39.472365][ T4760] cma_listen_on_dev+0x19c/0x61c [ 39.473260][ T4760] rdma_listen+0x4c4/0xb0c [ 39.474092][ T4760] ucma_listen+0x218/0x364 [ 39.474876][ T4760] ucma_write+0x2b8/0x39c [ 39.475654][ T4760] vfs_write+0x2a8/0x7c8 [ 39.476409][ T4760] ksys_write+0x12c/0x228 [ 39.477177][ T4760] __arm64_sys_write+0x7c/0x90 [ 39.478019][ T4760] invoke_syscall+0x98/0x290 [ 39.478840][ T4760] el0_svc_common+0x13c/0x258 [ 39.479676][ T4760] do_el0_svc+0x5c/0x134 [ 39.480467][ T4760] el0_svc+0x58/0x12c [ 39.481231][ T4760] el0t_64_sync_handler+0x84/0xf0 [ 39.482268][ T4760] el0t_64_sync+0x18c/0x190 [ 39.554293][ T4771] tipc: Started in network mode [ 39.556071][ T4771] tipc: Node identity ea93d7fef5e9, cluster identity 4711 [ 39.557515][ T4771] tipc: Enabled bearer , priority 0 [ 39.560437][ T4771] device syzkaller0 entered promiscuous mode [ 39.588754][ T4773] netlink: 20 bytes leftover after parsing attributes in process `syz.3.109'. [ 39.647340][ T4785] FAULT_INJECTION: forcing a failure. [ 39.647340][ T4785] name failslab, interval 1, probability 0, space 0, times 0 [ 39.652493][ T4785] CPU: 0 PID: 4785 Comm: syz.3.114 Not tainted syzkaller #0 [ 39.653960][ T4785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 39.655892][ T4785] Call trace: [ 39.656535][ T4785] dump_backtrace+0x1c4/0x1f0 [ 39.657464][ T4785] show_stack+0x2c/0x3c [ 39.658264][ T4785] __dump_stack+0x30/0x40 [ 39.659156][ T4785] dump_stack_lvl+0xf4/0x15c [ 39.660030][ T4785] dump_stack+0x1c/0x5c [ 39.660800][ T4785] should_fail_ex+0x3cc/0x524 [ 39.661681][ T4785] __should_failslab+0xc0/0x11c [ 39.662598][ T4785] should_failslab+0x10/0x28 [ 39.663481][ T4785] __kmem_cache_alloc_node+0x7c/0x318 [ 39.664502][ T4785] __kmalloc+0xc4/0x180 [ 39.665299][ T4785] security_sk_alloc+0x54/0x140 [ 39.666239][ T4785] sk_prot_alloc+0xe0/0x1e8 [ 39.667112][ T4785] sk_alloc+0x44/0x3a0 [ 39.667886][ T4785] kcm_create+0xfc/0x49c [ 39.668695][ T4785] __sock_create+0x448/0x8a8 [ 39.669562][ T4785] __sys_socket+0xc0/0x1b0 [ 39.670397][ T4785] __arm64_sys_socket+0x7c/0x94 [ 39.671344][ T4785] invoke_syscall+0x98/0x290 [ 39.672732][ T4785] el0_svc_common+0x13c/0x258 [ 39.673587][ T4785] do_el0_svc+0x5c/0x134 [ 39.674346][ T4785] el0_svc+0x58/0x12c [ 39.675064][ T4785] el0t_64_sync_handler+0x84/0xf0 [ 39.675971][ T4785] el0t_64_sync+0x18c/0x190 [ 39.690421][ T4784] netlink: 20 bytes leftover after parsing attributes in process `syz.2.123'. [ 39.697853][ T4789] tipc: Resetting bearer [ 39.762614][ T4770] tipc: Resetting bearer [ 39.809146][ T4770] tipc: Disabling bearer [ 39.900923][ T4804] FAULT_INJECTION: forcing a failure. [ 39.900923][ T4804] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 39.904193][ T4804] CPU: 1 PID: 4804 Comm: syz.1.117 Not tainted syzkaller #0 [ 39.905516][ T4804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 39.907233][ T4804] Call trace: [ 39.907790][ T4804] dump_backtrace+0x1c4/0x1f0 [ 39.908699][ T4804] show_stack+0x2c/0x3c [ 39.909497][ T4804] __dump_stack+0x30/0x40 [ 39.910315][ T4804] dump_stack_lvl+0xf4/0x15c [ 39.911303][ T4804] dump_stack+0x1c/0x5c [ 39.912189][ T4804] should_fail_ex+0x3cc/0x524 [ 39.913136][ T4804] should_fail+0x14/0x24 [ 39.913975][ T4804] should_fail_usercopy+0x20/0x30 [ 39.914998][ T4804] ucma_listen+0x98/0x364 [ 39.915832][ T4804] ucma_write+0x2b8/0x39c [ 39.916677][ T4804] vfs_write+0x2a8/0x7c8 [ 39.917509][ T4804] ksys_write+0x12c/0x228 [ 39.918354][ T4804] __arm64_sys_write+0x7c/0x90 [ 39.919285][ T4804] invoke_syscall+0x98/0x290 [ 39.920207][ T4804] el0_svc_common+0x13c/0x258 [ 39.921072][ T4804] do_el0_svc+0x5c/0x134 [ 39.921838][ T4804] el0_svc+0x58/0x12c [ 39.922539][ T4804] el0t_64_sync_handler+0x84/0xf0 [ 39.923419][ T4804] el0t_64_sync+0x18c/0x190 [ 40.471162][ T4845] FAULT_INJECTION: forcing a failure. [ 40.471162][ T4845] name failslab, interval 1, probability 0, space 0, times 0 [ 40.483449][ T4845] CPU: 0 PID: 4845 Comm: syz.4.132 Not tainted syzkaller #0 [ 40.484924][ T4845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 40.486923][ T4845] Call trace: [ 40.487542][ T4845] dump_backtrace+0x1c4/0x1f0 [ 40.488457][ T4845] show_stack+0x2c/0x3c [ 40.489236][ T4845] __dump_stack+0x30/0x40 [ 40.490103][ T4845] dump_stack_lvl+0xf4/0x15c [ 40.490972][ T4845] dump_stack+0x1c/0x5c [ 40.491801][ T4845] should_fail_ex+0x3cc/0x524 [ 40.492710][ T4845] __should_failslab+0xc0/0x11c [ 40.493593][ T4845] should_failslab+0x10/0x28 [ 40.494415][ T4845] kmem_cache_alloc+0x88/0x310 [ 40.495294][ T4845] kcm_create+0x114/0x49c [ 40.496065][ T4845] __sock_create+0x448/0x8a8 [ 40.496872][ T4845] __sys_socket+0xc0/0x1b0 [ 40.497647][ T4845] __arm64_sys_socket+0x7c/0x94 [ 40.498544][ T4845] invoke_syscall+0x98/0x290 [ 40.499337][ T4845] el0_svc_common+0x13c/0x258 [ 40.500154][ T4845] do_el0_svc+0x5c/0x134 [ 40.501094][ T4845] el0_svc+0x58/0x12c [ 40.501958][ T4845] el0t_64_sync_handler+0x84/0xf0 [ 40.502862][ T4845] el0t_64_sync+0x18c/0x190 [ 40.634230][ T4867] FAULT_INJECTION: forcing a failure. [ 40.634230][ T4867] name failslab, interval 1, probability 0, space 0, times 0 [ 40.636476][ T4867] CPU: 0 PID: 4867 Comm: syz.4.139 Not tainted syzkaller #0 [ 40.637646][ T4867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 40.639415][ T4867] Call trace: [ 40.640017][ T4867] dump_backtrace+0x1c4/0x1f0 [ 40.640811][ T4867] show_stack+0x2c/0x3c [ 40.641578][ T4867] __dump_stack+0x30/0x40 [ 40.642366][ T4867] dump_stack_lvl+0xf4/0x15c [ 40.643192][ T4867] dump_stack+0x1c/0x5c [ 40.643915][ T4867] should_fail_ex+0x3cc/0x524 [ 40.644749][ T4867] __should_failslab+0xc0/0x11c [ 40.645625][ T4867] should_failslab+0x10/0x28 [ 40.646448][ T4867] __kmem_cache_alloc_node+0x7c/0x318 [ 40.647415][ T4867] __kmalloc+0xc4/0x180 [ 40.648211][ T4867] memcg_list_lru_alloc+0x190/0x8bc [ 40.649258][ T4867] slab_pre_alloc_hook+0x2cc/0x31c [ 40.650200][ T4867] kmem_cache_alloc_lru+0x60/0x284 [ 40.651210][ T4867] hugetlbfs_alloc_inode+0xdc/0x138 [ 40.652148][ T4867] new_inode_pseudo+0x68/0x1cc [ 40.653010][ T4867] new_inode+0x38/0x174 [ 40.653802][ T4867] hugetlbfs_get_inode+0x9c/0x4bc [ 40.654714][ T4867] hugetlb_file_setup+0x24c/0x564 [ 40.655643][ T4867] newseg+0x36c/0x910 [ 40.656374][ T4867] ipcget+0x810/0xbc8 [ 40.657106][ T4867] __arm64_sys_shmget+0x120/0x174 [ 40.658018][ T4867] invoke_syscall+0x98/0x290 [ 40.658838][ T4867] el0_svc_common+0x13c/0x258 [ 40.659731][ T4867] do_el0_svc+0x5c/0x134 [ 40.660519][ T4867] el0_svc+0x58/0x12c [ 40.661250][ T4867] el0t_64_sync_handler+0x84/0xf0 [ 40.662250][ T4867] el0t_64_sync+0x18c/0x190 [ 41.567085][ T4949] tipc: Enabled bearer , priority 0 [ 41.569369][ T4949] device syzkaller0 entered promiscuous mode [ 41.732652][ T4955] tipc: Resetting bearer [ 41.736894][ T4948] tipc: Resetting bearer [ 41.809908][ T4948] tipc: Disabling bearer [ 42.111743][ T5010] tipc: Started in network mode [ 42.112969][ T5010] tipc: Node identity 3a12dd8f6565, cluster identity 4711 [ 42.114425][ T5010] tipc: Enabled bearer , priority 0 [ 42.117159][ T5010] device syzkaller0 entered promiscuous mode [ 42.252267][ T5021] netlink: 'syz.2.188': attribute type 27 has an invalid length. [ 42.253817][ T5021] netlink: 'syz.2.188': attribute type 3 has an invalid length. [ 42.483899][ T4412] rxe_eth0 speed is unknown, defaulting to 1000 [ 42.525700][ T5010] tipc: Resetting bearer [ 42.544886][ T5009] tipc: Resetting bearer [ 42.619982][ T5009] tipc: Disabling bearer [ 43.028474][ T5093] tipc: Enabled bearer , priority 0 [ 43.030235][ T5093] device syzkaller0 entered promiscuous mode [ 43.110836][ T5093] tipc: Resetting bearer [ 43.126891][ T5090] tipc: Resetting bearer [ 43.156116][ T5113] netlink: 16 bytes leftover after parsing attributes in process `syz.3.223'. [ 43.209745][ T5090] tipc: Disabling bearer [ 43.341381][ T5138] syz.3.236 uses obsolete (PF_INET,SOCK_PACKET) [ 43.497506][ T5155] tipc: Enabled bearer , priority 0 [ 43.503289][ T5155] device syzkaller0 entered promiscuous mode [ 43.526751][ T5162] netlink: 48 bytes leftover after parsing attributes in process `syz.0.248'. [ 43.619056][ T5155] tipc: Resetting bearer [ 43.662126][ T5153] tipc: Resetting bearer [ 43.739806][ T5153] tipc: Disabling bearer [ 44.011464][ T5213] netlink: 48 bytes leftover after parsing attributes in process `syz.4.262'. [ 44.215426][ T5234] tipc: Enabled bearer , priority 0 [ 44.219119][ T5234] device syzkaller0 entered promiscuous mode [ 44.369054][ T5234] tipc: Resetting bearer [ 44.380334][ T5233] tipc: Resetting bearer [ 44.469309][ T5233] tipc: Disabling bearer [ 44.477401][ T5254] netlink: 48 bytes leftover after parsing attributes in process `syz.1.275'. [ 44.768160][ T5283] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0) [ 44.795518][ T5287] netlink: 20 bytes leftover after parsing attributes in process `syz.2.289'. [ 44.869138][ T5294] tipc: Enabled bearer , priority 0 [ 44.870952][ T5294] device syzkaller0 entered promiscuous mode [ 45.010380][ T5294] tipc: Resetting bearer [ 45.031269][ T5292] tipc: Resetting bearer [ 45.055808][ T5326] netlink: 20 bytes leftover after parsing attributes in process `syz.0.302'. [ 45.113457][ T5337] xt_CT: You must specify a L4 protocol and not use inversions on it [ 45.139393][ T5292] tipc: Disabling bearer [ 45.313778][ T5368] netlink: 20 bytes leftover after parsing attributes in process `syz.4.315'. [ 45.427394][ T5386] tipc: Enabled bearer , priority 0 [ 45.430190][ T5386] device syzkaller0 entered promiscuous mode [ 45.516874][ T5386] tipc: Resetting bearer [ 45.525930][ T5384] tipc: Resetting bearer [ 45.599055][ T5384] tipc: Disabling bearer [ 45.865631][ T5450] loop3: detected capacity change from 0 to 164 [ 45.893634][ T5452] tipc: Enabled bearer , priority 0 [ 45.900122][ T5452] device syzkaller0 entered promiscuous mode [ 46.010759][ T5452] tipc: Resetting bearer [ 46.025615][ T5451] tipc: Resetting bearer [ 46.101500][ T5451] tipc: Disabling bearer [ 46.174011][ T5495] netlink: 168 bytes leftover after parsing attributes in process `syz.0.358'. [ 46.239420][ T5507] loop8: detected capacity change from 0 to 16384 [ 46.412778][ T5525] tipc: Enabled bearer , priority 0 [ 46.414533][ T5525] device syzkaller0 entered promiscuous mode [ 46.434843][ T5527] loop1: detected capacity change from 0 to 512 [ 46.456132][ T5529] netlink: 168 bytes leftover after parsing attributes in process `syz.3.372'. [ 46.507216][ T5527] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 46.533415][ T5525] tipc: Resetting bearer [ 46.536449][ T5523] tipc: Resetting bearer [ 46.589050][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 46.617659][ T5542] netlink: 12 bytes leftover after parsing attributes in process `syz.3.377'. [ 46.629773][ T5523] tipc: Disabling bearer [ 46.755586][ T5557] sctp: [Deprecated]: syz.2.383 (pid 5557) Use of int in max_burst socket option. [ 46.755586][ T5557] Use struct sctp_assoc_value instead [ 46.758817][ T5560] netlink: 168 bytes leftover after parsing attributes in process `syz.3.384'. [ 46.863110][ T5574] tipc: Enabled bearer , priority 0 [ 46.868126][ T5574] device syzkaller0 entered promiscuous mode [ 46.893088][ T5577] netlink: 12 bytes leftover after parsing attributes in process `syz.1.391'. [ 46.923600][ T5574] tipc: Resetting bearer [ 46.927071][ T5570] tipc: Resetting bearer [ 47.040018][ T5570] tipc: Disabling bearer [ 47.066119][ T5590] netlink: 136 bytes leftover after parsing attributes in process `syz.2.397'. [ 47.379580][ T5625] loop2: detected capacity change from 0 to 512 [ 47.397109][ T5625] EXT4-fs: Ignoring removed orlov option [ 47.409398][ T5625] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 47.412809][ T5627] tipc: Enabled bearer , priority 0 [ 47.415720][ T5627] device syzkaller0 entered promiscuous mode [ 47.449573][ T5625] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3861: comm syz.2.410: Allocating blocks 41-42 which overlap fs metadata [ 47.456050][ T5625] Quota error (device loop2): write_blk: dquota write failed [ 47.463530][ T5627] tipc: Resetting bearer [ 47.467847][ T5623] tipc: Resetting bearer [ 47.473440][ T5625] Quota error (device loop2): find_free_dqentry: Can't write quota data block 5 [ 47.481029][ T5625] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3861: comm syz.2.410: Allocating blocks 41-42 which overlap fs metadata [ 47.485374][ T5625] Quota error (device loop2): write_blk: dquota write failed [ 47.489349][ T5625] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 47.491638][ T5625] EXT4-fs error (device loop2): ext4_acquire_dquot:6841: comm syz.2.410: Failed to acquire dquot type 1 [ 47.494310][ T5625] EXT4-fs error (device loop2): mb_free_blocks:1839: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 47.506575][ T5625] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #12: comm syz.2.410: corrupted inode contents [ 47.522060][ T5625] EXT4-fs error (device loop2): ext4_dirty_inode:6166: inode #12: comm syz.2.410: mark_inode_dirty error [ 47.528441][ T5625] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #12: comm syz.2.410: corrupted inode contents [ 47.534222][ T5625] EXT4-fs error (device loop2): __ext4_ext_dirty:202: inode #12: comm syz.2.410: mark_inode_dirty error [ 47.550994][ T5623] tipc: Disabling bearer [ 47.561459][ T5625] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #12: comm syz.2.410: corrupted inode contents [ 47.577766][ T5625] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 47.584710][ T5625] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #12: comm syz.2.410: corrupted inode contents [ 47.603328][ T5625] EXT4-fs error (device loop2): ext4_truncate:4325: inode #12: comm syz.2.410: mark_inode_dirty error [ 47.620989][ T5625] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 47.629892][ T5625] EXT4-fs (loop2): 1 truncate cleaned up [ 47.634930][ T5625] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 47.663402][ T5625] EXT4-fs error (device loop2): __ext4_remount:6650: comm syz.2.410: Abort forced by user [ 47.667283][ T5625] EXT4-fs (loop2): re-mounted. Quota mode: writeback. [ 47.691409][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 47.854832][ T5663] tipc: Enabled bearer , priority 0 [ 47.861256][ T5663] device syzkaller0 entered promiscuous mode [ 47.895376][ T5668] loop1: detected capacity change from 0 to 4096 [ 47.917300][ T5668] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 48.367049][ T5663] tipc: Resetting bearer [ 48.377523][ T5662] tipc: Resetting bearer [ 48.460075][ T5662] tipc: Disabling bearer [ 48.742811][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 48.844876][ T5733] tipc: Started in network mode [ 48.851557][ T5733] tipc: Node identity 62e9b7f7e19e, cluster identity 4711 [ 48.856426][ T5733] tipc: Enabled bearer , priority 0 [ 48.863165][ T5733] device syzkaller0 entered promiscuous mode [ 48.910761][ T5733] tipc: Resetting bearer [ 48.914859][ T5732] tipc: Resetting bearer [ 48.999308][ T5732] tipc: Disabling bearer [ 49.082791][ T5760] FAULT_INJECTION: forcing a failure. [ 49.082791][ T5760] name failslab, interval 1, probability 0, space 0, times 0 [ 49.085552][ T5760] CPU: 0 PID: 5760 Comm: syz.3.464 Not tainted syzkaller #0 [ 49.086720][ T5760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 49.088455][ T5760] Call trace: [ 49.089043][ T5760] dump_backtrace+0x1c4/0x1f0 [ 49.089846][ T5760] show_stack+0x2c/0x3c [ 49.090582][ T5760] __dump_stack+0x30/0x40 [ 49.091372][ T5760] dump_stack_lvl+0xf4/0x15c [ 49.092184][ T5760] dump_stack+0x1c/0x5c [ 49.092924][ T5760] should_fail_ex+0x3cc/0x524 [ 49.093786][ T5760] __should_failslab+0xc0/0x11c [ 49.094624][ T5760] should_failslab+0x10/0x28 [ 49.095403][ T5760] __kmem_cache_alloc_node+0x7c/0x318 [ 49.096335][ T5760] kmalloc_trace+0x48/0x94 [ 49.097119][ T5760] sctp_add_bind_addr+0x9c/0x2e8 [ 49.098007][ T5760] sctp_copy_local_addr_list+0x2d4/0x474 [ 49.098994][ T5760] sctp_copy_one_addr+0xb0/0x33c [ 49.099869][ T5760] sctp_bind_addr_copy+0xa8/0x39c [ 49.100830][ T5760] sctp_assoc_set_bind_addr_from_ep+0x128/0x184 [ 49.101992][ T5760] sctp_connect_new_asoc+0x28c/0x5f4 [ 49.102931][ T5760] __sctp_connect+0x4bc/0xb54 [ 49.103780][ T5760] sctp_inet_connect+0x124/0x1d8 [ 49.104703][ T5760] __sys_connect+0x28c/0x2b4 [ 49.105548][ T5760] __arm64_sys_connect+0x7c/0x94 [ 49.106434][ T5760] invoke_syscall+0x98/0x290 [ 49.107277][ T5760] el0_svc_common+0x13c/0x258 [ 49.108113][ T5760] do_el0_svc+0x5c/0x134 [ 49.108959][ T5760] el0_svc+0x58/0x12c [ 49.109711][ T5760] el0t_64_sync_handler+0x84/0xf0 [ 49.110602][ T5760] el0t_64_sync+0x18c/0x190 [ 49.255163][ T5782] tipc: Enabled bearer , priority 0 [ 49.304295][ T5782] device syzkaller0 entered promiscuous mode [ 49.366592][ T5782] tipc: Resetting bearer [ 49.371198][ T5781] tipc: Resetting bearer [ 49.470595][ T5781] tipc: Disabling bearer [ 49.546336][ T5823] loop0: detected capacity change from 0 to 1024 [ 49.595967][ T5831] __nla_validate_parse: 12 callbacks suppressed [ 49.595986][ T5831] netlink: 136 bytes leftover after parsing attributes in process `syz.1.495'. [ 49.600700][ T5831] netlink: 8 bytes leftover after parsing attributes in process `syz.1.495'. [ 49.614797][ T4318] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 49.705163][ T5843] tipc: Enabled bearer , priority 0 [ 49.707035][ T5843] device syzkaller0 entered promiscuous mode [ 49.743193][ T5843] tipc: Resetting bearer [ 49.746713][ T5842] tipc: Resetting bearer [ 49.819196][ T5842] tipc: Disabling bearer [ 49.889336][ T5867] netlink: 136 bytes leftover after parsing attributes in process `syz.2.507'. [ 49.891396][ T5867] netlink: 8 bytes leftover after parsing attributes in process `syz.2.507'. [ 49.957957][ T5877] FAULT_INJECTION: forcing a failure. [ 49.957957][ T5877] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 49.962861][ T5877] CPU: 0 PID: 5877 Comm: syz.1.512 Not tainted syzkaller #0 [ 49.964349][ T5877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 49.966227][ T5877] Call trace: [ 49.966857][ T5877] dump_backtrace+0x1c4/0x1f0 [ 49.967796][ T5877] show_stack+0x2c/0x3c [ 49.968616][ T5877] __dump_stack+0x30/0x40 [ 49.969415][ T5877] dump_stack_lvl+0xf4/0x15c [ 49.970268][ T5877] dump_stack+0x1c/0x5c [ 49.971007][ T5877] should_fail_ex+0x3cc/0x524 [ 49.971883][ T5877] should_fail_alloc_page+0x74/0xb8 [ 49.972941][ T5877] prepare_alloc_pages+0x1b8/0x4f0 [ 49.973843][ T5877] __alloc_pages+0x134/0x544 [ 49.974664][ T5877] __folio_alloc+0x1c/0x44 [ 49.975465][ T5877] vma_alloc_folio+0x37c/0x8ac [ 49.976324][ T5877] shmem_alloc_and_acct_folio+0x3bc/0x948 [ 49.977357][ T5877] shmem_get_folio_gfp+0xedc/0x2038 [ 49.978276][ T5877] shmem_fault+0x170/0x564 [ 49.979095][ T5877] __do_fault+0x11c/0x3d8 [ 49.979888][ T5877] handle_mm_fault+0x1d04/0x3018 [ 49.980797][ T5877] __get_user_pages+0x340/0x770 [ 49.981636][ T5877] populate_vma_page_range+0x1f4/0x298 [ 49.982569][ T5877] __mm_populate+0x214/0x338 [ 49.983396][ T5877] vm_mmap_pgoff+0x1dc/0x298 [ 49.984203][ T5877] ksys_mmap_pgoff+0xd0/0x5a0 [ 49.985064][ T5877] __arm64_sys_mmap+0x108/0x120 [ 49.985954][ T5877] invoke_syscall+0x98/0x290 [ 49.986774][ T5877] el0_svc_common+0x13c/0x258 [ 49.987645][ T5877] do_el0_svc+0x5c/0x134 [ 49.988387][ T5877] el0_svc+0x58/0x12c [ 49.989125][ T5877] el0t_64_sync_handler+0x84/0xf0 [ 49.990111][ T5877] el0t_64_sync+0x18c/0x190 [ 50.027302][ T5882] loop2: detected capacity change from 0 to 512 [ 50.041501][ T5882] EXT4-fs: Ignoring removed nomblk_io_submit option [ 50.052042][ T5882] EXT4-fs warning (device loop2): ext4_multi_mount_protect:324: fsck is running on the filesystem [ 50.054200][ T5882] EXT4-fs warning (device loop2): ext4_multi_mount_protect:324: MMP failure info: last update time: 72057595707060727, last update node: , last update device: loop14 [ 50.065841][ T5884] ip_tables: iptables: counters copy to user failed while replacing table [ 50.239551][ T5900] tipc: Enabled bearer , priority 0 [ 50.241168][ T5900] device syzkaller0 entered promiscuous mode [ 50.296722][ T5900] tipc: Resetting bearer [ 50.301947][ T5899] tipc: Resetting bearer [ 50.381319][ T5899] tipc: Disabling bearer [ 50.669322][ T5936] tipc: Enabled bearer , priority 0 [ 50.673391][ T5936] device syzkaller0 entered promiscuous mode [ 50.758775][ T5941] netlink: 8 bytes leftover after parsing attributes in process `syz.1.535'. [ 50.765680][ T5936] tipc: Resetting bearer [ 50.772647][ T5944] Illegal XDP return value 4294967274 on prog (id 11) dev syz_tun, expect packet loss! [ 50.775178][ T5935] tipc: Resetting bearer [ 50.859020][ T5935] tipc: Disabling bearer [ 51.143362][ T5985] tipc: Enabled bearer , priority 0 [ 51.145496][ T5985] device syzkaller0 entered promiscuous mode [ 51.194682][ T5985] tipc: Resetting bearer [ 51.196374][ T5990] netlink: 4 bytes leftover after parsing attributes in process `syz.3.553'. [ 51.410528][ T5984] tipc: Resetting bearer [ 51.499167][ T5984] tipc: Disabling bearer [ 51.504751][ T5997] device gretap0 entered promiscuous mode [ 51.506622][ T5997] device vlan2 entered promiscuous mode [ 51.797845][ T6041] tipc: Enabled bearer , priority 0 [ 51.804005][ T6041] device syzkaller0 entered promiscuous mode [ 51.839714][ T6041] tipc: Resetting bearer [ 51.848887][ T6040] tipc: Resetting bearer [ 51.881440][ T6040] tipc: Disabling bearer [ 51.945959][ T6061] loop2: detected capacity change from 0 to 4096 [ 51.980444][ T6072] loop3: detected capacity change from 0 to 512 [ 51.994196][ T6072] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 52.003861][ T6061] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 52.013704][ T6072] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 52.043117][ T6072] EXT4-fs (loop3): 1 truncate cleaned up [ 52.050057][ T6072] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 52.088064][ T6072] EXT4-fs error (device loop3): ext4_generic_delete_entry:2731: inode #2: block 13: comm syz.3.585: bad entry in directory: inode out of bounds - offset=12, inode=2048, rec_len=12, size=1024 fake=1 [ 52.104572][ T6072] EXT4-fs (loop3): Remounting filesystem read-only [ 52.107447][ T6072] EXT4-fs error (device loop3) in ext4_delete_entry:2802: Corrupt filesystem [ 52.114489][ T6072] EXT4-fs (loop3): Remounting filesystem read-only [ 52.424397][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 52.712133][ T6119] tipc: Enabled bearer , priority 0 [ 52.714321][ T6119] device syzkaller0 entered promiscuous mode [ 52.730381][ T6119] tipc: Resetting bearer [ 52.748780][ T6118] tipc: Resetting bearer [ 52.789554][ T6118] tipc: Disabling bearer [ 52.792609][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 52.880207][ T6141] loop4: detected capacity change from 0 to 164 [ 52.924060][ T6143] loop0: detected capacity change from 0 to 512 [ 52.960558][ T6143] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 52.992410][ T6143] EXT4-fs error (device loop0): ext4_orphan_get:1435: comm syz.0.604: bad orphan inode 13 [ 52.995333][ T6143] ext4_test_bit(bit=12, block=18) = 1 [ 52.996404][ T6143] is_bad_inode(inode)=0 [ 53.001092][ T6143] NEXT_ORPHAN(inode)=0 [ 53.001922][ T6143] max_ino=32 [ 53.002486][ T6143] i_nlink=1 [ 53.003119][ T6143] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 53.057755][ T4333] EXT4-fs (loop0): unmounting filesystem. [ 53.082431][ T6167] tipc: Enabled bearer , priority 0 [ 53.084193][ T6167] device syzkaller0 entered promiscuous mode [ 53.101576][ T6167] tipc: Resetting bearer [ 53.108182][ T6166] tipc: Resetting bearer [ 53.169315][ T6166] tipc: Disabling bearer [ 53.404655][ T6215] tipc: Enabled bearer , priority 0 [ 53.406688][ T6215] device syzkaller0 entered promiscuous mode [ 53.421739][ T6215] tipc: Resetting bearer [ 53.425141][ T6212] tipc: Resetting bearer [ 53.469927][ T6212] tipc: Disabling bearer [ 53.732516][ T6262] Bluetooth: MGMT ver 1.22 [ 53.740318][ T6260] tipc: Enabled bearer , priority 0 [ 53.742092][ T6260] device syzkaller0 entered promiscuous mode [ 53.770698][ T6260] tipc: Resetting bearer [ 53.783186][ T6258] tipc: Resetting bearer [ 53.819584][ T6258] tipc: Disabling bearer [ 54.056534][ T6312] tipc: Enabled bearer , priority 0 [ 54.064125][ T6312] device syzkaller0 entered promiscuous mode [ 54.082875][ T6312] tipc: Resetting bearer [ 54.093421][ T6311] tipc: Resetting bearer [ 54.149198][ T6311] tipc: Disabling bearer [ 54.325988][ T6355] loop3: detected capacity change from 0 to 512 [ 54.350690][ T6355] EXT4-fs: Ignoring removed mblk_io_submit option [ 54.369446][ T6355] EXT4-fs (loop3): orphan cleanup on readonly fs [ 54.370630][ T6355] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -13 [ 54.374854][ T6355] EXT4-fs error (device loop3): ext4_clear_blocks:883: inode #13: comm syz.3.675: attempt to clear invalid blocks 2 len 1 [ 54.388371][ T6355] EXT4-fs (loop3): Remounting filesystem read-only [ 54.389976][ T6355] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 54.408941][ T6355] EXT4-fs (loop3): Remounting filesystem read-only [ 54.412011][ T6355] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.675: invalid indirect mapped block 1819239214 (level 0) [ 54.434746][ T6355] EXT4-fs (loop3): Remounting filesystem read-only [ 54.436171][ T6355] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.675: invalid indirect mapped block 1819239214 (level 1) [ 54.442726][ T6355] EXT4-fs (loop3): Remounting filesystem read-only [ 54.444654][ T6355] EXT4-fs (loop3): 1 truncate cleaned up [ 54.445728][ T6355] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 54.450683][ T6355] EXT4-fs (loop3): re-mounted. Quota mode: writeback. [ 54.463215][ T6368] tipc: Enabled bearer , priority 0 [ 54.465601][ T6368] device syzkaller0 entered promiscuous mode [ 54.473378][ T6368] tipc: Resetting bearer [ 54.477011][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 54.487302][ T6367] tipc: Resetting bearer [ 54.529206][ T6367] tipc: Disabling bearer [ 54.633129][ T6390] FAULT_INJECTION: forcing a failure. [ 54.633129][ T6390] name failslab, interval 1, probability 0, space 0, times 0 [ 54.638106][ T6390] CPU: 1 PID: 6390 Comm: syz.0.691 Not tainted syzkaller #0 [ 54.639641][ T6390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 54.641656][ T6390] Call trace: [ 54.642332][ T6390] dump_backtrace+0x1c4/0x1f0 [ 54.643363][ T6390] show_stack+0x2c/0x3c [ 54.644208][ T6390] __dump_stack+0x30/0x40 [ 54.645084][ T6390] dump_stack_lvl+0xf4/0x15c [ 54.645934][ T6390] dump_stack+0x1c/0x5c [ 54.646712][ T6390] should_fail_ex+0x3cc/0x524 [ 54.647598][ T6390] __should_failslab+0xc0/0x11c [ 54.648506][ T6390] should_failslab+0x10/0x28 [ 54.649356][ T6390] slab_pre_alloc_hook+0x6c/0x31c [ 54.650297][ T6390] kmem_cache_alloc_lru+0x60/0x284 [ 54.651259][ T6390] __d_alloc+0x40/0x68c [ 54.652013][ T6390] d_alloc_pseudo+0x28/0x8c [ 54.652832][ T6390] alloc_file_pseudo+0xd8/0x1f4 [ 54.653764][ T6390] sock_alloc_file+0xb4/0x234 [ 54.654654][ T6390] __sys_socket+0x138/0x1b0 [ 54.655505][ T6390] __arm64_sys_socket+0x7c/0x94 [ 54.656415][ T6390] invoke_syscall+0x98/0x290 [ 54.657288][ T6390] el0_svc_common+0x13c/0x258 [ 54.658180][ T6390] do_el0_svc+0x5c/0x134 [ 54.659009][ T6390] el0_svc+0x58/0x12c [ 54.659730][ T6390] el0t_64_sync_handler+0x84/0xf0 [ 54.660644][ T6390] el0t_64_sync+0x18c/0x190 [ 54.824371][ T6418] tipc: Enabled bearer , priority 0 [ 54.826227][ T6418] device syzkaller0 entered promiscuous mode [ 54.886679][ T6418] tipc: Resetting bearer [ 54.895966][ T6417] tipc: Resetting bearer [ 54.949118][ T6417] tipc: Disabling bearer [ 54.974652][ T6437] sctp: [Deprecated]: syz.2.704 (pid 6437) Use of int in max_burst socket option. [ 54.974652][ T6437] Use struct sctp_assoc_value instead [ 55.035616][ T6442] loop0: detected capacity change from 0 to 512 [ 55.056381][ T6442] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 55.072609][ T6442] EXT4-fs error (device loop0): ext4_orphan_get:1435: comm syz.0.706: bad orphan inode 131072 [ 55.078908][ T6442] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 55.145211][ T4333] EXT4-fs (loop0): unmounting filesystem. [ 55.327084][ T6475] loop0: detected capacity change from 0 to 512 [ 55.329936][ T6475] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 55.670597][ T6475] syz.0.712: attempt to access beyond end of device [ 55.670597][ T6475] loop0: rw=524288, sector=17179852706, nr_sectors = 16 limit=512 [ 55.679986][ T6475] syz.0.712: attempt to access beyond end of device [ 55.679986][ T6475] loop0: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 55.683755][ T6475] syz.0.712: attempt to access beyond end of device [ 55.683755][ T6475] loop0: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 55.693772][ T6475] syz.0.712: attempt to access beyond end of device [ 55.693772][ T6475] loop0: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 55.696813][ T6475] syz.0.712: attempt to access beyond end of device [ 55.696813][ T6475] loop0: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 55.716560][ T6484] loop4: detected capacity change from 0 to 1024 [ 55.726394][ T6484] EXT4-fs: Ignoring removed bh option [ 55.729580][ T6475] syz.0.712: attempt to access beyond end of device [ 55.729580][ T6475] loop0: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 55.734262][ T6486] tipc: Enabled bearer , priority 0 [ 55.736349][ T6486] device syzkaller0 entered promiscuous mode [ 55.739376][ T6475] syz.0.712: attempt to access beyond end of device [ 55.739376][ T6475] loop0: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 55.749631][ T6475] syz.0.712: attempt to access beyond end of device [ 55.749631][ T6475] loop0: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 55.756152][ T6486] tipc: Resetting bearer [ 55.759444][ T6475] syz.0.712: attempt to access beyond end of device [ 55.759444][ T6475] loop0: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 55.764154][ T6485] tipc: Resetting bearer [ 55.768688][ T6484] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 55.770674][ T6475] syz.0.712: attempt to access beyond end of device [ 55.770674][ T6475] loop0: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 55.778481][ T4341] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 55.791373][ T4341] Bluetooth: hci0: command 0x0c24 tx timeout [ 55.799876][ T6484] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 3) [ 55.814872][ T6484] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 55.818649][ T6484] EXT4-fs (loop4): This should not happen!! Data will be lost [ 55.818649][ T6484] [ 55.825865][ T6484] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 1) [ 55.837299][ T6484] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 1) [ 55.843968][ T6484] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 1) [ 55.848186][ T6484] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 1) [ 55.858383][ T6485] tipc: Disabling bearer [ 55.875126][ T6484] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 1) [ 55.885775][ T6483] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 1) [ 55.890993][ T6483] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 1) [ 55.894757][ T6483] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 1) [ 55.921848][ T6483] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.715: lblock 3 mapped to illegal pblock 3 (length 1) [ 56.355252][ T6532] netlink: 8 bytes leftover after parsing attributes in process `syz.3.727'. [ 56.538676][ T6546] tipc: Enabled bearer , priority 0 [ 56.561350][ T11] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 56.563769][ T11] EXT4-fs (loop4): This should not happen!! Data will be lost [ 56.563769][ T11] [ 56.568649][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 56.590881][ T6546] tipc: Resetting bearer [ 56.656044][ T6544] tipc: Disabling bearer [ 56.824628][ T6569] netlink: 32 bytes leftover after parsing attributes in process `syz.3.739'. [ 56.827028][ T6569] netlink: 32 bytes leftover after parsing attributes in process `syz.3.739'. [ 56.836135][ T6571] netlink: 8 bytes leftover after parsing attributes in process `syz.1.740'. [ 56.934510][ T6581] netlink: 'syz.4.745': attribute type 1 has an invalid length. [ 57.009574][ T6585] tipc: Enabled bearer , priority 0 [ 57.099816][ T6589] tipc: Resetting bearer [ 57.149896][ T6584] tipc: Disabling bearer [ 57.591807][ T6642] tipc: Enabled bearer , priority 0 [ 57.642356][ T6650] loop2: detected capacity change from 0 to 4096 [ 57.665169][ T6650] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 57.674087][ T6642] tipc: Resetting bearer [ 57.749238][ T6641] tipc: Disabling bearer [ 57.990813][ T6527] Set syz1 is full, maxelem 65536 reached [ 58.208460][ T6681] loop0: detected capacity change from 0 to 8192 [ 58.249143][ T6681] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 58.310328][ T6697] device syzkaller0 entered promiscuous mode [ 58.473793][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 58.728740][ T6740] netlink: 68 bytes leftover after parsing attributes in process `syz.2.802'. [ 58.934635][ T6766] device syzkaller0 entered promiscuous mode [ 59.002015][ T6778] loop1: detected capacity change from 0 to 512 [ 59.025680][ T6778] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 59.126809][ T6790] netlink: 124 bytes leftover after parsing attributes in process `syz.1.817'. [ 59.480109][ T6828] device syzkaller0 entered promiscuous mode [ 59.498409][ T6830] netlink: 124 bytes leftover after parsing attributes in process `syz.1.831'. [ 59.836254][ T6848] loop1: detected capacity change from 0 to 1024 [ 59.895359][ T6848] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 59.945322][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 60.042090][ T6872] netlink: 124 bytes leftover after parsing attributes in process `syz.4.843'. [ 60.059674][ T6874] FAULT_INJECTION: forcing a failure. [ 60.059674][ T6874] name fail_futex, interval 1, probability 0, space 0, times 1 [ 60.061976][ T6874] CPU: 1 PID: 6874 Comm: syz.2.844 Not tainted syzkaller #0 [ 60.063253][ T6874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 60.065099][ T6874] Call trace: [ 60.065796][ T6874] dump_backtrace+0x1c4/0x1f0 [ 60.066727][ T6874] show_stack+0x2c/0x3c [ 60.067554][ T6874] __dump_stack+0x30/0x40 [ 60.068454][ T6874] dump_stack_lvl+0xf4/0x15c [ 60.069318][ T6874] dump_stack+0x1c/0x5c [ 60.070103][ T6874] should_fail_ex+0x3cc/0x524 [ 60.071031][ T6874] should_fail+0x14/0x24 [ 60.071808][ T6874] get_futex_key+0x904/0xfb0 [ 60.072653][ T6874] futex_wait_setup+0xbc/0x320 [ 60.073508][ T6874] futex_wait+0x164/0x424 [ 60.074286][ T6874] do_futex+0x2e8/0x340 [ 60.075033][ T6874] __arm64_sys_futex+0x390/0x414 [ 60.075908][ T6874] invoke_syscall+0x98/0x290 [ 60.076712][ T6874] el0_svc_common+0x13c/0x258 [ 60.077558][ T6874] do_el0_svc+0x5c/0x134 [ 60.078326][ T6874] el0_svc+0x58/0x12c [ 60.079056][ T6874] el0t_64_sync_handler+0x84/0xf0 [ 60.079978][ T6874] el0t_64_sync+0x18c/0x190 [ 60.107319][ T6880] netlink: 32 bytes leftover after parsing attributes in process `syz.1.845'. [ 60.141697][ T6883] device syzkaller0 entered promiscuous mode [ 60.256148][ T6904] loop1: detected capacity change from 0 to 512 [ 60.287279][ T6904] EXT4-fs error (device loop1): ext4_orphan_get:1435: comm syz.1.852: bad orphan inode 15 [ 60.289896][ T6904] ext4_test_bit(bit=14, block=5) = 0 [ 60.290817][ T6904] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 60.295117][ T6904] EXT4-fs error (device loop1): __ext4_new_inode:1083: comm syz.1.852: reserved inode found cleared - inode=1 [ 60.321663][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 60.484846][ T6927] netlink: 28 bytes leftover after parsing attributes in process `syz.2.859'. [ 60.678665][ T6951] device syzkaller0 entered promiscuous mode [ 60.693259][ T6953] ieee802154 phy0 wpan0: encryption failed: -22 [ 60.903380][ T6975] loop1: detected capacity change from 0 to 1024 [ 61.111500][ T6992] netlink: 'syz.1.877': attribute type 9 has an invalid length. [ 61.113013][ T6992] netlink: 'syz.1.877': attribute type 7 has an invalid length. [ 61.114406][ T6992] netlink: 'syz.1.877': attribute type 8 has an invalid length. [ 61.406174][ T6998] tap0: tun_chr_ioctl cmd 2147774995 [ 61.419524][ T7004] __nla_validate_parse: 3 callbacks suppressed [ 61.419539][ T7004] netlink: 32 bytes leftover after parsing attributes in process `syz.4.884'. [ 61.542304][ T7017] device syzkaller0 entered promiscuous mode [ 61.634377][ T7032] netlink: 28 bytes leftover after parsing attributes in process `syz.3.892'. [ 61.740302][ T7042] netlink: 4 bytes leftover after parsing attributes in process `syz.3.894'. [ 62.113717][ T7083] netlink: 52 bytes leftover after parsing attributes in process `syz.1.907'. [ 62.211816][ T7096] batman_adv: batadv0: Adding interface: syzkaller0 [ 62.213027][ T7096] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.217434][ T7096] batman_adv: batadv0: Interface activated: syzkaller0 [ 62.220514][ T7095] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 62.271300][ T7095] batman_adv: batadv0: Removing interface: syzkaller0 [ 62.303422][ T7109] loop4: detected capacity change from 0 to 512 [ 62.355929][ T7109] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 62.422936][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 62.624878][ T7145] loop3: detected capacity change from 0 to 1024 [ 62.667755][ T7145] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 62.717368][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 62.816380][ C0] vxcan0: j1939_tp_rxtimer: 0x0000000067d68255: rx timeout, send abort [ 62.820155][ C0] vxcan0: j1939_xtp_rx_abort_one: 0x0000000067d68255: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 64.500350][ T2066] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.501485][ T2066] ieee802154 phy1 wpan1: encryption failed: -22 [ 69.622293][ T14] cfg80211: failed to load regulatory.db [ 73.590307][ T7244] netlink: 4 bytes leftover after parsing attributes in process `syz.4.941'. [ 73.653716][ T7244] netlink: 4 bytes leftover after parsing attributes in process `syz.4.941'. [ 74.032822][ T7244] netlink: 4 bytes leftover after parsing attributes in process `syz.4.941'. [ 74.046326][ T7263] FAULT_INJECTION: forcing a failure. [ 74.046326][ T7263] name failslab, interval 1, probability 0, space 0, times 0 [ 74.052081][ T7263] CPU: 0 PID: 7263 Comm: syz.3.947 Not tainted syzkaller #0 [ 74.053324][ T7263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 74.055178][ T7263] Call trace: [ 74.055774][ T7263] dump_backtrace+0x1c4/0x1f0 [ 74.056635][ T7263] show_stack+0x2c/0x3c [ 74.057363][ T7263] __dump_stack+0x30/0x40 [ 74.058113][ T7263] dump_stack_lvl+0xf4/0x15c [ 74.059090][ T7263] dump_stack+0x1c/0x5c [ 74.059983][ T7263] should_fail_ex+0x3cc/0x524 [ 74.060958][ T7263] __should_failslab+0xc0/0x11c [ 74.061961][ T7263] should_failslab+0x10/0x28 [ 74.062920][ T7263] __kmem_cache_alloc_node+0x7c/0x318 [ 74.064008][ T7263] kmalloc_node_trace+0x44/0x90 [ 74.064983][ T7263] __get_vm_area_node+0x14c/0x31c [ 74.065962][ T7263] __vmalloc_node_range+0x1d4/0xe70 [ 74.066992][ T7263] vmalloc+0x9c/0xd4 [ 74.067740][ T7263] bpf_jit_alloc_exec+0x20/0x30 [ 74.068667][ T7263] bpf_jit_binary_alloc+0xd8/0x1e8 [ 74.069591][ T7263] bpf_int_jit_compile+0xd2c/0x1090 [ 74.070521][ T7263] bpf_prog_select_runtime+0x3c4/0x698 [ 74.071509][ T7263] bpf_prepare_filter+0xd60/0xebc [ 74.072468][ T7263] bpf_prog_create_from_user+0x2cc/0x464 [ 74.073478][ T7263] do_seccomp+0x900/0xea4 [ 74.074231][ T7263] __arm64_sys_seccomp+0x7c/0x90 [ 74.075070][ T7263] invoke_syscall+0x98/0x290 [ 74.075853][ T7263] el0_svc_common+0x13c/0x258 [ 74.076683][ T7263] do_el0_svc+0x5c/0x134 [ 74.077440][ T7263] el0_svc+0x58/0x12c [ 74.078134][ T7263] el0t_64_sync_handler+0x84/0xf0 [ 74.079028][ T7263] el0t_64_sync+0x18c/0x190 [ 74.086212][ T7263] syz.3.947: vmalloc error: size 4096, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz3,mems_allowed=0 [ 74.089018][ T7263] CPU: 0 PID: 7263 Comm: syz.3.947 Not tainted syzkaller #0 [ 74.090460][ T7263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 74.092516][ T7263] Call trace: [ 74.093129][ T7263] dump_backtrace+0x1c4/0x1f0 [ 74.094032][ T7263] show_stack+0x2c/0x3c [ 74.094849][ T7263] __dump_stack+0x30/0x40 [ 74.095789][ T7263] dump_stack_lvl+0xf4/0x15c [ 74.096762][ T7263] dump_stack+0x1c/0x5c [ 74.097632][ T7263] warn_alloc+0x214/0x324 [ 74.098538][ T7263] __vmalloc_node_range+0x24c/0xe70 [ 74.099664][ T7263] vmalloc+0x9c/0xd4 [ 74.100480][ T7263] bpf_jit_alloc_exec+0x20/0x30 [ 74.101512][ T7263] bpf_jit_binary_alloc+0xd8/0x1e8 [ 74.102595][ T7263] bpf_int_jit_compile+0xd2c/0x1090 [ 74.103650][ T7263] bpf_prog_select_runtime+0x3c4/0x698 [ 74.104690][ T7263] bpf_prepare_filter+0xd60/0xebc [ 74.105633][ T7263] bpf_prog_create_from_user+0x2cc/0x464 [ 74.106670][ T7263] do_seccomp+0x900/0xea4 [ 74.107462][ T7263] __arm64_sys_seccomp+0x7c/0x90 [ 74.108359][ T7263] invoke_syscall+0x98/0x290 [ 74.109165][ T7263] el0_svc_common+0x13c/0x258 [ 74.110007][ T7263] do_el0_svc+0x5c/0x134 [ 74.110923][ T7263] el0_svc+0x58/0x12c [ 74.111791][ T7263] el0t_64_sync_handler+0x84/0xf0 [ 74.112758][ T7263] el0t_64_sync+0x18c/0x190 [ 74.117259][ T7263] Mem-Info: [ 74.117875][ T7263] active_anon:7772 inactive_anon:0 isolated_anon:0 [ 74.117875][ T7263] active_file:5070 inactive_file:2089 isolated_file:0 [ 74.117875][ T7263] unevictable:768 dirty:125 writeback:0 [ 74.117875][ T7263] slab_reclaimable:19066 slab_unreclaimable:101129 [ 74.117875][ T7263] mapped:32120 shmem:3805 pagetables:611 [ 74.117875][ T7263] sec_pagetables:0 bounce:0 [ 74.117875][ T7263] kernel_misc_reclaimable:0 [ 74.117875][ T7263] free:1432223 free_pcp:3569 free_cma:7360 [ 74.126180][ T7263] Node 0 active_anon:31136kB inactive_anon:0kB active_file:20280kB inactive_file:8356kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:128564kB dirty:508kB writeback:0kB shmem:15304kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:8288kB pagetables:2508kB sec_pagetables:0kB all_unreclaimable? no [ 74.134973][ T7263] Node 0 DMA free:3076864kB boost:0kB min:20720kB low:25900kB high:31080kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145728kB managed:3080192kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:29440kB [ 74.147047][ T7263] lowmem_reserve[]: 0 0 3532 3532 3532 [ 74.151247][ T7263] Node 0 Normal free:2652028kB boost:0kB min:24332kB low:30412kB high:36492kB reserved_highatomic:0KB active_anon:31036kB inactive_anon:0kB active_file:20280kB inactive_file:8356kB unevictable:3072kB writepending:508kB present:5242880kB managed:3620620kB mlocked:0kB bounce:0kB free_pcp:14040kB local_pcp:8924kB free_cma:0kB [ 74.156905][ T7263] lowmem_reserve[]: 0 0 0 0 0 [ 74.157740][ T7263] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 1*256kB (C) 1*512kB (C) 0*1024kB 0*2048kB 751*4096kB (MC) = 3076864kB [ 74.162260][ T7263] Node 0 Normal: 1493*4kB (UME) 823*8kB (UME) 259*16kB (UE) 268*32kB (UE) 43*64kB (UME) 18*128kB (UME) 13*256kB (UME) 8*512kB (UM) 5*1024kB (UME) 4*2048kB (UME) 635*4096kB (M) = 2652028kB [ 74.166635][ T7263] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 74.171208][ T7263] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=32768kB [ 74.173364][ T7263] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 74.175315][ T7263] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=64kB [ 74.177105][ T7263] 10985 total pagecache pages [ 74.177963][ T7263] 0 pages in swap cache [ 74.179604][ T7263] Free swap = 124740kB [ 74.180410][ T7263] Total swap = 124996kB [ 74.181140][ T7263] 2097152 pages RAM [ 74.181912][ T7263] 0 pages HighMem/MovableOnly [ 74.182730][ T7263] 421949 pages reserved [ 74.183613][ T7263] 8192 pages cma reserved [ 74.184404][ T7263] 0 pages hwpoisoned [ 74.391757][ T7281] tipc: Enabled bearer , priority 0 [ 74.494844][ T7292] loop4: detected capacity change from 0 to 512 [ 74.520891][ T7280] tipc: Disabling bearer [ 74.522721][ T7295] netlink: 4 bytes leftover after parsing attributes in process `syz.1.958'. [ 74.535865][ T7292] EXT4-fs error (device loop4): ext4_orphan_get:1409: inode #15: comm syz.4.957: inode has both inline data and extents flags [ 74.539913][ T7292] EXT4-fs error (device loop4): ext4_orphan_get:1414: comm syz.4.957: couldn't read orphan inode 15 (err -117) [ 74.545741][ T7292] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 74.561804][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 74.623746][ T7307] netlink: 4 bytes leftover after parsing attributes in process `syz.3.960'. [ 74.634144][ T7310] loop2: detected capacity change from 0 to 512 [ 74.644446][ T7295] netlink: 4 bytes leftover after parsing attributes in process `syz.1.958'. [ 74.649162][ T7310] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 74.682726][ T7310] bio_check_eod: 8151 callbacks suppressed [ 74.682740][ T7310] syz.2.961: attempt to access beyond end of device [ 74.682740][ T7310] loop2: rw=524288, sector=17179852706, nr_sectors = 16 limit=512 [ 74.703389][ T7310] syz.2.961: attempt to access beyond end of device [ 74.703389][ T7310] loop2: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 74.710916][ T7310] syz.2.961: attempt to access beyond end of device [ 74.710916][ T7310] loop2: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 74.716322][ T7310] syz.2.961: attempt to access beyond end of device [ 74.716322][ T7310] loop2: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 74.720971][ T7310] syz.2.961: attempt to access beyond end of device [ 74.720971][ T7310] loop2: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 74.724685][ T7310] syz.2.961: attempt to access beyond end of device [ 74.724685][ T7310] loop2: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 74.729890][ T7310] syz.2.961: attempt to access beyond end of device [ 74.729890][ T7310] loop2: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 74.732901][ T7310] syz.2.961: attempt to access beyond end of device [ 74.732901][ T7310] loop2: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 74.744407][ T7310] syz.2.961: attempt to access beyond end of device [ 74.744407][ T7310] loop2: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 74.751935][ T7317] syz.2.961: attempt to access beyond end of device [ 74.751935][ T7317] loop2: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 74.760231][ T7310] Buffer I/O error on dev loop2, logical block 17179852706, async page read [ 74.767149][ T7310] Buffer I/O error on dev loop2, logical block 17179852707, async page read [ 74.768643][ T7295] netlink: 4 bytes leftover after parsing attributes in process `syz.1.958'. [ 74.771062][ T7310] Buffer I/O error on dev loop2, logical block 17179852708, async page read [ 74.773054][ T7310] Buffer I/O error on dev loop2, logical block 17179852709, async page read [ 74.774953][ T7310] Buffer I/O error on dev loop2, logical block 17179852710, async page read [ 74.776546][ T7310] Buffer I/O error on dev loop2, logical block 17179852711, async page read [ 74.781800][ T7310] Buffer I/O error on dev loop2, logical block 17179852712, async page read [ 74.783823][ T7310] Buffer I/O error on dev loop2, logical block 17179852713, async page read [ 74.785664][ T7310] Buffer I/O error on dev loop2, logical block 17179852706, async page read [ 74.787380][ T7310] Buffer I/O error on dev loop2, logical block 17179852707, async page read [ 74.916859][ T7334] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.983018][ T7345] tipc: Enabled bearer , priority 0 [ 75.004229][ T7350] loop3: detected capacity change from 0 to 512 [ 75.044156][ T7350] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 75.091312][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 75.112912][ T7360] usb usb7: usbfs: process 7360 (syz.1.974) did not claim interface 0 before use [ 75.121474][ T7344] tipc: Disabling bearer [ 75.138809][ T7366] netlink: 4 bytes leftover after parsing attributes in process `syz.3.975'. [ 75.217805][ T7366] netlink: 4 bytes leftover after parsing attributes in process `syz.3.975'. [ 75.326614][ T7389] netlink: 8 bytes leftover after parsing attributes in process `syz.1.981'. [ 75.528197][ T7404] tipc: Enabled bearer , priority 0 [ 75.879621][ T7403] tipc: Disabling bearer [ 75.901037][ T7441] loop0: detected capacity change from 0 to 512 [ 76.143685][ T7472] loop2: detected capacity change from 0 to 512 [ 76.181393][ T7472] EXT4-fs error (device loop2): ext4_orphan_get:1409: inode #15: comm syz.2.1013: inode has both inline data and extents flags [ 76.208955][ T7472] EXT4-fs error (device loop2): ext4_orphan_get:1414: comm syz.2.1013: couldn't read orphan inode 15 (err -117) [ 76.212071][ T7472] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 76.245731][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 76.265883][ T7479] tipc: Enabled bearer , priority 0 [ 76.340240][ T7478] tipc: Disabling bearer [ 76.345101][ T7489] netem: change failed [ 76.394833][ T7489] device syzkaller0 entered promiscuous mode [ 76.441973][ T7489] tipc: Enabled bearer , priority 0 [ 76.453556][ T7489] tipc: Resetting bearer [ 76.457791][ T7487] tipc: Resetting bearer [ 76.489659][ T7487] tipc: Disabling bearer [ 76.688926][ T4330] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.692919][ T4330] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.695568][ T4330] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.697611][ T4330] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.703023][ T4330] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.704702][ T4330] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.951156][ T39] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.954980][ T7544] tipc: Enabled bearer , priority 0 [ 77.140467][ T39] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.191382][ T7534] tipc: Disabling bearer [ 77.203179][ T7524] rxe_eth0 speed is unknown, defaulting to 1000 [ 77.259824][ T39] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.393228][ T39] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.543522][ T7524] chnl_net:caif_netlink_parms(): no params data found [ 77.553694][ T7608] tipc: Enabled bearer , priority 0 [ 77.616243][ T7612] loop4: detected capacity change from 0 to 512 [ 77.641719][ T7612] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 77.664448][ T7612] EXT4-fs (loop4): 1 truncate cleaned up [ 77.665562][ T7612] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 77.729905][ T7604] tipc: Disabling bearer [ 77.753974][ T7524] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.756271][ T7524] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.761930][ T7524] device bridge_slave_0 entered promiscuous mode [ 77.766028][ T7524] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.767431][ T7524] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.770135][ T7524] device bridge_slave_1 entered promiscuous mode [ 77.782241][ T7524] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.789815][ T7524] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.813103][ T7524] team0: Port device team_slave_0 added [ 77.825968][ T7524] team0: Port device team_slave_1 added [ 77.836392][ T7524] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.846010][ T7524] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.853381][ T7524] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.856601][ T7524] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.859087][ T7524] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.863643][ T7524] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.896963][ T39] tipc: Left network mode [ 78.221558][ T7524] device hsr_slave_0 entered promiscuous mode [ 78.249258][ T7524] device hsr_slave_1 entered promiscuous mode [ 78.298320][ T7524] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.300766][ T7524] Cannot create hsr debugfs directory [ 78.581799][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 78.625700][ T7524] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 78.743285][ T7524] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 78.748532][ T4341] Bluetooth: hci1: command 0x0409 tx timeout [ 78.770311][ T7524] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 78.811344][ T7666] tipc: Enabling of bearer rejected, failed to enable media [ 78.871494][ T7524] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 79.158757][ T7524] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.204904][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 79.206540][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 79.227137][ T7524] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.247578][ T7731] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 79.289189][ T7731] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 79.318716][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.320778][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.322384][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.323588][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.325226][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 79.334805][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.338931][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.343102][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.344521][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.350292][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 79.355245][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 79.412665][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 79.417430][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.422526][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 79.430639][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 79.433146][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.444185][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 79.446451][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 79.464150][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 79.466299][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 79.565647][ T7524] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 79.602080][ T7771] loop1: detected capacity change from 0 to 1024 [ 79.605045][ T7771] EXT4-fs: Ignoring removed bh option [ 79.647715][ T7771] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 79.661417][ T7771] EXT4-fs: Remounting fs w/o journal so ignoring data_err option [ 79.667724][ T7771] EXT4-fs (loop1): re-mounted. Quota mode: none. [ 79.691866][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 79.740969][ T39] device hsr_slave_0 left promiscuous mode [ 79.746066][ T39] device hsr_slave_1 left promiscuous mode [ 79.749858][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 79.752171][ T39] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 79.754695][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 79.756237][ T39] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 79.758050][ T39] device bridge_slave_1 left promiscuous mode [ 79.761158][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.765516][ T39] device bridge_slave_0 left promiscuous mode [ 79.766846][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.783895][ T39] device veth1_macvtap left promiscuous mode [ 79.785805][ T39] device veth0_macvtap left promiscuous mode [ 79.787208][ T39] device veth1_vlan left promiscuous mode [ 79.791745][ T39] device veth0_vlan left promiscuous mode [ 80.093536][ T7737] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 80.111336][ T7737] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 80.111671][ T39] team0 (unregistering): Port device team_slave_1 removed [ 80.121652][ T7737] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 80.138093][ T7737] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 80.139845][ T7737] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 80.143027][ T39] team0 (unregistering): Port device team_slave_0 removed [ 80.145082][ T7737] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 80.155462][ T7737] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 80.156770][ T7737] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 80.167614][ T39] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 80.169945][ T7737] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 80.173298][ T7737] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 80.174639][ T7737] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 80.184604][ T7737] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 80.197040][ T7737] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 80.198829][ T7737] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 80.200926][ T39] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 80.202262][ T7737] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 81.458370][ T4341] Bluetooth: hci0: command 0x0c1a tx timeout [ 81.560416][ T39] bond0 (unregistering): Released all slaves [ 81.807357][ T7524] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.827166][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 81.828933][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 81.836442][ T7792] tipc: Enabling of bearer rejected, failed to enable media [ 81.934777][ T7821] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 81.967666][ T7821] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 82.039699][ T7829] loop2: detected capacity change from 0 to 4096 [ 82.057217][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 82.059224][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 82.067076][ T4931] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 82.069772][ T4931] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 82.079523][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 82.081725][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 82.085913][ T7524] device veth0_vlan entered promiscuous mode [ 82.095265][ T7524] device veth1_vlan entered promiscuous mode [ 82.136148][ T7829] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 82.188358][ T4330] Bluetooth: hci4: command 0x0c1a tx timeout [ 82.189562][ T4330] Bluetooth: hci3: command 0x0c1a tx timeout [ 82.190634][ T4330] Bluetooth: hci2: command 0x0c1a tx timeout [ 82.227801][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 82.229783][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 82.232041][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 82.233820][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 82.269319][ T4341] Bluetooth: hci1: command 0x040f tx timeout [ 82.609319][ T7524] device veth0_macvtap entered promiscuous mode [ 82.673054][ T7524] device veth1_macvtap entered promiscuous mode [ 82.681442][ T7524] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.690864][ T7524] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.695038][ T7524] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.698078][ T7524] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.702163][ T7524] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.706078][ T7524] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.709174][ T7524] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.711092][ T7524] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.714209][ T7524] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.717119][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 82.731628][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 82.733431][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 82.735820][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 82.737887][ T7864] tipc: Enabling of bearer rejected, failed to enable media [ 82.750725][ T7524] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.752679][ T7524] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.758480][ T7524] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.761043][ T7524] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.763272][ T7524] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.766216][ T7524] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.768629][ T7524] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.770982][ T7524] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.783759][ T7524] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.790681][ T4549] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 82.792873][ T4549] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 82.795243][ T7524] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.801318][ T7524] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.805202][ T7524] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.808362][ T7524] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.887646][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 83.003178][ T7891] loop4: detected capacity change from 0 to 1024 [ 83.004927][ T7891] EXT4-fs: Ignoring removed bh option [ 83.036924][ T7889] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 83.038590][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.039994][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.054720][ T7891] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 83.065458][ T7891] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 3: comm syz.4.1108: lblock 3 mapped to illegal pblock 3 (length 3) [ 83.075655][ T7891] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 83.078357][ T7891] EXT4-fs (loop4): This should not happen!! Data will be lost [ 83.078357][ T7891] [ 83.081027][ T7889] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 83.081843][ T7891] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: comm syz.4.1108: lblock 0 mapped to illegal pblock 0 (length 3) [ 83.086521][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 83.087284][ T7891] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 3 with error 117 [ 83.097368][ T7891] EXT4-fs (loop4): This should not happen!! Data will be lost [ 83.097368][ T7891] [ 83.109898][ T4931] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 7: comm kworker/u4:8: lblock 7 mapped to illegal pblock 7 (length 9) [ 83.112748][ T4931] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 7 with max blocks 9 with error 117 [ 83.115120][ T4931] EXT4-fs (loop4): This should not happen!! Data will be lost [ 83.115120][ T4931] [ 83.126097][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 83.201539][ T4931] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.203117][ T4931] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.205307][ T4549] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 83.391550][ T7922] loop1: detected capacity change from 0 to 4096 [ 83.454477][ T7922] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 83.548612][ T4330] Bluetooth: hci0: command 0x0406 tx timeout [ 83.563621][ T7937] tipc: Enabling of bearer rejected, failed to enable media [ 84.137098][ T7969] tipc: Enabling of bearer rejected, failed to enable media [ 84.147118][ T7971] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 84.188577][ T7971] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 84.223830][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 84.258409][ T4341] Bluetooth: hci2: command 0x0406 tx timeout [ 84.259591][ T4341] Bluetooth: hci3: command 0x0406 tx timeout [ 84.260737][ T4341] Bluetooth: hci4: command 0x0406 tx timeout [ 84.351143][ T4330] Bluetooth: hci1: command 0x0419 tx timeout [ 84.826985][ T8013] loop4: detected capacity change from 0 to 512 [ 84.889798][ T8013] EXT4-fs (loop4): 1 orphan inode deleted [ 84.890945][ T8013] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 84.910445][ T11] Quota error (device loop4): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 84.912447][ T11] EXT4-fs error (device loop4): ext4_release_dquot:6877: comm kworker/u4:1: Failed to release dquot type 1 [ 84.951342][ T8028] loop1: detected capacity change from 0 to 512 [ 84.959389][ T8028] EXT4-fs: Ignoring removed nobh option [ 84.962556][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 84.991043][ T8028] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.1139: invalid indirect mapped block 256 (level 2) [ 85.002128][ T8028] EXT4-fs (loop1): 2 truncates cleaned up [ 85.003350][ T8028] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 85.075849][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 85.094050][ T8037] loop4: detected capacity change from 0 to 4096 [ 85.118042][ T8037] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 85.618548][ T4341] Bluetooth: hci0: command 0x0406 tx timeout [ 85.638732][ T8060] tipc: Enabling of bearer rejected, failed to enable media [ 85.707219][ T8070] capability: warning: `syz.5.1151' uses deprecated v2 capabilities in a way that may be insecure [ 85.911165][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 86.442349][ T4330] Bluetooth: hci4: command 0x0406 tx timeout [ 86.443582][ T4330] Bluetooth: hci3: command 0x0406 tx timeout [ 86.444662][ T4330] Bluetooth: hci2: command 0x0406 tx timeout [ 86.445703][ T4330] Bluetooth: hci1: command 0x0c1a tx timeout [ 86.578016][ T8125] loop3: detected capacity change from 0 to 4096 [ 86.598334][ T8125] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 86.613855][ T8132] loop4: detected capacity change from 0 to 736 [ 86.655287][ T8137] tipc: Enabling of bearer rejected, failed to enable media [ 87.350969][ T8176] ip_tables: iptables: counters copy to user failed while replacing table [ 87.443261][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 87.881428][ T8197] ip_tables: iptables: counters copy to user failed while replacing table [ 87.971043][ T8205] tipc: Enabling of bearer rejected, failed to enable media [ 88.316829][ T8232] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 88.320838][ T8230] loop5: detected capacity change from 0 to 4096 [ 88.372583][ T8230] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 88.498527][ T4341] Bluetooth: hci1: command 0x0406 tx timeout [ 88.840062][ T8257] tipc: Enabling of bearer rejected, failed to enable media [ 89.174352][ T7524] EXT4-fs (loop5): unmounting filesystem. [ 89.287243][ T8244] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 89.288734][ T8244] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 89.289892][ T8244] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 89.290993][ T8244] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 89.292167][ T8244] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 89.366773][ T8270] loop5: detected capacity change from 0 to 4096 [ 89.421600][ T8270] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 89.425638][ T8285] __nla_validate_parse: 8 callbacks suppressed [ 89.425652][ T8285] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1220'. [ 90.216300][ T7524] EXT4-fs (loop5): unmounting filesystem. [ 90.319057][ T8309] team0: Device xfrm0 is of different type [ 90.401942][ T8318] tipc: Enabling of bearer rejected, failed to enable media [ 90.405154][ T8315] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1232'. [ 90.550567][ T8335] loop5: detected capacity change from 0 to 4096 [ 90.555135][ T8335] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 90.684201][ T8341] netlink: 'syz.1.1236': attribute type 27 has an invalid length. [ 90.685835][ T8341] netlink: 'syz.1.1236': attribute type 3 has an invalid length. [ 91.476573][ T4330] Bluetooth: hci1: command 0x0c1a tx timeout [ 91.477835][ T4330] Bluetooth: hci4: command 0x0c1a tx timeout [ 91.479246][ T4330] Bluetooth: hci3: command 0x0c1a tx timeout [ 91.480427][ T4330] Bluetooth: hci2: command 0x0c1a tx timeout [ 91.510605][ T7524] EXT4-fs (loop5): unmounting filesystem. [ 91.513625][ T8301] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 91.515054][ T8301] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 91.516453][ T8301] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 91.519294][ T8301] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 91.521735][ T8301] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 91.598174][ T8360] tipc: Enabling of bearer rejected, failed to enable media [ 91.600887][ T8359] loop3: detected capacity change from 0 to 2048 [ 91.693032][ T8359] loop3: p2 < > p3 p4 [ 91.696481][ T8359] loop3: p3 start 65535 is beyond EOD, truncated [ 91.697721][ T8359] loop3: p4 size 262144 extends beyond EOD, truncated [ 92.236329][ T8391] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1247'. [ 92.338343][ T4341] Bluetooth: hci0: command 0x0c1a tx timeout [ 92.389918][ T8398] loop3: detected capacity change from 0 to 4096 [ 92.415189][ T8398] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 92.548249][ T8405] netlink: 'syz.5.1251': attribute type 27 has an invalid length. [ 92.549760][ T8405] netlink: 'syz.5.1251': attribute type 3 has an invalid length. [ 93.306004][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 93.350172][ T8421] loop3: detected capacity change from 0 to 128 [ 93.398083][ T8421] bio_check_eod: 25154 callbacks suppressed [ 93.398098][ T8421] syz.3.1256: attempt to access beyond end of device [ 93.398098][ T8421] loop3: rw=0, sector=255508, nr_sectors = 2 limit=128 [ 93.495772][ T8433] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1262'. [ 93.548403][ T4330] Bluetooth: hci1: command 0x0c1a tx timeout [ 93.549723][ T4330] Bluetooth: hci4: command 0x0c1a tx timeout [ 93.550953][ T4330] Bluetooth: hci3: command 0x0c1a tx timeout [ 93.552002][ T4330] Bluetooth: hci2: command 0x0c1a tx timeout [ 93.661714][ T8449] tipc: Enabling of bearer rejected, failed to enable media [ 94.055738][ T8459] netlink: 'syz.4.1266': attribute type 27 has an invalid length. [ 94.057369][ T8459] netlink: 'syz.4.1266': attribute type 3 has an invalid length. [ 94.362465][ T8413] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 94.365141][ T8413] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 94.366542][ T8413] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 94.374211][ T8413] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 94.377670][ T8413] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 94.490741][ T8473] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1270'. [ 94.532285][ T8480] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1274'. [ 94.726939][ T8509] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1284'. [ 94.734004][ T8509] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1284'. [ 94.743004][ T8511] tipc: Enabling of bearer rejected, failed to enable media [ 94.743172][ T8509] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1284'. [ 94.752782][ T8509] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1284'. [ 94.817763][ T8521] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1287'. [ 94.904562][ T8529] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1289'. [ 95.353573][ T8557] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1303'. [ 95.476385][ T8495] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 95.479045][ T8495] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 95.480536][ T8495] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 95.481756][ T8495] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 95.482926][ T8495] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 95.590673][ T8571] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1309'. [ 95.659328][ T8579] loop1: detected capacity change from 0 to 512 [ 95.716203][ T8579] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 95.753400][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 96.658340][ T4330] Bluetooth: hci5: command 0x1003 tx timeout [ 96.658351][ T4341] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 96.741957][ T4341] Bluetooth: hci0: command 0x0c1a tx timeout [ 97.548437][ T4330] Bluetooth: hci1: command 0x0c1a tx timeout [ 97.549638][ T4330] Bluetooth: hci4: command 0x0c1a tx timeout [ 97.550740][ T4330] Bluetooth: hci3: command 0x0c1a tx timeout [ 97.551780][ T4330] Bluetooth: hci2: command 0x0c1a tx timeout [ 98.607769][ T8567] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 98.865924][ T8704] loop1: detected capacity change from 0 to 4096 [ 98.908691][ T8704] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 99.536865][ T8723] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.540507][ T8723] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.708692][ T8734] capability: warning: `syz.5.1340' uses 32-bit capabilities (legacy support in use) [ 99.713656][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 99.754684][ T8738] loop2: detected capacity change from 0 to 512 [ 99.758860][ T8736] tipc: Enabled bearer , priority 0 [ 99.761597][ T8738] EXT4-fs: Ignoring removed nobh option [ 99.770919][ T8738] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 99.782292][ T8738] EXT4-fs (loop2): 1 truncate cleaned up [ 99.783305][ T8738] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 99.801306][ T8747] loop1: detected capacity change from 0 to 1024 [ 99.871955][ T8747] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 99.894689][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 99.903418][ T8735] tipc: Disabling bearer [ 99.941033][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 100.045223][ T8768] process 'syz.3.1350' launched './file1' with NULL argv: empty string added [ 100.439012][ T8778] loop5: detected capacity change from 0 to 4096 [ 100.444101][ T8778] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 100.998872][ T8808] device syzkaller0 entered promiscuous mode [ 101.293677][ T7524] EXT4-fs (loop5): unmounting filesystem. [ 101.871476][ T8866] device syzkaller0 entered promiscuous mode [ 101.922319][ T8868] loop4: detected capacity change from 0 to 4096 [ 102.016680][ T8868] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 102.118813][ T8877] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 103.068624][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 103.138878][ T8891] FAULT_INJECTION: forcing a failure. [ 103.138878][ T8891] name failslab, interval 1, probability 0, space 0, times 0 [ 103.141861][ T8891] CPU: 1 PID: 8891 Comm: syz.1.1389 Not tainted syzkaller #0 [ 103.143157][ T8891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 103.144908][ T8891] Call trace: [ 103.145483][ T8891] dump_backtrace+0x1c4/0x1f0 [ 103.146328][ T8891] show_stack+0x2c/0x3c [ 103.147061][ T8891] __dump_stack+0x30/0x40 [ 103.147848][ T8891] dump_stack_lvl+0xf4/0x15c [ 103.148826][ T8891] dump_stack+0x1c/0x5c [ 103.149630][ T8891] should_fail_ex+0x3cc/0x524 [ 103.150492][ T8891] __should_failslab+0xc0/0x11c [ 103.151387][ T8891] should_failslab+0x10/0x28 [ 103.152230][ T8891] kmem_cache_alloc+0x88/0x310 [ 103.153114][ T8891] __kernfs_new_node+0xec/0x5fc [ 103.153979][ T8891] kernfs_new_node+0x120/0x230 [ 103.154832][ T8891] __kernfs_create_file+0x60/0x2e0 [ 103.155766][ T8891] sysfs_add_file_mode_ns+0x1e8/0x2a4 [ 103.156739][ T8891] sysfs_create_file_ns+0x10c/0x19c [ 103.157659][ T8891] driver_create_file+0x54/0x70 [ 103.158561][ T8891] bus_add_driver+0x31c/0x518 [ 103.159358][ T8891] driver_register+0x200/0x37c [ 103.160209][ T8891] usb_gadget_register_driver_owner+0xf0/0x25c [ 103.161339][ T8891] raw_ioctl+0x1014/0x326c [ 103.162305][ T8891] __arm64_sys_ioctl+0x14c/0x1c8 [ 103.163355][ T8891] invoke_syscall+0x98/0x290 [ 103.164173][ T8891] el0_svc_common+0x13c/0x258 [ 103.165163][ T8891] do_el0_svc+0x5c/0x134 [ 103.166060][ T8891] el0_svc+0x58/0x12c [ 103.166909][ T8891] el0t_64_sync_handler+0x84/0xf0 [ 103.167952][ T8891] el0t_64_sync+0x18c/0x190 [ 103.188522][ T8891] bus_add_driver: uevent attr (raw-gadget.0) failed [ 103.195202][ T8891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.198122][ T8891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 103.237920][ T8904] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1395'. [ 103.315102][ T8912] loop3: detected capacity change from 0 to 4096 [ 103.374197][ T8912] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 103.659718][ T8914] device syzkaller0 entered promiscuous mode [ 104.221417][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 104.357676][ T8950] loop4: detected capacity change from 0 to 164 [ 104.404995][ T8950] rock: corrupted directory entry. extent=41 out of volume (nzones=41) [ 104.447009][ T8955] loop2: detected capacity change from 0 to 4096 [ 104.754317][ T8955] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 105.313534][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 105.372728][ T8982] device syzkaller0 entered promiscuous mode [ 105.415680][ T8990] FAULT_INJECTION: forcing a failure. [ 105.415680][ T8990] name failslab, interval 1, probability 0, space 0, times 0 [ 105.418755][ T8990] CPU: 0 PID: 8990 Comm: syz.2.1430 Not tainted syzkaller #0 [ 105.420123][ T8990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 105.421983][ T8990] Call trace: [ 105.422584][ T8990] dump_backtrace+0x1c4/0x1f0 [ 105.423464][ T8990] show_stack+0x2c/0x3c [ 105.424260][ T8990] __dump_stack+0x30/0x40 [ 105.425051][ T8990] dump_stack_lvl+0xf4/0x15c [ 105.425890][ T8990] dump_stack+0x1c/0x5c [ 105.426645][ T8990] should_fail_ex+0x3cc/0x524 [ 105.427493][ T8990] __should_failslab+0xc0/0x11c [ 105.428356][ T8990] should_failslab+0x10/0x28 [ 105.429184][ T8990] slab_pre_alloc_hook+0x6c/0x31c [ 105.430091][ T8990] kmem_cache_alloc_lru+0x60/0x284 [ 105.431015][ T8990] proc_alloc_inode+0x2c/0xb8 [ 105.431849][ T8990] new_inode_pseudo+0x68/0x1cc [ 105.432661][ T8990] new_inode+0x38/0x174 [ 105.434648][ T8990] proc_pid_make_inode+0x30/0x1a8 [ 105.435563][ T8990] proc_pident_instantiate+0x6c/0x274 [ 105.436563][ T8990] proc_pident_lookup+0x18c/0x268 [ 105.437521][ T8990] proc_tgid_base_lookup+0x34/0x44 [ 105.437565][ T8990] __lookup_slow+0x25c/0x38c [ 105.439501][ T8990] lookup_slow+0x60/0x84 [ 105.439516][ T8990] link_path_walk+0x818/0xcd8 [ 105.439530][ T8990] path_openat+0x1c0/0x27a0 [ 105.439539][ T8990] do_filp_open+0x198/0x38c [ 105.442848][ T8990] do_sys_openat2+0x134/0x3fc [ 105.442865][ T8990] __arm64_sys_openat+0x11c/0x150 [ 105.442879][ T8990] invoke_syscall+0x98/0x290 [ 105.442891][ T8990] el0_svc_common+0x13c/0x258 [ 105.446530][ T8990] do_el0_svc+0x5c/0x134 [ 105.446550][ T8990] el0_svc+0x58/0x12c [ 105.446559][ T8990] el0t_64_sync_handler+0x84/0xf0 [ 105.448993][ T8990] el0t_64_sync+0x18c/0x190 [ 105.587141][ T9001] FAULT_INJECTION: forcing a failure. [ 105.587141][ T9001] name fail_futex, interval 1, probability 0, space 0, times 0 [ 105.878350][ T9001] CPU: 0 PID: 9001 Comm: syz.1.1434 Not tainted syzkaller #0 [ 105.879829][ T9001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 105.881641][ T9001] Call trace: [ 105.882232][ T9001] dump_backtrace+0x1c4/0x1f0 [ 105.883114][ T9001] show_stack+0x2c/0x3c [ 105.883866][ T9001] __dump_stack+0x30/0x40 [ 105.884667][ T9001] dump_stack_lvl+0xf4/0x15c [ 105.885523][ T9001] dump_stack+0x1c/0x5c [ 105.886308][ T9001] should_fail_ex+0x3cc/0x524 [ 105.887152][ T9001] should_fail+0x14/0x24 [ 105.887902][ T9001] get_futex_key+0x904/0xfb0 [ 105.888697][ T9001] futex_wake+0x10c/0x458 [ 105.889457][ T9001] do_futex+0x2c4/0x340 [ 105.890213][ T9001] __arm64_sys_futex+0x390/0x414 [ 105.891117][ T9001] invoke_syscall+0x98/0x290 [ 105.891922][ T9001] el0_svc_common+0x13c/0x258 [ 105.892768][ T9001] do_el0_svc+0x5c/0x134 [ 105.893533][ T9001] el0_svc+0x58/0x12c [ 105.894239][ T9001] el0t_64_sync_handler+0x84/0xf0 [ 105.895123][ T9001] el0t_64_sync+0x18c/0x190 [ 105.953327][ T9006] loop5: detected capacity change from 0 to 4096 [ 106.001859][ T9006] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 106.594329][ T9027] ieee802154 phy1 wpan1: encryption failed: -22 [ 106.805560][ T7524] EXT4-fs (loop5): unmounting filesystem. [ 106.809663][ T9039] device syzkaller0 entered promiscuous mode [ 107.280607][ T9061] loop4: detected capacity change from 0 to 136 [ 107.432127][ T9068] loop3: detected capacity change from 0 to 4096 [ 107.435831][ T9070] loop4: detected capacity change from 0 to 4096 [ 107.453538][ T9070] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 107.460717][ T9068] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 108.537846][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 108.678915][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 108.771508][ T9102] loop2: detected capacity change from 0 to 512 [ 108.787269][ T9106] device syzkaller0 entered promiscuous mode [ 108.811618][ T9102] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 108.840603][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 108.912292][ T9113] loop2: detected capacity change from 0 to 4096 [ 108.927459][ T9113] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 109.473301][ T9129] device syzkaller0 entered promiscuous mode [ 109.527616][ T9132] loop4: detected capacity change from 0 to 4096 [ 109.552050][ T9132] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 110.047740][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 110.302451][ T9164] device syzkaller0 entered promiscuous mode [ 110.393119][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 110.435419][ T9168] loop4: detected capacity change from 0 to 4096 [ 110.461493][ T9168] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 111.123845][ T9198] loop2: detected capacity change from 0 to 4096 [ 111.146157][ T9198] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 111.172495][ T9203] device syzkaller0 entered promiscuous mode [ 111.291591][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 111.958786][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 112.086119][ T9239] loop1: detected capacity change from 0 to 4096 [ 112.112997][ T9239] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 112.704099][ T9255] device syzkaller0 entered promiscuous mode [ 112.919438][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 113.237334][ T9293] loop5: detected capacity change from 0 to 512 [ 113.259652][ T9293] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 113.264609][ T9293] EXT4-fs error (device loop5): __ext4_find_entry:1698: inode #2: comm syz.5.1547: checksumming directory block 0 [ 113.294149][ T7524] EXT4-fs (loop5): unmounting filesystem. [ 113.535604][ T9309] device syzkaller0 entered promiscuous mode [ 113.644226][ T9311] loop4: detected capacity change from 0 to 4096 [ 113.676273][ T9311] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 114.170844][ T9328] nftables ruleset with unbound chain [ 114.494778][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 114.561648][ T9358] device syzkaller0 entered promiscuous mode [ 114.656637][ T9370] FAULT_INJECTION: forcing a failure. [ 114.656637][ T9370] name failslab, interval 1, probability 0, space 0, times 0 [ 114.661424][ T9370] CPU: 1 PID: 9370 Comm: syz.2.1580 Not tainted syzkaller #0 [ 114.662858][ T9370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 114.664636][ T9370] Call trace: [ 114.665217][ T9370] dump_backtrace+0x1c4/0x1f0 [ 114.666047][ T9370] show_stack+0x2c/0x3c [ 114.666786][ T9370] __dump_stack+0x30/0x40 [ 114.667563][ T9370] dump_stack_lvl+0xf4/0x15c [ 114.668382][ T9370] dump_stack+0x1c/0x5c [ 114.669126][ T9370] should_fail_ex+0x3cc/0x524 [ 114.669996][ T9370] __should_failslab+0xc0/0x11c [ 114.670903][ T9370] should_failslab+0x10/0x28 [ 114.671761][ T9370] kmem_cache_alloc+0x88/0x310 [ 114.672648][ T9370] vm_area_dup+0x30/0x1c4 [ 114.673397][ T9370] copy_mm+0x828/0x1208 [ 114.674129][ T9370] copy_process+0x16d8/0x38b4 [ 114.674995][ T9370] kernel_clone+0x1ec/0x938 [ 114.675808][ T9370] __arm64_sys_clone+0x15c/0x1c8 [ 114.676688][ T9370] invoke_syscall+0x98/0x290 [ 114.677502][ T9370] el0_svc_common+0x13c/0x258 [ 114.678318][ T9370] do_el0_svc+0x5c/0x134 [ 114.679085][ T9370] el0_svc+0x58/0x12c [ 114.679771][ T9370] el0t_64_sync_handler+0x84/0xf0 [ 114.680638][ T9370] el0t_64_sync+0x18c/0x190 [ 114.772685][ T9377] loop4: detected capacity change from 0 to 4096 [ 114.789895][ T9377] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 114.803888][ T9382] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1585'. [ 115.394996][ T9405] loop3: detected capacity change from 0 to 512 [ 115.396371][ T9409] device syzkaller0 entered promiscuous mode [ 115.436738][ T9405] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.1594: bg 0: block 5: invalid block bitmap [ 115.441099][ T9405] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 115.444085][ T9405] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.1594: invalid indirect mapped block 3 (level 2) [ 115.446684][ T9405] EXT4-fs (loop3): 1 orphan inode deleted [ 115.447834][ T9405] EXT4-fs (loop3): 1 truncate cleaned up [ 115.451823][ T9405] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 115.619361][ T4334] EXT4-fs (loop4): unmounting filesystem. [ 115.690208][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 115.791028][ T9433] loop2: detected capacity change from 0 to 164 [ 116.067334][ T9452] device syzkaller0 entered promiscuous mode [ 116.134485][ T9454] loop5: detected capacity change from 0 to 4096 [ 116.160306][ T9454] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 116.194042][ T9460] loop1: detected capacity change from 0 to 4096 [ 116.232068][ T9460] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 117.062108][ C0] [ 117.062647][ C0] ================================ [ 117.063533][ C0] WARNING: inconsistent lock state [ 117.064549][ C0] syzkaller #0 Not tainted [ 117.065434][ C0] -------------------------------- [ 117.066399][ C0] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. [ 117.067740][ C0] ksoftirqd/0/15 [HC0[0]:SC1[1]:HE1:SE0] takes: [ 117.068993][ C0] ffff0000d3fee130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x114/0x2a0 [ 117.070895][ C0] {SOFTIRQ-ON-W} state was registered at: [ 117.072080][ C0] lock_acquire+0x210/0x63c [ 117.073047][ C0] lock_sock_nested+0x70/0x130 [ 117.073936][ C0] x25_bind+0x1b4/0x3d4 [ 117.074731][ C0] __sys_bind+0x1f8/0x2a4 [ 117.075551][ C0] __arm64_sys_bind+0x7c/0x94 [ 117.076458][ C0] invoke_syscall+0x98/0x290 [ 117.077355][ C0] el0_svc_common+0x13c/0x258 [ 117.078306][ C0] do_el0_svc+0x5c/0x134 [ 117.079172][ C0] el0_svc+0x58/0x12c [ 117.079962][ C0] el0t_64_sync_handler+0x84/0xf0 [ 117.080986][ C0] el0t_64_sync+0x18c/0x190 [ 117.081820][ C0] irq event stamp: 1399458 [ 117.082629][ C0] hardirqs last enabled at (1399458): [] __local_bh_enable_ip+0x1f8/0x37c [ 117.084432][ C0] hardirqs last disabled at (1399457): [] __local_bh_enable_ip+0x178/0x37c [ 117.086171][ C0] softirqs last enabled at (1398702): [] handle_softirqs+0xb1c/0xc90 [ 117.087895][ C0] softirqs last disabled at (1398709): [] run_ksoftirqd+0x7c/0x2ac [ 117.089584][ C0] [ 117.089584][ C0] other info that might help us debug this: [ 117.091031][ C0] Possible unsafe locking scenario: [ 117.091031][ C0] [ 117.092375][ C0] CPU0 [ 117.092942][ C0] ---- [ 117.093521][ C0] lock(sk_lock-AF_X25); [ 117.094265][ C0] [ 117.094877][ C0] lock(sk_lock-AF_X25); [ 117.095656][ C0] [ 117.095656][ C0] *** DEADLOCK *** [ 117.095656][ C0] [ 117.097060][ C0] 1 lock held by ksoftirqd/0/15: [ 117.097927][ C0] #0: ffff8000165f7500 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 [ 117.099619][ C0] [ 117.099619][ C0] stack backtrace: [ 117.100655][ C0] CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 [ 117.101993][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 117.103845][ C0] Call trace: [ 117.104454][ C0] dump_backtrace+0x1c4/0x1f0 [ 117.105312][ C0] show_stack+0x2c/0x3c [ 117.106073][ C0] __dump_stack+0x30/0x40 [ 117.106897][ C0] dump_stack_lvl+0xf4/0x15c [ 117.107711][ C0] dump_stack+0x1c/0x5c [ 117.108490][ C0] print_usage_bug+0x4cc/0x6e8 [ 117.109354][ C0] mark_lock_irq+0x858/0xab8 [ 117.110189][ C0] mark_lock+0x224/0x320 [ 117.110961][ C0] __lock_acquire+0xc70/0x7280 [ 117.111837][ C0] lock_acquire+0x210/0x63c [ 117.112634][ C0] lock_sock_nested+0x70/0x130 [ 117.113477][ C0] x25_kill_by_neigh+0x114/0x2a0 [ 117.114391][ C0] x25_link_terminated+0x5c/0x78 [ 117.115296][ C0] x25_lapb_receive_frame+0x140/0xd0c [ 117.116212][ C0] netif_receive_skb_core+0x160/0x244 [ 117.117166][ C0] lapbeth_napi_poll+0x48/0xa0 [ 117.118001][ C0] __napi_poll+0xb8/0x3f4 [ 117.118730][ C0] net_rx_action+0x52c/0xb5c [ 117.119517][ C0] handle_softirqs+0x318/0xc90 [ 117.120349][ C0] run_ksoftirqd+0x7c/0x2ac [ 117.121130][ C0] smpboot_thread_fn+0x4e8/0x960 [ 117.122293][ C0] kthread+0x254/0x2e0 [ 117.123035][ C0] ret_from_fork+0x10/0x20 [ 117.123889][ C0] BUG: sleeping function called from invalid context at net/core/sock.c:3506 [ 117.125342][ C0] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15, name: ksoftirqd/0 [ 117.127027][ C0] preempt_count: 100, expected: 0 [ 117.127931][ C0] RCU nest depth: 1, expected: 0 [ 117.128883][ C0] INFO: lockdep is turned off. [ 117.129735][ C0] Preemption disabled at: [ 117.129748][ C0] [] handle_softirqs+0xe8/0xc90 [ 117.131757][ C0] CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 [ 117.133119][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 117.134882][ C0] Call trace: [ 117.135447][ C0] dump_backtrace+0x1c4/0x1f0 [ 117.136284][ C0] show_stack+0x2c/0x3c [ 117.137015][ C0] __dump_stack+0x30/0x40 [ 117.137785][ C0] dump_stack_lvl+0xf4/0x15c [ 117.138620][ C0] dump_stack+0x1c/0x5c [ 117.139360][ C0] __might_resched+0x354/0x4e0 [ 117.140221][ C0] __might_sleep+0x94/0x110 [ 117.141083][ C0] lock_sock_nested+0x80/0x130 [ 117.141957][ C0] x25_kill_by_neigh+0x114/0x2a0 [ 117.142861][ C0] x25_link_terminated+0x5c/0x78 [ 117.143736][ C0] x25_lapb_receive_frame+0x140/0xd0c [ 117.144699][ C0] netif_receive_skb_core+0x160/0x244 [ 117.145668][ C0] lapbeth_napi_poll+0x48/0xa0 [ 117.146523][ C0] __napi_poll+0xb8/0x3f4 [ 117.147313][ C0] net_rx_action+0x52c/0xb5c [ 117.148147][ C0] handle_softirqs+0x318/0xc90 [ 117.148981][ C0] run_ksoftirqd+0x7c/0x2ac [ 117.149789][ C0] smpboot_thread_fn+0x4e8/0x960 [ 117.150680][ C0] kthread+0x254/0x2e0 [ 117.151391][ C0] ret_from_fork+0x10/0x20 [ 117.158343][ T7524] EXT4-fs (loop5): unmounting filesystem. [ 117.322956][ T4329] EXT4-fs (loop1): unmounting filesystem. [ 125.938617][ T2066] ieee802154 phy1 wpan1: encryption failed: -22