last executing test programs: 1m32.404603593s ago: executing program 1 (id=2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000004c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000500)={0xa, 0x4e23, 0x800, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000005c0), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000600)=@ccm_128={{0x303}, "ee3fa66fbf0f9e55", "a5656c2128eda9fbb14b7442bc5fc5e4", "1d8faf68", "edf7bd5bfadea811"}, 0x28) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000006c0)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f3317000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4004010) 1m31.375966538s ago: executing program 1 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./file0\x00', 0x0) mkdir(&(0x7f0000000840)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000880)='./bus\x00', &(0x7f0000020780), 0x8, &(0x7f00000207c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000020800)='./file0\x00', 0x0, 0x41) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000020840)={0x8}) chdir(&(0x7f0000020880)='./bus\x00') setxattr$system_posix_acl(&(0x7f00000202c0)='.\x00', &(0x7f0000020300)='system.posix_acl_default\x00', &(0x7f0000020340)={{}, {0x1, 0x4}, [], {}, [], {}, {0x20, 0x6}}, 0x24, 0x3) 1m31.223625623s ago: executing program 1 (id=15): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x3, @remote, 'ip6_vti0\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl(r1, 0x40047438, &(0x7f0000000040)) pselect6(0x40, &(0x7f0000000340)={0x0, 0x0, 0x1, 0x0, 0x800, 0x0, 0x100001, 0x5}, 0x0, &(0x7f0000000380)={0x1f, 0x2, 0xffff, 0x3, 0x40004, 0x80000000000000, 0x6a9}, &(0x7f0000000500)={0x0, 0x3938700}, 0x0) 1m31.076075649s ago: executing program 1 (id=17): syz_mount_image$hfsplus(&(0x7f0000004540), &(0x7f0000004580)='./file0\x00', 0x0, &(0x7f00000045c0)={[{}, {@part={'part', 0x3d, 0x7}}, {@nls={'nls', 0x3d, 'iso8859-6'}}]}, 0x1, 0x5f0, &(0x7f0000004600)="$eJzs3c1rHOcdB/DvjF6sdcFREjtJ3UJECsXExNaLSVsoVC2m6BBMoJdcRS3HwmsnSJui5FDU4j8kPainHHopgdJDKD73kH9A0GOh0KPoRWVmZ19sS7KUWNIq/nzQs/OMnpnf/OanmQftSLABXlhLH2RiM0WWrr63Ua1vby20t7cW7vf6Sc4lKeuvjFfdfyVjD5OZdFu+n6RowhX7HefL+S8uf31r40p3rWxavf3YQfsdzmbTstgkufgc4z361vGK/hlWQW/2go+C3Wf77zEefuwYY3MExT4/i+nkfJKpZh7oXbjlyWb3/I3MDQgAAADH6KWd7GQjF047DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADhLms//L5pW9vozKXqf/z/ZfC9N/0z76rQTAAAAAAAAAIDn4M2d7GQjF3rru0X9N/+36pWL9ev38knWs5K1XMtGltNJJ2uZSzLd3af+Z4DJjeVOZ23uEHvOD/bMYM/5kztnAAAAAAAAAPgO+mOWBn//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUVAkY91F3S72+tMpx5NMJZmstttM/t7rn2VfnXYCAAAAcAJe2slONnKht75b1O/5X6vf90/lkzxIJ6vppJ2V3K6fBXTf9ZfbWwvt7a2F+1V7Ou4v/3OkNOqI6T572PvIs/UWl/p7LOXX+U2uZibv7+5mNb/LcjpZyUxu1r3lFJlunl5M9/LcO9/Fx9bef1aub9SZtHInq3Vu1/LbfJR2bqesz6He5uAj/qGqTvGLxiFrdLtZFknxg+bMRsN0XZGJfkVmm9pX1Xj54Eo8fp2URz3SXMr+M6iLx1Dz882yqvnU6NV8Iv1KzA9dfa8dXInknc5f37zbfnDv7p31q6NzSt/Qk9fEwlAlXn+hKjHZVKM7i+4zW2Ztz9nyrXrfC1nNrXyU21nJT/Ju5uu2UC+H63rpEPdaebR77UdXms4rSdHqLkdEVdeXh+o6PNNN12PD3xlU6ZXnPyONX246Y0kx3s9pFDxZibmhSrx6cCX+tFu9rrcf3Fu7u/zxIY/342ZZzc3nRmpunmyu3vF67fGroxp7dc+xuXrsYn+sfGrsUn/sWXfqZPM73NOR5uux1/cc6+73xtDYXr/lADDyzr99frL179Y/W5+3Hrbutt6b+tW5n5774WQmHo3/bewv5Z/Lnxdv5/P8fvD+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+ObWP/3s3nK7vbKmc6Y7483Pc1Ty0TnrnSdniqmTn5w4dtc79z++vv7pZ++s3l/+cOXDlQc3Zufn3r0x97Mb1++stldmu6+nnSXHZXDTn3YmAAAAAAAAAAAAHMVJ/DvpaZ8jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ8fSB5nYTJG52Wuz1fr21kK7ar3+YMsyyXi1/F8y9jCZSbdleihcsd9xvpz/4vLXtzauDGKVve3Hkvzj253FZtOy2CS5+OQWrWcHKfeJ92iveEdS9CtTBb3ZCw6n7f8BAAD//21RHVg=") mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write$cgroup_int(r0, &(0x7f0000000100)=0x9, 0x12) mknod(&(0x7f0000000280)='./bus\x00', 0xc000, 0x2000008) 1m30.450952423s ago: executing program 1 (id=21): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x3, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180)={0x0, 0x0}, 0x8) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000380)=r0, 0x4) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000003c0)={r1, 0x20, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}}, 0x10) 1m29.068473534s ago: executing program 1 (id=24): socket(0x2, 0x3, 0x67) r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x70, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x50, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x3c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_GRE_LOCAL={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x15}}, @IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x43}]}}}]}, 0x70}}, 0x0) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x7, r2, 0x1, 0x0, 0x6, @local}, 0x14) 1m28.922762649s ago: executing program 32 (id=24): socket(0x2, 0x3, 0x67) r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x70, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x50, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x3c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_GRE_LOCAL={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x15}}, @IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x43}]}}}]}, 0x70}}, 0x0) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x7, r2, 0x1, 0x0, 0x6, @local}, 0x14) 48.670125614s ago: executing program 3 (id=272): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r1}, 0x4) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x3b8001}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x19, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r2}, 0xc) 48.495731652s ago: executing program 3 (id=273): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x44, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r3, {0xfff1}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7fffffff}]}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) 48.22063343s ago: executing program 3 (id=275): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x8000}, 0x20000001) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) socket$inet6_udp(0xa, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='net/vlan/vlan1\x00') 47.612537262s ago: executing program 3 (id=277): syz_mount_image$hfsplus(&(0x7f0000004540), &(0x7f0000004580)='./file0\x00', 0x0, &(0x7f00000045c0)={[{}, {@part={'part', 0x3d, 0x7}}, {@nls={'nls', 0x3d, 'iso8859-6'}}]}, 0x1, 0x5f0, &(0x7f0000004600)="$eJzs3c1rHOcdB/DvjF6sdcFREjtJ3UJECsXExNaLSVsoVC2m6BBMoJdcRS3HwmsnSJui5FDU4j8kPainHHopgdJDKD73kH9A0GOh0KPoRWVmZ19sS7KUWNIq/nzQs/OMnpnf/OanmQftSLABXlhLH2RiM0WWrr63Ua1vby20t7cW7vf6Sc4lKeuvjFfdfyVjD5OZdFu+n6RowhX7HefL+S8uf31r40p3rWxavf3YQfsdzmbTstgkufgc4z361vGK/hlWQW/2go+C3Wf77zEefuwYY3MExT4/i+nkfJKpZh7oXbjlyWb3/I3MDQgAAADH6KWd7GQjF047DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADhLms//L5pW9vozKXqf/z/ZfC9N/0z76rQTAAAAAAAAAIDn4M2d7GQjF3rru0X9N/+36pWL9ev38knWs5K1XMtGltNJJ2uZSzLd3af+Z4DJjeVOZ23uEHvOD/bMYM/5kztnAAAAAAAAAPgO+mOWBn//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUVAkY91F3S72+tMpx5NMJZmstttM/t7rn2VfnXYCAAAAcAJe2slONnKht75b1O/5X6vf90/lkzxIJ6vppJ2V3K6fBXTf9ZfbWwvt7a2F+1V7Ou4v/3OkNOqI6T572PvIs/UWl/p7LOXX+U2uZibv7+5mNb/LcjpZyUxu1r3lFJlunl5M9/LcO9/Fx9bef1aub9SZtHInq3Vu1/LbfJR2bqesz6He5uAj/qGqTvGLxiFrdLtZFknxg+bMRsN0XZGJfkVmm9pX1Xj54Eo8fp2URz3SXMr+M6iLx1Dz882yqvnU6NV8Iv1KzA9dfa8dXInknc5f37zbfnDv7p31q6NzSt/Qk9fEwlAlXn+hKjHZVKM7i+4zW2Ztz9nyrXrfC1nNrXyU21nJT/Ju5uu2UC+H63rpEPdaebR77UdXms4rSdHqLkdEVdeXh+o6PNNN12PD3xlU6ZXnPyONX246Y0kx3s9pFDxZibmhSrx6cCX+tFu9rrcf3Fu7u/zxIY/342ZZzc3nRmpunmyu3vF67fGroxp7dc+xuXrsYn+sfGrsUn/sWXfqZPM73NOR5uux1/cc6+73xtDYXr/lADDyzr99frL179Y/W5+3Hrbutt6b+tW5n5774WQmHo3/bewv5Z/Lnxdv5/P8fvD+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+ObWP/3s3nK7vbKmc6Y7483Pc1Ty0TnrnSdniqmTn5w4dtc79z++vv7pZ++s3l/+cOXDlQc3Zufn3r0x97Mb1++stldmu6+nnSXHZXDTn3YmAAAAAAAAAAAAHMVJ/DvpaZ8jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ8fSB5nYTJG52Wuz1fr21kK7ar3+YMsyyXi1/F8y9jCZSbdleihcsd9xvpz/4vLXtzauDGKVve3Hkvzj253FZtOy2CS5+OQWrWcHKfeJ92iveEdS9CtTBb3ZCw6n7f8BAAD//21RHVg=") mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write$cgroup_int(r0, &(0x7f0000000100)=0x9, 0x12) mknod(&(0x7f0000000280)='./bus\x00', 0xc000, 0x2000008) 47.018716353s ago: executing program 3 (id=282): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000c40)='./binderfs/binder0\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000a80)='./file0\x00', 0x102) r1 = open$dir(&(0x7f0000000ac0)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x2, 0x4, &(0x7f0000000bc0)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r0, &(0x7f0000000c40)=ANY=[], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000c80)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000cc0)='./file0\x00', &(0x7f0000000d00)=[0x5], 0x0, 0x0, 0x2000000000000080, 0x1}}, 0x40) 46.584666557s ago: executing program 3 (id=289): openat(0xffffffffffffffff, 0x0, 0x10800, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000540)='proc\x00', 0x10000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000005c0)='27', 0x2) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) 46.187283098s ago: executing program 33 (id=289): openat(0xffffffffffffffff, 0x0, 0x10800, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000540)='proc\x00', 0x10000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000005c0)='27', 0x2) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) 44.730891247s ago: executing program 4 (id=300): mknodat$null(0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00', 0x2000, 0x103) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000800)='.\x00', 0x0, 0x11) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x1, 0x4800003e, r0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./file0\x00', 0x80042, 0x0) io_setup(0x3, &(0x7f0000000880)=0x0) io_submit(r3, 0x1, &(0x7f00000008c0)=[&(0x7f0000000900)={0x0, 0x0, 0x10, 0x7, 0x0, r2, 0x0, 0x0, 0x6fa, 0x0, 0x2, r2}]) 44.477635463s ago: executing program 4 (id=302): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000200)={0x3fff}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) write(r0, &(0x7f0000000040)="33000000080006010100ffc00201", 0xe) 44.220602319s ago: executing program 4 (id=304): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x64}]}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x42}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xdc}}, 0x8040) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2, 0x400000000000003, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfbffffff}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @empty}}]}, 0x50}}, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) 43.256661238s ago: executing program 4 (id=310): r0 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x800, 0xffffba5e) rename(&(0x7f0000000140)='./file0\x00', &(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 43.164770567s ago: executing program 4 (id=311): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x17f) mount(0x0, &(0x7f0000000040)='./mysys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x4000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) 42.956566158s ago: executing program 4 (id=314): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000002000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b"], 0x0}, 0x94) r0 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000400)=0x6, 0x4) setsockopt$inet_int(r0, 0x0, 0x19, &(0x7f0000000580)=0x400030, 0x4) bind$inet(r0, &(0x7f00000005c0)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000600)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) 29.123115173s ago: executing program 5 (id=372): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/netdevsim/devices/netdevsim0/new_port\x00', 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r1, &(0x7f0000000440)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18e0688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc7fbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc0fa31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae1786a46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4cc05c8c8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212ee01af2e49bbeb0a27e07c5714b74e373798c7bebce265f700ef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c075aacfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba5340e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c70629730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5c3049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e5706000", 0x1000}}, 0x951) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) write(r0, &(0x7f0000000400)='4', 0x1) 28.940635001s ago: executing program 5 (id=374): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b0000"], 0x50) close(0xffffffffffffffff) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) getgroups(0x753a175, 0xfffffffffffffffe) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0x6) 28.807978575s ago: executing program 5 (id=376): r0 = memfd_create(&(0x7f0000000100)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04\x1d\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) r1 = dup(r0) r2 = fanotify_init(0x1, 0x101000) fanotify_mark(r2, 0x1, 0x800001b, r1, 0x0) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$UHID_INPUT(r4, &(0x7f00000002c0)={0x8, {"b2dfe5ab8eb25d1ec54ac054220cd0c384d2e8b22ed8d2f8ffd1465959c95d0634f8fe33b16445b189959e1056060052934fb0026becb18ee492f0ea6c833b0c721c19785a6a1a280dafd2e6429542ad33e156cb912fefb989568be358a55b485352dac2ac60f91277c8e99fb80f66d8b29b816e23455a7dea65315996a175ca84635b333530e2c178633ca01f9f8550ff1e3bfdafc3568e275f2b773990f99eed07639a4f9453f70d0d171dfd0576872590f47537bc08bb109f33caea4256639ffc4e5ca3dcd1bed852adf0ac0c0d936c78182b6ab9edbc2632c5d702390828819c5dc17a95ffdd4051293b284a9765996d6e14d7c9c6b7ac7a8c8be78992117274e49426e931c977c772bae7fd90cfd86e532ee22b792870f37165a87c00d009a2df674f186a835e3f18b061337d433c56ed79422a5f349229488f0c427b81f2fd2126e7c16a47ff0f8cf430e989125095dfb439d88460ed50c74341996123d6f3e0cb4d67ca154fb3f43aede0b7ecfb4534d303fa56c4def7d56f98baaecb016c4adf583ce4c0bbeb66889733e85419d2c87d76637af3cf72f8a877f9b0db09b2b6cf5a4798ee5b6761b1ea8d1483e23adbafa57ee79020e9c6768cc38be36be6ffc019b2fe473e5deb4a6e4aa262a6b33f91871eb00e521861cb95208e200bda0f7def20dcd955ad3b7b7880e856edca5622931331957162efbe017c2357150be1d6b20ed052a8e2d5747191e0c40ece29ec96741204eb42e159278f6f3b758b5ca842bbeac7ecf909687cbdcfa6fc4376d26eb292d413acce2794cf56ce0bb0997ad7199f6159bba96e36f6303a130bf56d155da8854cfb69f309d59f3cf135416d6697f74aabada5e950115ce6f5bea50ea32060c9e7950d4e034be6ebe5fa78e53749ace05a7d082b75990c421ab26eb6cb0acac852acd6d20cd2405b71334a23e7908c88a2a1593a3eb9a6e4bc5f7e47ff4a012245e64bb95745d668d6bdfc88109f905e5909887e85f39c3d7eed5423057430e9ad70b682ece41526c601e674c169df28728eb9816b1a718e3f47d8be4146ae04398125750c711ed65e5065a5b7e70b3ea3887fedc4780448e80a811893bbc9e0f1dbadc0b7c7f57fc15c2bcdc96733eb5699328d663522dcb38eb7c6612f7810fab2d00ba184e551425a04f0676d90d2253de8f6712c34f03c79c471449ed04bdbe64690f7c907a2aff8a01c5647271f4cbeb650f199a577ab45632498dfbf673d1c134d6651e16688d426f5270da3be09ff466e81818e2342d273bb10977d3f09a20c156df11afe3f3cd856773651cad7dfa106bb95e490f050e784fc6cf179d86ae59ad49fdc7cd89c2acbafc96050d63a2138990e32d2ad0a91ff8367636f562f78213933be9daac9ccad60e934ecd513f84db5d4382ff98e7e5cd83c5cae9a6a37307a1cf67a40f5173306d9340a6b9a320f0220f5011039000b239e782b2869ff0cb04f5b6f2fe8cb9bcb9103083edd251c0a5a2a9b3201eeb2eb7a768504b864c7aef5562eb7c20ba6e73d09cebe352e498b8adbd21c987c98049903013514fbe97295834afc1d4f777f15f0782eb15bb722d78e1571d9e53690694c12612d18dedf60d51a0307eda5e082a7ac614684900a36f7dea9fea794a7bae1b76bd727da3dd85099d3dc4d4bd4aff8d7fab211430b9e2c2d0a35a9eeb420bb9dc541d3aadc5bd2d5c532bd4e1cf3b79c277d5335ac3086d23b7eabceeb0f9347e6e388258480fa17cc26f0c9483047beec5e5beeba4675d94f188097b72ab28798abe5051ff62fa96244b266ec64c4ff50f4a575ea2100b3dabe3d177e07fc7af0b7548955d888cbbe0cc210aab4fdd135b0e884ff4c8cd95d840bd010fb7bb079f45f11002080f09d1975af1bcaa2e913bd3ad0e22083957690814ced9541424fe4aa3abaaa613923813e348010d7a78ab501bf6177de6b547e36e23249f5e254db71127e17574f729ca6af9ec454a2ab94bb7f13023d88a9bace4ed55893a25e32522615ef873938aeef0f02388c07f453cd990672c88c13984d91e9a4fbd3bd4143080c1240dc25ab51ff36db3f085c7b91c44382d27e1b2957562edb5bf5b93acaba878d970ea76273d3dc8fce9c472d510aa612a33de940e10060c66f5161f874c9e0d445b516286ff8ce09f48a6739b2a19b048620fa4ac9aed3dede9c69358e7915c69dd950058aece1de58d2b411efed9887aa36d6500c46780e235400aed222b8beea36a329316bba45e750c4724215e6384f7a7f1c754eeb77793d534aeeb4ecd99ac38b8ec38726229faddd81f3ad5ab0ab7173248c61d2f83bff1089c1b20fbde70d531f1a0174365233bf7af87c6ca8b38950604e91291549585b105c6a746931f44bb461b68cdf2652d78d7bddb1f0c2a4d2b547f4a80539c21bf03d402e8abcc5a9620fcca7d91d298418f865e09a28b2b50be1e26882eda13675597024189dd68608cf37d9d687bc3b3dcbd5f07e6b400c4ef61b8dbd463a736e078ee3f7ac7619378cb5af589d6a03723c7f670d024feabf16231889a6bacb3ae48ffc6dd94c53b898e5a28b7a051abd6b3aaa9b98d957fcd375fc74263fb53d37746e929f775cc6195576bfcc10b35b9d8c682e98394f23c1e9966dcc80fca977620b16e2b1be318362b3af77c931f9c0d8d6ec8c7482c8a5418f229c9064310b4985e37c6a7e36343616d0c971b0f90dc1ff9b9744915ff02afcf0e6cb281f8bf89ced9951a3c60f6a5ccbfe5c1595e03f8af7ffa784cc014e4bce21753682c73687122ae62510e9c70480acc4771db09fb70cf61143df4542169cbb7105f62b777d37ea9a4e5cba80a6bd249936f1f46d7361a146915457a4906c78e6ee8e64e0c478b8a4effc5ef9531ac53b8e40070e01ac83bf0e66c8765aaa2c5bab467a4892a8e928fa3bbf4cfe579103365cfe2811cfecf576aa0ec7c0fd803340e577f2c841a93f3bcbcfaf04cb106d6c0647de8611cf89b83ec7791ce6102d0927247d60ade3ae61be1b8ff28bf733b9af4b12669136ddfb87e05740914ce0febf72d59e73c6dd790cb58720e7f550a2541fa3d1301a52bb8b7cac453924ca1f821bc680e9d23a6ec3cbab6fe341aa3e6b347231eb67186d1814fbe2d50852a7044acd1825bb8a3647532770eb7bfef72a2f22e633849e0ab272bcbf4080bd4d39d0bf5c9e1a4a305de1ba7868d07bebfd72972030c13afb9deee395ef1580aa925c69d7a456ecfbf20be383b6bf4f73696b16d1871c8a5936f007fe8ddce12ccb803699bd712c221e33704f77d4b173a4ac5be3ba5a9f33dc1d28cfecf9c87990cd2341aea672fd45e2e79d48b9bc710bba67703482b68e32e65d6d4b0584dc74952ad53287e9c044f376d2ba51149f45a68c8b63fdcd6e78e233199945c26d9e3e478040de8a95946d82e2bb97669d69fa1d70374d1dd94d82b2fb4726aa8dd9c88d3670a77619d4e1f26c114ad725bc0f83f41923225e2fac61183b633d54b5cd4088149d2649f07bc8ab599e394b68dc20b9a59a3d53dc89e34a0d7ce02f0374b505629e03d43fe9888c88b130b75bfacf5bf3e3aca92187ddab5f34f99a77f60f85b98164010b084aaf934c2b158bd2e760d64cdab9fc4156b2a52cf5d23aa0f329fb6d429b42fdf487ab5154ffdc6a38438fceb40c68614a0c0be9daa89f1c2993cd55a9fbed5dc4e5f3862fb96efd4085e2f437c755e97254152ea84ad6ec7fe028d871b2ed2b3a77328793c4e38297d658f1964f89ba4e21ff15fd5b1a8e3834748bf8092dc5e08bab9c7c1f6cc64f176c355435a35b2e7f62eed84c155cc25f1a7788e8a8fc867d0bb593b1d5b74f9e06fa5fb4e04efed97d3f53fe4a3a7031d8c785e179bf9fed0f6f1dec9fc834d1bff199ae2947bc5af7399cf9be3d7b947f82144a0963aaca3f5e1e354fa745e51fb5598e50ec2ec2b152d0b3d2217bb92e2e516f75ccf7c1ec097264cfea27faedd1ef7d1606ea1fb7e6f42f5f58eb0c1b6182220d23b2422ea42420015c8627ad9977f50dffbc3407699e8dcf9cc7d75dd9ff12ee22d9b2dd87d5d81a373c5954085046e9d1f2b3fb7431c216d7d4e5dbcfef29d2386d291365a212b5ecbd06fcb331a7a3f42ac75413b35f451a1c54478513b483f90ac5f6b189a1077671f38e14bed5275694cc8473160cec9007fdbddf3399188bf876391e5fe4077cccf6e1d006bacf0569d28390910747ff8d8226efbaa4a85721b82a91df98a5d6c5d32fa636fdc3add83832d2ddbc2be74875b049862d1bab2a77f15ed706f4dbaeb3e19d5b61ccbb5ef1f1eaebf8fedcddb68d96cf2e704358400c89788cc2561694dc508c811cd6e433252a5e27320f723b98141ae0f9deb144bef1315c0c801291a659b45facf06ebfbf0ed42894b662e9c5b16db7de968b45e53820fa889ff7bbba0a83209accce38e6d6224dce29bcf5dbb90a5b4f348086ff2689bc94fd38ab32b688eb6b29ea13560937ddb2a916b8743f4e74a5977bd518a81290ca7e5dab23fc927b15cd0616afd15929bd31093f483710ac32eb3b8853b42d840a2d15eaf2f4a688838bdf0ea5e26836d0865cf5cf5283f3e6097d9c5a1755758aded6e573bc3e445ef67920ce27edf926de0b3a5e27af64c3a33884d5aff24a827affb5ab047f2a89492b8c65caaaec62b73ac82a6986045e53396aa7849cc1b04d7ae3b0ec4ab07c6e1cd67f5f88c3c73288ee5c61310640bbc3f4a24317fdf067e1322c32c24428b538a97e5aebef9988149213bba3bec256bbae1ddd4423cfd99c829f1f40bea30d593d98b6ecf21c035826e90b7af8ed918dba42593bf137f624aac7ca3720623a54386cf456e9158009540cb5d8960f1d6c19b77b2a393a38d0c452ec345c7362cc833eb735e12d9155bb84230f809eef80e39d84aa7460fa8b5e48997ef97d259e37fc8476435cdf13f1bae21e79c1f1b4f37447f41e238d8d59a900fa26e710d0d1af0e769a8fa6331e6a8771c23d68bc6fd258c9f57098d1994e1cfdd6ba5770bdf7ebbcdeda8a78bd94de9e97b582c065aac5aeb2692fad1c993024550ac825bcfa388ce4c13dcfa0d36b90f3089d2746685ef82d9a8c05b794925ff4b319f3f6c780ff42e538dc917cb35fdef0522c2a075661dfcb473bf62f6f1c6f792148ac9809d642ffad9029186f4db001fc4d65c61043ae4932983576768c96cfd1c5b3e4a1816e01aa31bdbee1aa30ff147e122a9e50636a2711b0adc11485867edd2b278ba3bef09c229675c0a313f3ffa7b2bc5fb2be80254c10c50844a94c6c2867babfd2799e1cf0661752f5cd2efeac9e5e86400b41948b45a743cd89a2ac040bfdac24a6c739460198f875a0be63e6e979c29e4019ec52571bfd038790447f6b412b81862679d81ad15ec82fc2f6e0c371256fc70cef756ab13b6622229590654713fb7e38c6247d6f1c240a5e87647fd34fad16c39722435d12afefe981bef66d55581e0ba5c664de44f72298ec9dc8a6b9ca82bce4ed8796fbdde9281cde91f4b242c4960610655fb5747bc2b38bef3135ca868f79914015631fca1f1dd2cdc54fd40ae1d121f496a87ccd5293c668f7fc9e71d5e2dc5eef8026d2e538bdfd6d158ee9eb7eba246b517fd7dc412cfa096cae72988c1ec1b6b57e46204c3c4068a851cec2d94b361b4000313bda276bc0f6b1096fc2c6b7314e73570782371992b570558b4ae897fb80d9dda70fc5bb8627e55edf98fd98eecc54e8028ae625a1afa3ccd16ea8d67b2a7d", 0x1000}}, 0x1006) splice(r3, 0x0, r0, 0x0, 0x5, 0x2) 28.623470474s ago: executing program 5 (id=378): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x185093, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x8c) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) umount2(&(0x7f00000002c0)='./file0/file0\x00', 0x8) 28.532200473s ago: executing program 5 (id=379): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='fdinfo/3\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f0000000680)={0xd3, 0x8, 0x3, 0x8, 0x7dff, 0x5, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0) 28.220037785s ago: executing program 5 (id=381): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x3e, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffffff07000000400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x20004015}, 0x40) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004850}, 0x40) 27.5885349s ago: executing program 34 (id=381): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x3e, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffffff07000000400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x20004015}, 0x40) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004850}, 0x40) 27.417965777s ago: executing program 35 (id=314): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000002000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b"], 0x0}, 0x94) r0 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000400)=0x6, 0x4) setsockopt$inet_int(r0, 0x0, 0x19, &(0x7f0000000580)=0x400030, 0x4) bind$inet(r0, &(0x7f00000005c0)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000600)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) 8.336387308s ago: executing program 7 (id=487): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r1}, &(0x7f0000000500), &(0x7f0000000240)=r0}, 0x20) setsockopt(0xffffffffffffffff, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$sock_timeval(r0, 0x1, 0x42, &(0x7f0000000040)={0x0, 0xea60}, 0x10) read(r0, &(0x7f0000000080)=""/5, 0x5) 8.129413689s ago: executing program 7 (id=490): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x10810038) socket(0x10, 0x803, 0x0) r1 = socket$inet6(0xa, 0x3, 0xff) setuid(0xee01) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000002840)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x270, 0x270, 0x270, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xd0}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x1a0}}, {{@ipv6={@mcast1, @empty, [], [], '\x00', 'syzkaller1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xd0}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 7.836039099s ago: executing program 7 (id=491): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000026c0)=@deltfilter={0xfe4, 0x2d, 0x400, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x5, 0xffe0}, {0xa, 0x3}, {0x6, 0x5}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_cgroup={{0xb}, {0xfac, 0x2, [@TCA_CGROUP_ACT={0xfa8, 0x1, [@m_connmark={0xd0, 0x0, 0x0, 0x0, {{0xd}, {0x74, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x671, 0x7, 0x7, 0x3}, 0xe57}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0xe, 0x7, 0x9, 0x5ff}, 0xe}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xd, 0x10000, 0xffffffffffffffff, 0xc, 0xa00}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x3, 0xffffffffffffffff, 0x5, 0x5854}, 0xfffc}}]}, {0x2d, 0x6, "8603f539b6a7af824d262bf654e2998b1ef3d2c0c3dcff5329f40e2a6613622a8e0c660697488dd9d3"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_connmark={0x6c, 0x14, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0x1, 0x20000000, 0x40, 0x2}, 0x8001}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8001, 0x10001, 0x3, 0x4, 0x800}, 0x2}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_pedit={0xe68, 0x5, 0x0, 0x0, {{0xa}, {0xe3c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe38, 0x2, {{{0x1c000000, 0x40, 0x4, 0x7, 0x3fe}, 0xb1, 0x3, [{0xf7b7, 0x5, 0x9, 0xd, 0xdd, 0x5}]}, [{0x3, 0x2, 0xffffffff, 0x3, 0xd8aa, 0x7}, {0xaa2, 0x6, 0x101, 0x6, 0x2, 0x3}, {0x200000, 0x100, 0x0, 0x5c6, 0x6830, 0x8}, {0x2, 0x311, 0x8, 0x4b, 0x82, 0x8}, {0x7, 0x5, 0x2, 0x212, 0x7, 0xe1}, {0x7, 0x4, 0x8d, 0x1ff, 0x1ff, 0x1000}, {0x200, 0x7, 0xffffffff, 0x9, 0x9}, {0x7, 0xfe4, 0x1, 0x0, 0x624, 0xb513}, {0x8, 0x3, 0x7ff, 0x70, 0x6, 0x8000}, {0xfffffffe, 0x0, 0x3ff, 0xb06, 0x1, 0x6}, {0x5, 0x1, 0xdb, 0x6, 0x2, 0x4}, {0x9, 0x4, 0x519f, 0x5, 0x6, 0x31c4}, {0x7, 0x7, 0x3ff, 0x1, 0x8000, 0x5}, {0x7fffffff, 0x1, 0x5, 0xfe45, 0x5, 0xb}, {0xbd, 0x5f05, 0x8, 0xf, 0x1, 0xa}, {0x0, 0x8000, 0x3, 0x7, 0xd17, 0x7}, {0xae, 0x7, 0x2, 0x2, 0x9}, {0x6, 0x4, 0xa, 0x3, 0x1, 0x3}, {0x2, 0xa502, 0x3, 0xfffffff7, 0x81, 0x1}, {0x80, 0x8, 0x9, 0x0, 0x0, 0x7}, {0x9, 0x4, 0x1400000, 0x9, 0xad, 0x6}, {0xc, 0xffffff00, 0x5, 0x3, 0x3, 0x3}, {0x7, 0x32da135, 0xb, 0x8, 0xa93c, 0x6}, {0x3e, 0x5bce, 0x4, 0x7ff, 0x80000001, 0x32b}, {0xffffffff, 0x9, 0x100, 0x1, 0xfffffffb, 0x9}, {0x10001, 0x1, 0xe0cc, 0x8, 0x9, 0x2}, {0xf7, 0x5, 0x800, 0x8, 0x7f}, {0xdbeb, 0x8, 0x1, 0x1, 0x1, 0x80000}, {0x5, 0x0, 0xbaf9, 0x4, 0x28000000, 0x9}, {0x0, 0x8, 0x6, 0x9, 0x5, 0xfffffff4}, {0xadfe, 0x9, 0x1, 0x4, 0xfaf, 0x81}, {0x800, 0x5, 0x3, 0x5, 0x5, 0x1e4}, {0x6, 0x7, 0x8, 0x8, 0xad38, 0x6}, {0xa, 0x4467, 0x9, 0x5, 0x401, 0x1}, {0x1ff, 0x400, 0x9, 0x80000001, 0x7ff, 0xb6}, {0x1000, 0xffff8001, 0x40, 0x2, 0x800, 0x3}, {0x9, 0xb, 0x5, 0x9, 0x4, 0x9}, {0x0, 0xe, 0x4, 0x4, 0x9, 0x6}, {0x5, 0x4, 0x6, 0xfffffffe, 0x4, 0xfff}, {0x5, 0x0, 0x1, 0x5a48, 0x6, 0xfffffff9}, {0xffffffff, 0x80000000, 0x6d, 0x0, 0x8, 0xe}, {0x9, 0xfffffffa, 0x5, 0x6, 0x8, 0x9}, {0x7fff, 0x3, 0x5, 0x3ff, 0x8, 0x7}, {0x10001, 0x7, 0x2, 0x7ff, 0x9, 0x6}, {0x3, 0x9de, 0x4, 0x11, 0x7, 0x9}, {0x3, 0x9, 0x8f, 0xffffdd1a, 0x10, 0x2}, {0x1, 0xa8a9, 0x1, 0x5, 0x7, 0x401}, {0x4, 0xffff, 0x1000, 0x1, 0x6, 0x1}, {0x2a, 0x0, 0x80000000, 0x0, 0xfc, 0x3}, {0xc55b, 0x5, 0xb, 0x8001, 0x4, 0x1ff}, {0x7, 0x6, 0x0, 0x1d, 0x42f, 0x7}, {0xfffffff8, 0x6, 0x3, 0x2, 0x7, 0x7}, {0x1, 0x2, 0x5, 0x30, 0xfe68, 0x800}, {0x80000000, 0x2, 0x1, 0x8, 0x0, 0xffffffff}, {0x3, 0x6021db75, 0x7fff, 0x1000, 0xc1, 0x1add65aa}, {0x2, 0x7, 0x4, 0x2, 0xe9, 0x986}, {0xba, 0x8, 0x6, 0x401, 0x4, 0x10}, {0x9, 0x7fffffff, 0xb70f, 0x40, 0x3, 0xfffffffe}, {0x4, 0x3, 0x4, 0xd, 0xb24, 0x6}, {0xbf, 0x3, 0xbf6, 0xfffeffff, 0x2, 0x3}, {0x3, 0x6, 0x4, 0x7c6, 0x80000001, 0x1}, {0x58e2, 0x1, 0x4, 0x7, 0x3ff, 0x4}, {0x6, 0xb4, 0xeb, 0x3, 0x6, 0xe}, {0xc, 0x1, 0x3, 0xf, 0x7, 0xdb10ee8a}, {0x3, 0xf, 0x81, 0x420d, 0xa, 0xad78}, {0x2, 0x4, 0xfffffffc, 0x401, 0x4, 0x2}, {0x4, 0x4, 0x3, 0xf908, 0x2, 0x400}, {0x800, 0x6, 0x2, 0x4, 0x8e20, 0x4}, {0x7ae4fc5e, 0x3, 0xf, 0xf87, 0x2, 0x1}, {0x2, 0x7, 0xed7e, 0x4, 0x5, 0xdc}, {0x4, 0x154, 0xfffffe00, 0x3ff80000, 0x2, 0xa}, {0x6, 0x5, 0x3, 0x3a84, 0x0, 0x1}, {0xeea1, 0x9, 0x55de2144, 0x9, 0x80, 0x7cf}, {0x2, 0x6, 0x8, 0x3, 0x0, 0x7fffffff}, {0x1000, 0x7f, 0x8000, 0xfffffffe, 0x8, 0xd1e}, {0x6, 0x2, 0x6c5, 0xd, 0x4, 0x8}, {0x1, 0x5, 0x10000, 0xc, 0x7ff, 0x5}, {0x4, 0x7, 0x264564e6, 0xea, 0x7fff, 0x1}, {0xa, 0x4, 0x2, 0x3, 0x0, 0x7}, {0x84000000, 0x9, 0x2, 0x8000, 0x5, 0x4}, {0x0, 0x2, 0xa483, 0x9, 0x2, 0x6}, {0x22, 0x2, 0x9, 0x1, 0x3, 0x4}, {0x3, 0x3, 0x7fff, 0x0, 0x46, 0x7fffffff}, {0x6, 0x8, 0xffffc000, 0x1ff, 0x8}, {0xe, 0x1, 0x0, 0x9, 0x9, 0x8}, {0x1000, 0x9, 0xffffffff, 0x100, 0x3ff}, {0x80, 0x1, 0x9, 0x6a59, 0x4, 0x3}, {0x8000, 0x0, 0x100, 0x1, 0x0, 0x4}, {0x0, 0x401, 0xbe5e, 0x0, 0x81, 0xd0}, {0x6, 0xa, 0x146e, 0x43d, 0xe, 0xb08}, {0x7ff, 0x0, 0x4, 0x0, 0x7f, 0x1}, {0xfffffff6, 0x5, 0xe, 0xff, 0x7, 0x6}, {0x0, 0x4c, 0x8, 0xfffffffc, 0x2, 0xd42}, {0xff, 0xfffffffc, 0x2, 0x0, 0xb881, 0x6}, {0x3, 0x8, 0xffffffff, 0xfffffbff, 0x1, 0x96e}, {0x5, 0x6, 0x380000, 0x3, 0x7, 0x2}, {0x0, 0x81, 0x3, 0x1, 0x4, 0x4}, {0x0, 0x7, 0x8, 0x5, 0x3, 0x10}, {0x4, 0x6, 0x3, 0xf, 0xf, 0x9}, {0x7fffffff, 0x8000, 0x3ff, 0x8, 0x505, 0xe3e}, {0x9, 0x1, 0x7, 0xd1, 0x8, 0x1}, {0x4, 0x9da, 0x2, 0x7, 0x9d94bae, 0x101}, {0x6, 0x2, 0x7f, 0x13760, 0x10001, 0x9}, {0x3c, 0x0, 0x409, 0x3, 0xfffeffff}, {0x9, 0x7, 0x0, 0xf5, 0xffffffff, 0x7c94}, {0x5, 0x3, 0xfff, 0x5, 0x99, 0x4e}, {0x10, 0x3, 0x8, 0x4516, 0x1, 0xe89c}, {0x21b, 0x9, 0xa, 0x5, 0x7fff}, {0x7f, 0x0, 0x489, 0x1, 0x80000001, 0xe}, {0x5, 0xfffff1f4, 0x7, 0x5, 0x7, 0x9}, {0x4, 0x6, 0x3, 0x5, 0x6, 0x1}, {0xe3e, 0xfffffffd, 0x3, 0x5, 0x8000, 0x2}, {0x101, 0xa2, 0xff, 0xfffffff7, 0x10001, 0x80000000}, {0x14a9, 0x1ff, 0x3, 0x2, 0x7, 0x1}, {0xa82c, 0x570b, 0x9, 0x0, 0x1, 0x5}, {0x2, 0x3, 0x2, 0xffff0000, 0x8, 0x7}, {0x0, 0xd2, 0x1, 0x9, 0x10, 0xfffff000}, {0x5, 0x8, 0x1, 0x0, 0x4, 0x1c5b}, {0x2, 0xffff5a2f, 0x2, 0x5, 0x1, 0x200}, {0x193cfceb, 0x800, 0x3, 0xd, 0x4, 0x5}, {0x8, 0x1fffe, 0x2, 0x9, 0x0, 0xc38c}, {0x9, 0x0, 0x5, 0x4, 0xfffffffd, 0xe0000}, {0xffffffff, 0xec, 0x5, 0x4, 0xc1e7, 0xb64d}, {0x8000, 0x87, 0x7ce, 0x400, 0x0, 0x2d}, {0x9, 0x9, 0x2, 0x18f, 0x3ff, 0x3}, {0x2, 0x5, 0x6, 0xb, 0x7}, {0x81, 0x2, 0x4, 0x0, 0x3, 0x7}, {0x9f8, 0x2, 0x4, 0xe, 0x400, 0x6}], [{0x2}, {0x706c4c185c430530}, {0x1, 0x1}, {0x4}, {0x5, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x4}, {0x2, 0x1}, {0x1, 0x1}, {0x4}, {0x5}, {0x7, 0x1}, {0x3}, {0x4, 0x1}, {0x5, 0x1}, {0x1}, {0x4, 0x1}, {0x1}, {0x1}, {0x1}, {0x4}, {0x0, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x1}, {}, {0x1, 0x1}, {0x3}, {0x1, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x5}, {0x1, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x2}, {0x1}, {}, {0x1}, {0x5}, {0x0, 0x1}, {0x5}, {0x5}, {0x4}, {}, {0x5, 0x1}, {0x3}, {}, {0x5, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x2}, {0x0, 0x1}, {0x5}, {0x0, 0x1}, {0x1}, {0x2}, {0x2}, {0x5}, {0x1, 0x1}, {0x3}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x4, 0x1}, {0x2}, {0x3}, {0x0, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {}, {0x5, 0x1}, {0x5}, {0x4, 0x1}, {0x2}, {}, {0x0, 0x1}, {0x3}, {0x1, 0x1}, {0x3}, {0x7, 0x1}, {0x2, 0x1}, {0x3, 0x2}, {0x4}, {0x5}, {0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x3}, {0x4, 0x1}, {}, {0x5, 0x1}, {0x4}, {0x5}, {0x5, 0x1}, {0x0, 0x1}, {0x5}, {0x2, 0x1}, {0x5}, {0x3, 0x1}, {0x3, 0x1}, {0x2}, {0x2}, {0x4, 0x1}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x4}, {0xec1752f8e3477738, 0x1}, {0x3, 0x1}, {0x2}, {0x0, 0x1}, {0x3}, {0x3, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {}, {0x3, 0x1}, {0x4, 0x1}, {0x2, 0x433dd36a35789fc3}, {}, {0x3}, {0x4, 0x1}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xfe4}, 0x1, 0x0, 0x0, 0x4040000}, 0x8800) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 7.44059568s ago: executing program 7 (id=497): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={[{@fat=@debug}, {@utf8}, {@fat=@nfs}, {@utf8no}, {@uni_xlate}, {@utf8}, {@shortname_win95}, {@uni_xlateno}, {@rodir}, {@shortname_win95}, {@shortname_mixed}, {@fat=@flush}, {@numtail}, {@uni_xlateno}]}, 0x0, 0x2cd, &(0x7f00000001c0)="$eJzs3c9rE1sUwPHTSdukLW2yKA/eg4cH3ehmaONfEKQFMaDURtSFMLUTDRmTkImRiNju3PpPuCkuXSmo/0A37tyLmyIIbroQR/Jj2jGZ1hDbTmy+Hyhze8+czB3uTDlzoZOdm88fFPOumbdqYiRUDJFN2RVJNVsdY52t0WpPStCmXJj59vH/67duX8lks0srqsuZ1YtpVZ078/bRk5dn39dmbryaexOX7dSdna/pT9v/bP+782PV//SyiKVr5XLNWnNsXS+4RVP1mmNbrq2FkmtXa2pp1Y/nnXKl0lCrtD47XanarqtWqaFFu6G1staqDbXuWYWSmqaps9MyamKHRr0XvX25rZUVK3N8I8IJmwrrrFYzViw0mNs6iUEBAIDhElX9f7/gasHVUrlZ3x9S/xsSjP+m/hcZ6fp/UJWDQ6H1JIbYcm9Xs/5v3g1GojtC/Q8AAAAAAAAAAAAAAAAAAAAAwN9g1/OSnucl/a3/ExeRhIj4vx+QbpzwcHHEBpt/pv20CPzjXkLEeVbP1XPtbTueyUtBHLFlYULke+t6aIp7Xru9fDm7tKAtKXnnbHTyN+q5mMT9fF9qL98L5i+28zWYvyETMh08flqSMh+enw7Jr+cm5fw5L946riG2mJKUD3elLI6st67r/fyni6qXrma78qda+wEAAAAAcBqYuqfn+b0VN9Vf7OmKtzv31wckGVgf8ELWB7qer8flv/HozhsAAAAAgFHiTkrRchy76jYen/aG//0YR/KBIlGfTqLfncdFpNPzeljmop+GISLdoYmenvBG7M9m+YvIr/fFfOTTPXDDi+1dq58ftu+AftKj/KsEAAAA4Dj4Rf9Y1AMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCE9fsWMX//QV5C5ufGIztLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDj8DAAA//+KMBRq") r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='./file0\x00', 0x0, 0x1333404, 0x0) mount$bind(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00', 0x0, 0x93085, 0x0) mount$bind(&(0x7f0000000640)='.\x00', &(0x7f0000000680)='./file0\x00', 0x0, 0x1005848, 0x0) read$FUSE(r0, &(0x7f00000006c0)={0x2020}, 0x2020) 7.112548233s ago: executing program 7 (id=499): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000080000001801000020646c250000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000840)={{r1}, &(0x7f00000007c0), &(0x7f0000000800)=r0}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) 6.26443334s ago: executing program 7 (id=505): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000007"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) 5.844840213s ago: executing program 36 (id=505): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000007"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) 3.347226128s ago: executing program 0 (id=528): r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000340)=0x1, 0x4) listen(r0, 0x5) r1 = socket$inet_smc(0x2b, 0x1, 0x0) accept(r0, 0x0, 0x0) connect$inet(r1, &(0x7f0000000300)={0x2, 0x4e20, @loopback}, 0x10) 3.056945398s ago: executing program 2 (id=531): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r0, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000380)}, 0x20) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a00000004000000080000000001"], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x16, 0x11, &(0x7f0000000840)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffb}}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x3}]}, &(0x7f0000000900)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000940)={r3, 0x0, 0xe, 0x0, &(0x7f00000009c0)='\x00'/14, 0x0, 0x80000004, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.44465052s ago: executing program 6 (id=532): mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000c00)='./dev\x00', &(0x7f0000000c40)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c80)='./mnt\x00', 0x1ff) mount(&(0x7f0000000cc0)=@filename='./dev/sda1\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000d40)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000000d80)='./mnt\x00') mknod$loop(&(0x7f0000001240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000, 0x1) rename(&(0x7f0000001340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 2.385765166s ago: executing program 0 (id=533): r0 = socket(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000002900)=r2, 0x4) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=ANY=[@ANYBLOB="4800000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="0c00040000000000280012800b000100627269646765000018000280090014"], 0x48}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 2.266973018s ago: executing program 6 (id=534): r0 = fsopen(&(0x7f0000000200)='configfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x3) r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x50, 0x30, 0x1, 0x0, 0x0, {}, [{0x3c, 0x1, [@m_skbedit={0x38, 0x1, 0x0, 0x0, {{0xc}, {0xc, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0xa}]}, {0x4}, {0xc}, {0xc, 0x9, {0x47}}}}]}]}, 0x50}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000030400000000fdffff0000000300", @ANYRES32=r1, @ANYBLOB="000000006f0018000500100002000000080040"], 0x30}, 0x1, 0x0, 0x0, 0x2000c000}, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 2.024998363s ago: executing program 2 (id=535): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) unshare(0x22020600) r2 = memfd_create(&(0x7f0000000000)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04\x1d\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) r3 = dup(r1) copy_file_range(r2, 0x0, r3, 0x0, 0x2aad109b, 0x0) 1.986470177s ago: executing program 2 (id=536): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) bind(r0, &(0x7f00000003c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10) r2 = socket$can_raw(0x1d, 0x3, 0x1) sendmsg$can_raw(r2, &(0x7f00000005c0)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000640)={&(0x7f0000000680)=@can={{0x1}, 0x8, 0x0, 0x0, 0x0, "0100"}, 0x10}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) read(r0, &(0x7f00000006c0)=""/100, 0x64) 804.027568ms ago: executing program 2 (id=537): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000006c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3a8, 0x0, 0x148, 0x1e0, 0x278, 0x310, 0xb0, 0x148, 0x1e0, 0x278, 0x310, 0x6, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x408) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000100)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e22, 0x7, @empty, 0x1fc}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000380)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x20, 0x2}}}}}}, 0x0) 803.743368ms ago: executing program 6 (id=538): r0 = socket(0x10, 0x803, 0x0) r1 = syz_io_uring_setup(0x4c4f, &(0x7f0000000400)={0x0, 0xed83, 0x400, 0x2, 0x2e3}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f00000003c0)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r0, 0x0, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0, 0x80000080, 0x1}) io_uring_enter(r1, 0x1, 0xfffffffd, 0x9, 0x0, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000380)=0xd, 0x4) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x477, 0x4) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), r0) 757.653353ms ago: executing program 0 (id=539): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001400b59527bd7000fcdbdf250a400000", @ANYRES32=r3, @ANYBLOB="1400020000000000e10000000000ffff0000000008000800090300"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000015"], 0x34}, 0x1, 0x0, 0x0, 0x41c1}, 0x4040800) 508.616758ms ago: executing program 6 (id=540): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002980)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x4001ffe, 0xa68d7c519fc00ff1, 0xffbc, 0x6, 0x1d45, 0x0, 0x0, 0x0, 0x40}}, 0x50) close(r0) chown(&(0x7f0000000000)='./file0\x00', r2, r3) 508.193818ms ago: executing program 2 (id=541): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[], 0x4c}}, 0x4000040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x24}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="06001500070000000c0016"], 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x10) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 507.877538ms ago: executing program 0 (id=542): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) r3 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x804, 0x0, 0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000240)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x40, 0x0, r2, 0x0, &(0x7f00000002c0)="8a14", 0x2, 0x40000100, 0x1}) io_uring_enter(r3, 0x1, 0x1, 0x1, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 348.243334ms ago: executing program 6 (id=543): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x8000000) semget$private(0x0, 0x4000, 0x0) semctl$SETALL(0x0, 0x0, 0x14, 0x0) 298.18584ms ago: executing program 0 (id=544): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x4) mount(0x0, &(0x7f00000002c0)='./gadget\x00', &(0x7f0000000300)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000080)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x10, 0x3bee3f9f87c5003e, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 200.62779ms ago: executing program 2 (id=545): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x2200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000340)=[@text32={0x20, &(0x7f0000000380)="d8df7e23b3b9ce000000b807000000ba000000000f301b8154fea900b9b60a000080321100c4e28ddc8dcd000000c182fd3f0000c850220000b801000000b9a6080000b9800000c035000800000f30ba000000000f300f300fc79d53bf0000c4b9e16dc301012202", 0x68}], 0x1, 0x5c, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x4332, 0x1, 0x8, 0xfe, 0x5, 0xfff, 0x37, 0x101, 0x8, 0x6, 0x100000001, 0x2, 0x8, 0x5, 0x5, 0x20000000400eee0], 0x8000000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 44.569476ms ago: executing program 6 (id=546): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x21) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000161000/0x18000)=nil, &(0x7f0000005700)=[@text64={0x40, 0x0}], 0x1, 0x5a, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000165000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000180)="672ef32ef365dd3e66b85f0000000f23d00f21f86635200000060f23f866b9800000c00f326635008000000f3065f30f090f092665360f01cf2ef30f0966b80d0000000f23c80f21f86635000010000f23f8baf80c66b849ec588766efbafc0cec0f06", 0x63}], 0x1, 0x40, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 0 (id=547): creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fcdbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="2e00330020180600080211000000080211000001ffffffffffff64000002080008021100000000060101010101010000080057"], 0x54}, 0x1, 0x0, 0x0, 0x4018010}, 0x804) kernel console output (not intermixed with test programs): 85.288867][ T5856] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 85.291836][ T5864] Registered device Abilis Systems DVB-Titan [ 85.304151][ T5950] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 85.329710][ T5950] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 85.400999][ T5950] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #16: comm syz.3.20: invalid indirect mapped block 32768 (level 2) [ 85.425658][ T5950] EXT4-fs (loop3): 1 orphan inode deleted [ 85.458967][ T5950] EXT4-fs (loop3): 1 truncate cleaned up [ 85.479931][ T5950] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 86.075549][ T5781] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 86.134693][ T5856] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x0000011c. ret = -71 [ 86.155275][ T5856] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 86.167111][ T5856] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 86.179970][ T5856] lan78xx: probe of 3-1:1.0 failed with error -71 [ 86.206130][ T5856] usb 3-1: USB disconnect, device number 2 [ 86.545535][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.634182][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.725919][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.821004][ T175] usb 1-1: USB disconnect, device number 2 [ 86.853030][ T9] cfg80211: failed to load regulatory.db [ 86.903411][ T175] Unregistered device Abilis Systems DVB-Titan [ 86.912132][ T175] as10x_usb: device has been disconnected [ 87.004049][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.336915][ T5789] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 87.347060][ T5789] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 87.354828][ T5789] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 87.383854][ T5789] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 87.397979][ T5789] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 87.406175][ T5789] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.601308][ T5967] rxe_eth0 speed is unknown, defaulting to 1000 [ 87.713740][ T5975] loop0: detected capacity change from 0 to 128 [ 87.757461][ T5975] EXT4-fs: Ignoring removed i_version option [ 87.849325][ T5975] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 87.911756][ T5975] ext4 filesystem being mounted at /2/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 88.155993][ T5785] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 88.369743][ T5965] loop3: detected capacity change from 0 to 32768 [ 88.408728][ T5965] ======================================================= [ 88.408728][ T5965] WARNING: The mand mount option has been deprecated and [ 88.408728][ T5965] and is ignored by this kernel. Remove the mand [ 88.408728][ T5965] option from the mount to silence this warning. [ 88.408728][ T5965] ======================================================= [ 88.606716][ T5965] JBD2: Ignoring recovery information on journal [ 88.643141][ T6003] sock: sock_set_timeout: `syz.2.34' (pid 6003) tries to set negative timeout [ 88.743017][ T6005] 9pnet: p9_errstr2errno: server reported unknown error n$[ [ 88.743017][ T6005] Q&|x [ 88.801661][ T5965] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 88.874053][ T5967] chnl_net:caif_netlink_parms(): no params data found [ 89.027763][ T27] audit: type=1804 audit(1793131364.770:2): pid=5965 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.27" name="/newroot/11/file1/bus" dev="loop3" ino=17059 res=1 errno=0 [ 89.062413][ T5965] (syz.3.27,5965,0):ocfs2_get_clusters:606 ERROR: status = -34 [ 89.074464][ T5965] (syz.3.27,5965,0):ocfs2_reflink_remap_extent:4559 ERROR: status = -34 [ 89.096880][ T5965] (syz.3.27,5965,0):ocfs2_reflink_remap_blocks:4718 ERROR: status = -34 [ 89.111741][ T5965] (syz.3.27,5965,0):ocfs2_remap_file_range:2746 ERROR: status = -34 [ 89.247102][ T5781] ocfs2: Unmounting device (7,3) on (node local) [ 89.310147][ T5967] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.351915][ T5967] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.390210][ T5967] bridge_slave_0: entered allmulticast mode [ 89.417274][ T5967] bridge_slave_0: entered promiscuous mode [ 89.476515][ T5784] Bluetooth: hci0: command tx timeout [ 89.496913][ T5967] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.504064][ T5967] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.546630][ T5967] bridge_slave_1: entered allmulticast mode [ 89.553741][ T5967] bridge_slave_1: entered promiscuous mode [ 89.828011][ T5967] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.932090][ T5967] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.026424][ T6051] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 90.113721][ T6052] syz.0.46 uses obsolete (PF_INET,SOCK_PACKET) [ 90.200301][ T5967] team0: Port device team_slave_0 added [ 90.259527][ T5967] team0: Port device team_slave_1 added [ 90.457414][ T5967] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.473763][ T5967] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.510266][ T5967] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.616436][ T12] hsr_slave_0: left promiscuous mode [ 90.636342][ T12] hsr_slave_1: left promiscuous mode [ 90.649886][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 90.684064][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 90.697696][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 90.717982][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 90.742405][ T12] bridge_slave_1: left allmulticast mode [ 90.769827][ T12] bridge_slave_1: left promiscuous mode [ 90.791136][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.831195][ T12] bridge_slave_0: left allmulticast mode [ 90.845960][ T12] bridge_slave_0: left promiscuous mode [ 90.859393][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.922092][ T12] veth1_macvtap: left promiscuous mode [ 90.930122][ T12] veth0_macvtap: left promiscuous mode [ 90.951792][ T12] veth1_vlan: left promiscuous mode [ 90.960491][ T12] veth0_vlan: left promiscuous mode [ 91.555915][ T5784] Bluetooth: hci0: command tx timeout [ 91.666182][ T5857] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 91.750593][ T12] team0 (unregistering): Port device team_slave_1 removed [ 91.788109][ T12] team0 (unregistering): Port device team_slave_0 removed [ 91.821933][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 91.857845][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 91.862640][ T5857] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 91.884135][ T5857] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 91.894027][ T5857] usb 1-1: config 1 interface 1 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 91.907156][ T5857] usb 1-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 91.916302][ T5857] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.173029][ T12] bond0 (unregistering): Released all slaves [ 92.229316][ T5967] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.241335][ T5967] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.267993][ T5967] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.348553][ T5857] dvb_ttusb_budget: ttusb_init_controller: error [ 92.355467][ T5857] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 92.482837][ T5967] hsr_slave_0: entered promiscuous mode [ 92.495194][ T5857] DVB: Unable to find symbol stv0299_attach() [ 92.525278][ T5967] hsr_slave_1: entered promiscuous mode [ 92.533981][ T5967] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.549135][ T5967] Cannot create hsr debugfs directory [ 92.554747][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 92.558544][ T6085] loop3: detected capacity change from 0 to 128 [ 92.567970][ T6086] tipc: Started in network mode [ 92.576466][ T5857] DVB: Unable to find symbol tda8083_attach() [ 92.582720][ T5857] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 92.582935][ T6086] tipc: Node identity 7f000001, cluster identity 4711 [ 92.592387][ T6085] EXT4-fs: Ignoring removed nobh option [ 92.628036][ T6086] tipc: New replicast peer: 172.20.20.12 [ 92.662239][ T6086] tipc: Enabled bearer , priority 10 [ 92.685495][ T6085] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 92.750398][ T6085] ext4 filesystem being mounted at /16/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 92.966088][ T6093] dvb_ttusb_budget: cmd xter failed, receive error -90 [ 93.004842][ T9] usb 1-1: USB disconnect, device number 3 [ 93.009910][ T5781] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 93.030621][ T5967] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 93.072995][ T6098] loop2: detected capacity change from 0 to 512 [ 93.093417][ T5967] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 93.149476][ T6098] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 93.151469][ T5967] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 93.184290][ T5967] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 93.207094][ T6098] EXT4-fs error (device loop2): ext4_iget_extra_inode:4752: inode #15: comm syz.2.55: corrupted in-inode xattr: invalid ea_ino [ 93.257494][ T6098] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.55: couldn't read orphan inode 15 (err -117) [ 93.297637][ T6098] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 93.384456][ T6098] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2858: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 93.433187][ T5967] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.482673][ T5967] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.499647][ T5786] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.553039][ T3516] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.560244][ T3516] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.627624][ T3516] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.634880][ T3516] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.644831][ T5784] Bluetooth: hci0: command tx timeout [ 93.789420][ T9] tipc: Node number set to 2130706433 [ 94.208461][ T5967] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.404383][ T6135] loop3: detected capacity change from 0 to 2048 [ 94.561601][ T6142] loop2: detected capacity change from 0 to 1024 [ 94.585126][ T6142] EXT4-fs: Ignoring removed nobh option [ 94.628717][ T6142] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 94.684733][ T6142] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 94.734216][ T6149] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 94.958886][ T5786] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 95.037283][ T5967] veth0_vlan: entered promiscuous mode [ 95.088622][ T5967] veth1_vlan: entered promiscuous mode [ 95.208159][ T5967] veth0_macvtap: entered promiscuous mode [ 95.224898][ T5967] veth1_macvtap: entered promiscuous mode [ 95.268833][ T5967] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.301062][ T5967] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.324827][ T5967] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.344196][ T5967] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.364099][ T5967] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.390474][ T5967] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.418963][ T5967] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.488409][ T5967] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.524456][ T5967] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.552782][ T5967] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.579129][ T5967] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.606568][ T5967] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.634955][ T5967] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.665315][ T5967] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.716096][ T5784] Bluetooth: hci0: command tx timeout [ 95.718009][ T5967] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.761457][ T5967] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.774641][ T5967] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.783593][ T5967] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.205352][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.242612][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.337463][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.345329][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.499782][ T6194] loop3: detected capacity change from 0 to 8192 [ 96.550904][ T6194] ntfs3: loop3: Different NTFS sector size (4096) and media sector size (512). [ 96.704084][ T6194] ntfs3: loop3: ino=b, mi_enum_attr [ 96.733589][ T6194] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 96.783761][ T6194] ntfs3: loop3: Failed to load $Extend (-2). [ 96.810097][ T6194] ntfs3: loop3: Failed to initialize $Extend. [ 97.312535][ T6225] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 97.629593][ T5949] libceph: connect (1)[c::]:6789 error -101 [ 97.646272][ T5949] libceph: mon0 (1)[c::]:6789 connect error [ 97.686014][ T6235] ceph: No mds server is up or the cluster is laggy [ 98.069303][ T6248] loop2: detected capacity change from 0 to 8192 [ 98.122317][ T6248] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 98.143115][ T6248] REISERFS (device loop2): found reiserfs format "3.5" with non-standard journal [ 98.199140][ T6248] REISERFS (device loop2): using ordered data mode [ 98.285267][ T6248] reiserfs: using flush barriers [ 98.405894][ T6248] REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 98.522462][ T6248] REISERFS (device loop2): checking transaction log (loop2) [ 98.606452][ T6248] REISERFS (device loop2): Using r5 hash to sort names [ 98.679131][ T6248] REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. [ 99.087113][ T6248] REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 4 0(1) DIR], item_len 35, item_location 2449, free_space(entry_count) 2 [ 99.209558][ T6248] REISERFS error (device loop2): vs-5150 search_by_key: invalid format found in block 556. Fsck? [ 99.278034][ T6248] REISERFS (device loop2): Remounting filesystem read-only [ 99.326920][ T6248] REISERFS error (device loop2): vs-13050 reiserfs_update_sd_size: i/o failure occurred trying to update [2 4 0x0 SD] stat data [ 99.513109][ T6297] loop3: detected capacity change from 0 to 1024 [ 99.565594][ T6297] EXT4-fs (loop3): filesystem is read-only [ 99.705911][ T5890] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 99.895813][ T5890] usb 5-1: Using ep0 maxpacket: 8 [ 99.905453][ T5890] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 99.924327][ T5890] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 99.957865][ T5890] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 99.967873][ T6309] process 'syz.3.102' launched '/dev/fd/4' with NULL argv: empty string added [ 100.028801][ T5890] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 100.049593][ T5890] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 100.083386][ T5890] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 100.103344][ T5890] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.383039][ T5890] usb 5-1: GET_CAPABILITIES returned 0 [ 100.396026][ T5890] usbtmc 5-1:16.0: can't read capabilities [ 100.565839][ T5857] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 100.767392][ T6295] usbtmc 5-1:16.0: usb_control_msg returned -71 [ 100.769819][ T5864] usb 5-1: USB disconnect, device number 2 [ 100.775516][ T6331] usbtmc 5-1:16.0: usb_control_msg returned -19 [ 100.780220][ T5857] usb 1-1: Using ep0 maxpacket: 8 [ 100.808263][ T5857] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 100.826367][ T5857] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 100.855410][ T5857] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 100.876250][ T5857] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 100.897860][ T5857] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 100.940888][ T6336] loop3: detected capacity change from 0 to 4096 [ 100.949578][ T5857] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 100.977005][ T5857] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.183851][ T6336] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 101.207296][ T6336] EXT4-fs (loop3): Test dummy encryption mode enabled [ 101.236527][ T5857] usb 1-1: GET_CAPABILITIES returned 0 [ 101.244196][ T6336] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 101.269916][ T5857] usbtmc 1-1:16.0: can't read capabilities [ 101.306694][ T6312] loop2: detected capacity change from 0 to 32768 [ 101.359432][ T6312] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.100 (6312) [ 101.526170][ T6312] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 101.569192][ T6312] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 101.578635][ T5781] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 101.580866][ T6312] BTRFS info (device loop2): force clearing of disk cache [ 101.615246][ T6312] BTRFS info (device loop2): enabling auto defrag [ 101.645855][ T6318] usbtmc 1-1:16.0: usb_control_msg returned -71 [ 101.647765][ T5949] usb 1-1: USB disconnect, device number 4 [ 101.693910][ T6348] usbtmc 1-1:16.0: usb_control_msg returned -19 [ 101.717672][ T6312] BTRFS info (device loop2): max_inline at 0 [ 101.752936][ T6312] BTRFS info (device loop2): enabling disk space caching [ 101.790583][ T6312] BTRFS info (device loop2): disk space caching is enabled [ 102.148996][ T6312] BTRFS info (device loop2): enabling ssd optimizations [ 102.217995][ T6312] BTRFS info (device loop2): rebuilding free space tree [ 102.375596][ T6312] BTRFS info (device loop2): disabling free space tree [ 102.431158][ T6312] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 102.435922][ T5864] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 102.485809][ T6312] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 102.715483][ T5864] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 102.732222][ T5864] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 102.769119][ T5864] usb 4-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 102.788789][ T5864] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 102.818955][ T5864] usb 4-1: Product: syz [ 102.826056][ T5864] usb 4-1: Manufacturer: syz [ 102.850701][ T5864] mos7840 4-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 103.064397][ T6384] loop4: detected capacity change from 0 to 32768 [ 103.089185][ T11] BTRFS info (device loop2): qgroup scan completed (inconsistency flag cleared) [ 103.148525][ T6384] JBD2: Ignoring recovery information on journal [ 103.203514][ T6398] syz.2.100 (6398) used greatest stack depth: 19248 bytes left [ 103.286617][ T6384] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 103.537804][ T5786] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 103.706707][ T6384] syz.4.109 (6384) used greatest stack depth: 17752 bytes left [ 103.813796][ T5967] ocfs2: Unmounting device (7,4) on (node local) [ 104.300546][ T5864] mos7840: probe of ttyUSB0 failed with error -71 [ 104.343416][ T5864] usb 4-1: USB disconnect, device number 2 [ 104.373944][ T5864] mos7840 4-1:1.0: device disconnected [ 105.004745][ T6430] loop4: detected capacity change from 0 to 512 [ 105.098202][ T6430] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 105.123107][ T6430] ext4 filesystem being mounted at /9/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 105.186096][ T6432] request_module fs- succeeded, but still no fs? [ 105.235949][ T175] kernel write not supported for file /dummy_udc (pid: 175 comm: kworker/0:2) [ 105.298980][ T5967] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 105.928673][ T6454] netlink: 4 bytes leftover after parsing attributes in process `syz.3.126'. [ 105.956224][ T6454] netlink: 12 bytes leftover after parsing attributes in process `syz.3.126'. [ 106.120463][ T6463] loop0: detected capacity change from 0 to 2048 [ 106.171462][ T6463] Alternate GPT is invalid, using primary GPT. [ 106.178862][ T6463] loop0: p2 p3 p7 [ 106.224163][ T6463] loop2: detected capacity change from 0 to 7 [ 106.235531][ T6463] loop2: [ 106.240684][ T6463] loop2: partition table partially beyond EOD, truncated [ 106.431097][ T6470] loop3: detected capacity change from 0 to 512 [ 106.536873][ T6470] EXT4-fs error (device loop3): ext4_orphan_get:1408: inode #15: comm syz.3.133: iget: bad i_size value: 38620345925642 [ 106.580106][ T6475] FAULT_INJECTION: forcing a failure. [ 106.580106][ T6475] name failslab, interval 1, probability 0, space 0, times 0 [ 106.593845][ T6475] CPU: 0 PID: 6475 Comm: syz.2.135 Not tainted syzkaller #0 [ 106.601168][ T6475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 106.611252][ T6475] Call Trace: [ 106.614560][ T6475] [ 106.617522][ T6475] dump_stack_lvl+0x18c/0x250 [ 106.622238][ T6475] ? show_regs_print_info+0x20/0x20 [ 106.627460][ T6475] ? load_image+0x420/0x420 [ 106.631968][ T6475] ? __might_sleep+0xe0/0xe0 [ 106.636557][ T6475] ? __lock_acquire+0x7eb0/0x7eb0 [ 106.641585][ T6475] should_fail_ex+0x394/0x4c0 [ 106.646270][ T6475] should_failslab+0x9/0x20 [ 106.650767][ T6475] slab_pre_alloc_hook+0x59/0x300 [ 106.655785][ T6475] ? asymmetric_key_generate_id+0xf0/0x150 [ 106.661590][ T6475] ? x509_key_preparse+0x225/0x6c0 [ 106.666731][ T6475] ? x509_key_preparse+0x225/0x6c0 [ 106.671837][ T6475] __kmem_cache_alloc_node+0x53/0x260 [ 106.677236][ T6475] ? x509_key_preparse+0x225/0x6c0 [ 106.682352][ T6475] __kmalloc+0xa7/0x240 [ 106.686518][ T6475] x509_key_preparse+0x225/0x6c0 [ 106.691462][ T6475] asymmetric_key_preparse+0xa9/0x140 [ 106.696866][ T6475] __key_create_or_update+0x351/0xa60 [ 106.702244][ T6475] ? key_create_or_update+0x60/0x60 [ 106.707437][ T6475] ? bpf_lsm_key_permission+0x9/0x10 [ 106.712727][ T6475] ? lookup_user_key+0xb66/0x1140 [ 106.718192][ T6475] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 106.724196][ T6475] key_create_or_update+0x42/0x60 [ 106.729229][ T6475] __se_sys_add_key+0x34f/0x410 [ 106.734081][ T6475] ? __x64_sys_add_key+0xc0/0xc0 [ 106.739022][ T6475] ? lockdep_hardirqs_on+0x98/0x150 [ 106.744228][ T6475] ? __x64_sys_add_key+0x20/0xc0 [ 106.749165][ T6475] do_syscall_64+0x55/0xb0 [ 106.753580][ T6475] ? clear_bhb_loop+0x40/0x90 [ 106.758254][ T6475] ? clear_bhb_loop+0x40/0x90 [ 106.762927][ T6475] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 106.768815][ T6475] RIP: 0033:0x7fe05379f559 [ 106.773233][ T6475] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.792842][ T6475] RSP: 002b:00007fe05461d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 106.801251][ T6475] RAX: ffffffffffffffda RBX: 00007fe053a25fa0 RCX: 00007fe05379f559 [ 106.809221][ T6475] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 106.817187][ T6475] RBP: 00007fe053836b20 R08: ffffffffffffffff R09: 0000000000000000 [ 106.825156][ T6475] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 106.833120][ T6475] R13: 00007fe053a26038 R14: 00007fe053a25fa0 R15: 00007ffe46b39c68 [ 106.841102][ T6475] [ 106.866702][ T6470] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.133: couldn't read orphan inode 15 (err -117) [ 106.908369][ T6470] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 107.118667][ T5781] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.465801][ T5949] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 107.665800][ T5949] usb 5-1: Using ep0 maxpacket: 16 [ 107.679264][ T5949] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 107.695771][ T5949] usb 5-1: config 0 has no interface number 0 [ 107.712298][ T5949] usb 5-1: config 0 interface 1 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 107.733468][ T5949] usb 5-1: config 0 interface 1 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 107.748460][ T5949] usb 5-1: config 0 interface 1 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 107.783398][ T5949] usb 5-1: config 0 interface 1 has no altsetting 0 [ 107.803645][ T5949] usb 5-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 107.825860][ T5949] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.868452][ T5949] usb 5-1: config 0 descriptor?? [ 107.883085][ T5949] usbhid 5-1:0.1: fixing wrong optional hid class descriptors count [ 107.904260][ T6503] netlink: 'syz.2.145': attribute type 1 has an invalid length. [ 108.330060][ T5949] elan 0003:04F3:074D.0002: failed to start in urb: -90 [ 108.737647][ T5949] elan 0003:04F3:074D.0002: Get report error for parm 6: 0 [ 109.353699][ T5949] elan 0003:04F3:074D.0002: Set report error for parm 8: -71 [ 109.373637][ T5949] elan 0003:04F3:074D.0002: hidraw0: USB HID v0.00 Joystick [HID 04f3:074d] on usb-dummy_hcd.4-1/input1 [ 109.403090][ T5949] elan 0003:04F3:074D.0002: Input device is not registered [ 109.433095][ T5949] elan: probe of 0003:04F3:074D.0002 failed with error -119 [ 109.454439][ T5949] usb 5-1: USB disconnect, device number 3 [ 109.498944][ T6528] fido_id[6528]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 109.513231][ T6530] sctp: [Deprecated]: syz.2.154 (pid 6530) Use of int in maxseg socket option. [ 109.513231][ T6530] Use struct sctp_assoc_value instead [ 110.241029][ T6558] loop4: detected capacity change from 0 to 1024 [ 110.262818][ T6558] hfsplus: write access to a journaled filesystem is not supported, use the force option at your own risk, mounting read-only. [ 110.372096][ T11] rpcbind: server 127.0.0.1 not responding, timed out [ 110.699645][ T6569] loop2: detected capacity change from 0 to 256 [ 110.715303][ T6569] exfat: Deprecated parameter 'utf8' [ 110.814456][ T6569] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe3908169, utbl_chksum : 0xe619d30d) [ 111.245884][ T5949] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 111.478433][ T5949] usb 4-1: unable to get BOS descriptor or descriptor too short [ 111.494186][ T5949] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 111.512740][ T5949] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 111.531870][ T5949] usb 4-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 111.563542][ T5949] usb 4-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 111.608411][ T5949] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 111.625052][ T5949] usb 4-1: config 1 interface 1 has no altsetting 0 [ 111.648639][ T5949] usb 4-1: string descriptor 0 read error: -22 [ 111.668444][ T5949] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 111.679122][ T5949] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.700189][ T6605] loop4: detected capacity change from 0 to 1024 [ 111.738473][ T6605] hfsplus: invalid btree flag [ 111.753273][ T6605] hfsplus: failed to load attributes file [ 111.927003][ T6607] loop4: detected capacity change from 0 to 164 [ 111.998525][ T27] audit: type=1326 audit(1793131387.730:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.069132][ T27] audit: type=1326 audit(1793131387.760:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.109577][ T27] audit: type=1326 audit(1793131387.760:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.133623][ C1] vkms_vblank_simulate: vblank timer overrun [ 112.164781][ T27] audit: type=1326 audit(1793131387.770:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.193950][ T27] audit: type=1326 audit(1793131387.770:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.217726][ C1] vkms_vblank_simulate: vblank timer overrun [ 112.233743][ T27] audit: type=1326 audit(1793131387.770:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.266990][ T27] audit: type=1326 audit(1793131387.770:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.296711][ T27] audit: type=1326 audit(1793131387.770:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.320516][ C1] vkms_vblank_simulate: vblank timer overrun [ 112.332459][ T27] audit: type=1326 audit(1793131387.770:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.365311][ T27] audit: type=1326 audit(1793131387.770:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6606 comm="syz.4.180" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4db659f559 code=0x7ffc0000 [ 112.834825][ T5949] usb 4-1: USB disconnect, device number 3 [ 116.977069][ T6694] netlink: 4 bytes leftover after parsing attributes in process `syz.0.200'. [ 116.997781][ T6694] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 117.164039][ T6694] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 117.205668][ T6707] bridge_slave_0: left allmulticast mode [ 117.221013][ T6707] bridge_slave_0: left promiscuous mode [ 117.249860][ T6707] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.455523][ T6722] ip_tables: iptables: counters copy to user failed while replacing table [ 117.667999][ T6728] loop3: detected capacity change from 0 to 128 [ 117.706619][ T6728] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 117.761417][ T6728] ext4 filesystem being mounted at /59/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 117.819245][ T6737] netlink: 12 bytes leftover after parsing attributes in process `syz.0.210'. [ 117.871435][ T6737] xfrm1: entered promiscuous mode [ 117.894810][ T5784] Bluetooth: Frame is too long (len 10, expected len 4) [ 117.911317][ T6737] xfrm1: entered allmulticast mode [ 117.928817][ T6737] netlink: 12 bytes leftover after parsing attributes in process `syz.0.210'. [ 117.947431][ T6737] Zero length message leads to an empty skb [ 117.948260][ T6728] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 118.126010][ T6750] loop2: detected capacity change from 0 to 64 [ 118.415871][ T23] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 118.607014][ T23] usb 4-1: Using ep0 maxpacket: 32 [ 118.614557][ T23] usb 4-1: unable to get BOS descriptor or descriptor too short [ 118.633606][ T23] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 118.656210][ T23] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 118.668425][ T23] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 118.686332][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.703443][ T23] usb 4-1: Product: syz [ 118.707825][ T23] usb 4-1: Manufacturer: syz [ 118.713540][ T23] usb 4-1: SerialNumber: syz [ 118.774989][ T6778] loop5: detected capacity change from 0 to 7 [ 118.803607][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 118.828931][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 118.838372][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.849472][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 118.858673][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.869939][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 118.879153][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.889430][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 118.898627][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.910836][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 118.920040][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.930800][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 118.945802][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 118.954958][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.964658][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 118.973892][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.985403][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 118.994614][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 119.004451][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 119.021358][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 119.033602][ T6778] ldm_validate_partition_table(): Disk read failed. [ 119.041996][ T6778] Dev loop5: unable to read RDB block 0 [ 119.051550][ T6778] loop5: unable to read partition table [ 119.059934][ T6778] loop5: partition table beyond EOD, truncated [ 119.079485][ T6778] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 119.192013][ T23] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 119.254141][ T23] snd-usb-audio: probe of 4-1:1.0 failed with error -22 [ 119.288642][ T6755] udevd[6755]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 119.519192][ T175] usb 4-1: USB disconnect, device number 4 [ 119.681954][ T6805] loop0: detected capacity change from 0 to 512 [ 119.708292][ T6805] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 119.740973][ T6805] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (35405!=33349) [ 119.764260][ T6805] EXT4-fs (loop0): orphan cleanup on readonly fs [ 119.777581][ T6805] EXT4-fs (loop0): 1 truncate cleaned up [ 119.789480][ T6805] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 119.840302][ T6810] loop2: detected capacity change from 0 to 512 [ 119.863049][ T5785] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.918869][ T6810] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 119.939508][ T6810] ext4 filesystem being mounted at /58/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 119.958698][ T5784] Bluetooth: hci0: command tx timeout [ 120.564139][ T5786] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.854708][ T6825] loop3: detected capacity change from 0 to 32768 [ 120.901208][ T6825] JBD2: Ignoring recovery information on journal [ 120.941811][ T6823] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.950205][ T6823] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.018460][ T6825] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 121.076724][ T5857] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 121.285205][ T5857] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 121.295503][ T5857] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.332564][ T5781] ocfs2: Unmounting device (7,3) on (node local) [ 121.594439][ T6823] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.829651][ T6849] loop3: detected capacity change from 0 to 1024 [ 121.857283][ T6849] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 122.036981][ T5789] Bluetooth: hci0: command tx timeout [ 122.057462][ T6849] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:478: comm syz.3.239: Invalid block bitmap block 0 in block_group 0 [ 122.114160][ T6849] EXT4-fs (loop3): Remounting filesystem read-only [ 122.143142][ T6849] __quota_error: 8 callbacks suppressed [ 122.143184][ T6849] Quota error (device loop3): write_blk: dquota write failed [ 122.181530][ T6850] loop4: detected capacity change from 0 to 32768 [ 122.182231][ T6849] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 122.212867][ T6849] EXT4-fs (loop3): 1 orphan inode deleted [ 122.226247][ T6850] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 122.234825][ T6850] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 122.269774][ T6850] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 122.303717][ T5949] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 122.312384][ T5949] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 122.334503][ T6849] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 122.382461][ T5949] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 70ms [ 122.394357][ T5949] gfs2: fsid=syz:syz.0: jid=0: Done [ 122.402845][ T6850] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 122.427363][ T5857] usb 3-1: non-Atmel transceiver xxxx1f7f [ 122.571741][ T6823] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.599556][ T6823] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.610126][ T6823] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.619810][ T6823] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.644585][ T5857] usb 3-1: Firmware version (0.0) predates our first public release. [ 122.670681][ T5857] usb 3-1: Please update to version 0.2 or newer [ 122.686600][ T5857] usb 3-1: atusb_probe: initialization failed, error = -19 [ 122.689023][ T5781] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 122.712212][ T5857] usb 3-1: USB disconnect, device number 3 [ 122.963521][ T6872] netlink: 'syz.3.241': attribute type 1 has an invalid length. [ 123.285445][ T6884] loop2: detected capacity change from 0 to 256 [ 123.351534][ T5949] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 123.401807][ T6884] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 123.441026][ T6891] FAULT_INJECTION: forcing a failure. [ 123.441026][ T6891] name failslab, interval 1, probability 0, space 0, times 0 [ 123.498049][ T6891] CPU: 1 PID: 6891 Comm: syz.3.247 Not tainted syzkaller #0 [ 123.505385][ T6891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 123.515460][ T6891] Call Trace: [ 123.518759][ T6891] [ 123.521710][ T6891] dump_stack_lvl+0x18c/0x250 [ 123.526436][ T6891] ? show_regs_print_info+0x20/0x20 [ 123.531663][ T6891] ? load_image+0x420/0x420 [ 123.536205][ T6891] should_fail_ex+0x394/0x4c0 [ 123.540908][ T6891] should_failslab+0x9/0x20 [ 123.545431][ T6891] slab_pre_alloc_hook+0x59/0x300 [ 123.550489][ T6891] ? nf_ct_ext_add+0x1ab/0x3e0 [ 123.555286][ T6891] ? nf_ct_ext_add+0x1ab/0x3e0 [ 123.560078][ T6891] __kmem_cache_alloc_node+0x53/0x260 [ 123.565480][ T6891] ? nf_ct_ext_add+0x1ab/0x3e0 [ 123.570275][ T6891] __kmalloc_node_track_caller+0xa4/0x230 [ 123.576034][ T6891] krealloc+0x86/0x120 [ 123.580138][ T6891] nf_ct_ext_add+0x1ab/0x3e0 [ 123.584764][ T6891] init_conntrack+0x63a/0x1020 [ 123.589556][ T6891] ? __nf_conntrack_find_get+0x481/0x550 [ 123.595211][ T6891] ? early_drop+0x7f0/0x7f0 [ 123.599749][ T6891] ? nf_conntrack_find_get+0x670/0x670 [ 123.605244][ T6891] ? __siphash_unaligned+0x25c/0x3d0 [ 123.610431][ T5949] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 123.610543][ T6891] nf_conntrack_in+0xc29/0x1600 [ 123.626192][ T6891] ? nf_ct_pernet+0x270/0x270 [ 123.630904][ T6891] ? ip6t_do_table+0x1cb/0x1570 [ 123.635761][ T5949] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 123.635789][ T6891] ? ip6t_alloc_initial_table+0x640/0x640 [ 123.652353][ T6891] ? __lock_acquire+0x135d/0x7eb0 [ 123.657405][ T6891] ? ipv6_defrag+0x2d6/0x3a0 [ 123.662018][ T6891] ? ipv6_conntrack_in+0x20/0x20 [ 123.664820][ T5949] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 123.666979][ T6891] nf_hook_slow+0xb9/0x210 [ 123.667010][ T6891] ? ip6_xmit+0x1a30/0x1a30 [ 123.685673][ T6891] nf_hook+0x228/0x390 [ 123.689775][ T6891] ? ip6_mtu+0x7d/0x4a0 [ 123.693969][ T6891] ? nf_hook+0xa2/0x390 [ 123.695805][ T5949] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 123.698128][ T6891] ? ip6_make_skb+0x520/0x520 [ 123.698160][ T6891] ? ip6_xmit+0x1a30/0x1a30 [ 123.698192][ T6891] ? ip6_xmit+0x2db/0x1a30 [ 123.724710][ T6891] ip6_xmit+0x115b/0x1a30 [ 123.729064][ T6891] ? ip6_xmit+0x1a30/0x1a30 [ 123.729617][ T5949] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 123.733583][ T6891] ? ip6_xmit+0x2db/0x1a30 [ 123.733616][ T6891] ? ip6_autoflowlabel+0xe0/0xe0 [ 123.733646][ T6891] ? inet6_csk_route_socket+0x655/0xf70 [ 123.752938][ T5949] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 123.757498][ T6891] ? read_lock_is_recursive+0x20/0x20 [ 123.757539][ T6891] inet6_csk_xmit+0x42e/0x6b0 [ 123.757567][ T6891] ? inet6_csk_xmit+0x1d1/0x6b0 [ 123.757589][ T6891] ? inet6_csk_addr2sockaddr+0x1e0/0x1e0 [ 123.757621][ T6891] ? csum_ipv6_magic+0x1ea/0x2f0 [ 123.757663][ T6891] __tcp_transmit_skb+0x1dd6/0x3470 [ 123.757709][ T6891] ? __tcp_send_ack+0x5f0/0x5f0 [ 123.782377][ T5949] usb 1-1: Manufacturer: syz [ 123.786251][ T6891] ? __asan_memset+0x22/0x40 [ 123.786283][ T6891] ? tcp_rbtree_insert+0x118/0x170 [ 123.786303][ T6891] ? tcp_connect+0x2ac6/0x5310 [ 123.786329][ T6891] tcp_connect+0x20a2/0x5310 [ 123.807226][ T5949] usb 1-1: config 0 descriptor?? [ 123.810472][ T6891] ? tcp_options_write+0xc70/0xc70 [ 123.834989][ T6891] ? read_tsc+0x9/0x20 [ 123.839101][ T6891] ? __asan_memset+0x22/0x40 [ 123.843731][ T6891] ? tcp_fastopen_active_should_disable+0x240/0x240 [ 123.850363][ T6891] ? inet6_hash_connect+0x7b/0xe0 [ 123.855409][ T6891] tcp_v6_connect+0x11ba/0x18e0 [ 123.860299][ T6891] ? tcp_v6_pre_connect+0xf0/0xf0 [ 123.865351][ T6891] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 123.871368][ T6891] ? __local_bh_enable_ip+0x13a/0x1c0 [ 123.876794][ T6891] ? lockdep_hardirqs_on+0x98/0x150 [ 123.882024][ T6891] ? __local_bh_enable_ip+0x13a/0x1c0 [ 123.887437][ T6891] ? _local_bh_enable+0xa0/0xa0 [ 123.892310][ T6891] ? do_raw_spin_unlock+0x121/0x230 [ 123.897542][ T6891] mptcp_connect+0x518/0x770 [ 123.902171][ T6891] __inet_stream_connect+0x254/0xdf0 [ 123.907488][ T6891] ? lock_chain_count+0x20/0x20 [ 123.912365][ T6891] ? __local_bh_enable_ip+0x13a/0x1c0 [ 123.917759][ T6891] ? inet_dgram_connect+0x340/0x340 [ 123.922986][ T6891] ? __local_bh_enable_ip+0x13a/0x1c0 [ 123.928383][ T6891] ? _local_bh_enable+0xa0/0xa0 [ 123.933268][ T6891] inet_stream_connect+0x66/0xa0 [ 123.938238][ T6891] __sys_connect+0x3da/0x470 [ 123.942853][ T6891] ? __sys_connect_file+0x170/0x170 [ 123.948096][ T6891] __x64_sys_connect+0x7a/0x90 [ 123.952889][ T6891] do_syscall_64+0x55/0xb0 [ 123.957339][ T6891] ? clear_bhb_loop+0x40/0x90 [ 123.962051][ T6891] ? clear_bhb_loop+0x40/0x90 [ 123.966760][ T6891] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 123.972682][ T6891] RIP: 0033:0x7f387139f559 [ 123.977133][ T6891] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.996761][ T6891] RSP: 002b:00007f387226e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 124.005197][ T6891] RAX: ffffffffffffffda RBX: 00007f3871625fa0 RCX: 00007f387139f559 [ 124.013190][ T6891] RDX: 000000000000001c RSI: 0000200000000080 RDI: 0000000000000004 [ 124.021184][ T6891] RBP: 00007f3871436b20 R08: 0000000000000000 R09: 0000000000000000 [ 124.029173][ T6891] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.037167][ T6891] R13: 00007f3871626038 R14: 00007f3871625fa0 R15: 00007fff87d91368 [ 124.045188][ T6891] [ 124.076637][ T6900] FAT-fs (loop2): error, corrupted file size (i_pos 196, 16779264) [ 124.148914][ T6900] FAT-fs (loop2): Filesystem has been set read-only [ 124.253911][ T5949] appleir 0003:05AC:8243.0003: unknown main item tag 0x0 [ 124.283082][ T5949] appleir 0003:05AC:8243.0003: No inputs registered, leaving [ 124.336717][ T5949] appleir 0003:05AC:8243.0003: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 124.453943][ T27] audit: type=1800 audit(1793131400.190:21): pid=6884 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.246" name="file1" dev="loop2" ino=1048630 res=0 errno=0 [ 124.701156][ T5890] usb 1-1: USB disconnect, device number 5 [ 125.757108][ T6951] TCP: TCP_TX_DELAY enabled [ 126.435995][ T5857] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 126.620630][ T6977] syzkaller1: entered promiscuous mode [ 126.631865][ T6977] syzkaller1: entered allmulticast mode [ 126.639294][ T5857] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 126.645316][ T5857] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 126.645367][ T5857] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 126.679501][ T5857] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.966315][ T5857] usb 5-1: usb_control_msg returned -32 [ 126.971949][ T5857] usbtmc 5-1:16.0: can't read capabilities [ 127.467812][ T6989] FAULT_INJECTION: forcing a failure. [ 127.467812][ T6989] name failslab, interval 1, probability 0, space 0, times 0 [ 127.484499][ T6989] CPU: 0 PID: 6989 Comm: syz.3.275 Not tainted syzkaller #0 [ 127.491824][ T6989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 127.501995][ T6989] Call Trace: [ 127.505291][ T6989] [ 127.508241][ T6989] dump_stack_lvl+0x18c/0x250 [ 127.512956][ T6989] ? show_regs_print_info+0x20/0x20 [ 127.518182][ T6989] ? load_image+0x420/0x420 [ 127.522712][ T6989] ? __might_sleep+0xe0/0xe0 [ 127.527328][ T6989] ? __lock_acquire+0x7eb0/0x7eb0 [ 127.532380][ T6989] should_fail_ex+0x394/0x4c0 [ 127.537087][ T6989] should_failslab+0x9/0x20 [ 127.541624][ T6989] slab_pre_alloc_hook+0x59/0x300 [ 127.546672][ T6989] kmem_cache_alloc_lru+0x4d/0x2c0 [ 127.551799][ T6989] ? proc_alloc_inode+0x2a/0xb0 [ 127.556674][ T6989] proc_alloc_inode+0x2a/0xb0 [ 127.561372][ T6989] ? proc_invalidate_siblings_dcache+0x6c0/0x6c0 [ 127.567726][ T6989] new_inode_pseudo+0x63/0x1d0 [ 127.572522][ T6989] new_inode+0x22/0x1d0 [ 127.576799][ T6989] proc_get_inode+0x22/0x730 [ 127.581427][ T6989] proc_lookup_de+0x248/0x2f0 [ 127.586134][ T6989] ? proc_lookup_de+0x2f0/0x2f0 [ 127.591006][ T6989] path_openat+0x1110/0x3270 [ 127.595646][ T6989] ? do_filp_open+0x430/0x430 [ 127.600360][ T6989] do_filp_open+0x1f2/0x430 [ 127.604888][ T6989] ? vfs_tmpfile+0x620/0x620 [ 127.609509][ T6989] ? noop_direct_IO+0x20/0x20 [ 127.614213][ T6989] ? _raw_spin_unlock+0x28/0x40 [ 127.619096][ T6989] ? alloc_fd+0x590/0x640 [ 127.623468][ T6989] do_sys_openat2+0x134/0x1d0 [ 127.628178][ T6989] ? do_sys_open+0xe0/0xe0 [ 127.632623][ T6989] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 127.638463][ T5857] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 127.638613][ T6989] ? lock_chain_count+0x20/0x20 [ 127.650853][ T6989] __x64_sys_openat+0x139/0x160 [ 127.655733][ T6989] do_syscall_64+0x55/0xb0 [ 127.660175][ T6989] ? clear_bhb_loop+0x40/0x90 [ 127.664877][ T6989] ? clear_bhb_loop+0x40/0x90 [ 127.669583][ T6989] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 127.675502][ T6989] RIP: 0033:0x7f387135fd8e [ 127.679938][ T6989] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 127.699741][ T6989] RSP: 002b:00007f387226dec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 127.708181][ T6989] RAX: ffffffffffffffda RBX: 00007f387226e6c0 RCX: 00007f387135fd8e [ 127.716172][ T6989] RDX: 0000000000000002 RSI: 00007f387226df90 RDI: ffffffffffffff9c [ 127.722534][ T5857] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 127.724133][ T6989] RBP: 00007f3871436b20 R08: 0000000000000000 R09: 0000000000000000 [ 127.741650][ T6989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.749650][ T6989] R13: 00007f3871626038 R14: 00007f3871625fa0 R15: 00007fff87d91368 [ 127.757659][ T6989] [ 127.801961][ T5890] usb 5-1: USB disconnect, device number 4 [ 128.050454][ T6997] loop3: detected capacity change from 0 to 1024 [ 128.123651][ T6997] hfsplus: invalid length 1280 has been corrected to 255 [ 128.184086][ T6997] FAULT_INJECTION: forcing a failure. [ 128.184086][ T6997] name failslab, interval 1, probability 0, space 0, times 0 [ 128.212801][ T6997] CPU: 1 PID: 6997 Comm: syz.3.277 Not tainted syzkaller #0 [ 128.220142][ T6997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 128.230224][ T6997] Call Trace: [ 128.233535][ T6997] [ 128.236486][ T6997] dump_stack_lvl+0x18c/0x250 [ 128.241204][ T6997] ? show_regs_print_info+0x20/0x20 [ 128.246436][ T6997] ? load_image+0x420/0x420 [ 128.250959][ T6997] ? __might_sleep+0xe0/0xe0 [ 128.255576][ T6997] ? __lock_acquire+0x7eb0/0x7eb0 [ 128.260640][ T6997] should_fail_ex+0x394/0x4c0 [ 128.265352][ T6997] should_failslab+0x9/0x20 [ 128.269886][ T6997] slab_pre_alloc_hook+0x59/0x300 [ 128.274932][ T6997] ? prepend_path+0x8a7/0x950 [ 128.279639][ T6997] ? tomoyo_encode+0x2ad/0x570 [ 128.284429][ T6997] ? tomoyo_encode+0x2ad/0x570 [ 128.289217][ T6997] __kmem_cache_alloc_node+0x53/0x260 [ 128.294652][ T6997] ? tomoyo_encode+0x2ad/0x570 [ 128.299444][ T6997] __kmalloc+0xa7/0x240 [ 128.303634][ T6997] tomoyo_encode+0x2ad/0x570 [ 128.308260][ T6997] tomoyo_realpath_from_path+0x57c/0x5c0 [ 128.313926][ T6997] ? tomoyo_domain+0xd6/0x120 [ 128.318640][ T6997] tomoyo_path_number_perm+0x248/0x5e0 [ 128.324123][ T6997] ? tomoyo_path_number_perm+0x217/0x5e0 [ 128.329776][ T6997] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 128.335298][ T6997] ? do_raw_spin_unlock+0x121/0x230 [ 128.340527][ T6997] ? hook_path_mknod+0x157/0x540 [ 128.345487][ T6997] ? d_alloc+0x1eb/0x250 [ 128.349755][ T6997] tomoyo_path_mknod+0x14b/0x1a0 [ 128.354716][ T6997] ? hook_path_mkdir+0x20/0x20 [ 128.359508][ T6997] ? tomoyo_path_symlink+0xf0/0xf0 [ 128.364642][ T6997] ? kern_path_create+0x50/0x50 [ 128.369520][ T6997] security_path_mknod+0xf0/0x150 [ 128.374569][ T6997] do_mknodat+0x25a/0x500 [ 128.379011][ T6997] ? do_o_path+0x200/0x200 [ 128.383461][ T6997] __x64_sys_mknod+0x8e/0xa0 [ 128.388081][ T6997] do_syscall_64+0x55/0xb0 [ 128.392525][ T6997] ? clear_bhb_loop+0x40/0x90 [ 128.397229][ T6997] ? clear_bhb_loop+0x40/0x90 [ 128.401926][ T6997] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 128.407834][ T6997] RIP: 0033:0x7f387139f559 [ 128.412264][ T6997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.431886][ T6997] RSP: 002b:00007f387226e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 128.440315][ T6997] RAX: ffffffffffffffda RBX: 00007f3871625fa0 RCX: 00007f387139f559 [ 128.448282][ T6997] RDX: 0000000002000008 RSI: 000000000000c000 RDI: 0000200000000280 [ 128.456255][ T6997] RBP: 00007f3871436b20 R08: 0000000000000000 R09: 0000000000000000 [ 128.464214][ T6997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.472194][ T6997] R13: 00007f3871626038 R14: 00007f3871625fa0 R15: 00007fff87d91368 [ 128.480218][ T6997] [ 128.483234][ C1] vkms_vblank_simulate: vblank timer overrun [ 128.495904][ T6997] ERROR: Out of memory at tomoyo_realpath_from_path. [ 128.590786][ T5781] hfsplus: invalid length 1280 has been corrected to 255 [ 128.646993][ T7006] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 128.934979][ T42] hfsplus: invalid length 1280 has been corrected to 255 [ 129.060092][ T4456] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.164907][ T7019] loop2: detected capacity change from 0 to 2048 [ 129.176116][ T4456] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.205233][ T7019] ext4: Unknown parameter 'obj_type' [ 129.329338][ T4456] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.478409][ T4456] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.066681][ T7038] FAULT_INJECTION: forcing a failure. [ 130.066681][ T7038] name failslab, interval 1, probability 0, space 0, times 0 [ 130.115846][ T7038] CPU: 1 PID: 7038 Comm: syz.4.295 Not tainted syzkaller #0 [ 130.123184][ T7038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 130.133234][ T7038] Call Trace: [ 130.136511][ T7038] [ 130.139441][ T7038] dump_stack_lvl+0x18c/0x250 [ 130.144130][ T7038] ? show_regs_print_info+0x20/0x20 [ 130.149327][ T7038] ? load_image+0x420/0x420 [ 130.153831][ T7038] ? __lock_acquire+0x7eb0/0x7eb0 [ 130.158861][ T7038] ? rcu_is_watching+0x15/0xb0 [ 130.163625][ T7038] ? trace_contention_end+0x39/0xe0 [ 130.168819][ T7038] should_fail_ex+0x394/0x4c0 [ 130.173504][ T7038] should_failslab+0x9/0x20 [ 130.178007][ T7038] slab_pre_alloc_hook+0x59/0x300 [ 130.183036][ T7038] ? kvmalloc_node+0x70/0x180 [ 130.187742][ T7038] ? kvmalloc_node+0x70/0x180 [ 130.192423][ T7038] __kmem_cache_alloc_node+0x53/0x260 [ 130.197793][ T7038] ? kvmalloc_node+0x70/0x180 [ 130.202471][ T7038] __kmalloc_node+0xa6/0x240 [ 130.207058][ T7038] ? security_capable+0x89/0xb0 [ 130.211911][ T7038] kvmalloc_node+0x70/0x180 [ 130.216412][ T7038] __se_sys_setgroups+0xec/0x410 [ 130.221344][ T7038] ? syscall_enter_from_user_mode+0x25/0x80 [ 130.227231][ T7038] ? lockdep_hardirqs_on+0x98/0x150 [ 130.232435][ T7038] do_syscall_64+0x55/0xb0 [ 130.236854][ T7038] ? clear_bhb_loop+0x40/0x90 [ 130.241529][ T7038] ? clear_bhb_loop+0x40/0x90 [ 130.246203][ T7038] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 130.252095][ T7038] RIP: 0033:0x7f4db659f559 [ 130.256502][ T7038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.276130][ T7038] RSP: 002b:00007f4db73c7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 130.284553][ T7038] RAX: ffffffffffffffda RBX: 00007f4db6825fa0 RCX: 00007f4db659f559 [ 130.292520][ T7038] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 130.300486][ T7038] RBP: 00007f4db6636b20 R08: 0000000000000000 R09: 0000000000000000 [ 130.308463][ T7038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 130.316427][ T7038] R13: 00007f4db6826038 R14: 00007f4db6825fa0 R15: 00007ffc88a8c508 [ 130.324406][ T7038] [ 130.360935][ T7043] FAULT_INJECTION: forcing a failure. [ 130.360935][ T7043] name failslab, interval 1, probability 0, space 0, times 0 [ 130.390859][ T7043] CPU: 1 PID: 7043 Comm: syz.0.296 Not tainted syzkaller #0 [ 130.398191][ T7043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 130.408264][ T7043] Call Trace: [ 130.411563][ T7043] [ 130.414510][ T7043] dump_stack_lvl+0x18c/0x250 [ 130.419222][ T7043] ? show_regs_print_info+0x20/0x20 [ 130.424456][ T7043] ? load_image+0x420/0x420 [ 130.428988][ T7043] ? __might_sleep+0xe0/0xe0 [ 130.433606][ T7043] ? __lock_acquire+0x7eb0/0x7eb0 [ 130.438661][ T7043] should_fail_ex+0x394/0x4c0 [ 130.443371][ T7043] should_failslab+0x9/0x20 [ 130.447893][ T7043] slab_pre_alloc_hook+0x59/0x300 [ 130.452936][ T7043] ? d_instantiate+0x6f/0x90 [ 130.456946][ T5784] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 130.457529][ T7043] kmem_cache_alloc+0x5a/0x2d0 [ 130.457551][ T7043] ? alloc_empty_file+0x9e/0x1d0 [ 130.474512][ T7043] alloc_empty_file+0x9e/0x1d0 [ 130.479307][ T7043] alloc_file+0x5b/0x600 [ 130.483576][ T7043] alloc_file_pseudo+0x184/0x210 [ 130.488537][ T7043] ? fput+0x1a0/0x1a0 [ 130.492543][ T7043] ? alloc_fd+0x590/0x640 [ 130.496902][ T7043] sock_alloc_file+0xb7/0x280 [ 130.501607][ T7043] __sys_socket+0x140/0x1b0 [ 130.506141][ T7043] __x64_sys_socket+0x7a/0x90 [ 130.510841][ T7043] do_syscall_64+0x55/0xb0 [ 130.515259][ T7043] ? clear_bhb_loop+0x40/0x90 [ 130.519936][ T7043] ? clear_bhb_loop+0x40/0x90 [ 130.524610][ T7043] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 130.530499][ T7043] RIP: 0033:0x7f5fde79f559 [ 130.534994][ T7043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.554597][ T7043] RSP: 002b:00007f5fdf5dc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 130.563019][ T7043] RAX: ffffffffffffffda RBX: 00007f5fdea25fa0 RCX: 00007f5fde79f559 [ 130.570986][ T7043] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000001d [ 130.578950][ T7043] RBP: 00007f5fde836b20 R08: 0000000000000000 R09: 0000000000000000 [ 130.586923][ T7043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 130.594886][ T7043] R13: 00007f5fdea26038 R14: 00007f5fdea25fa0 R15: 00007fff5ea6ea38 [ 130.602870][ T7043] [ 130.617726][ T5784] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 130.629982][ T5784] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 130.656065][ T5784] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 130.663855][ T5784] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 130.671874][ T5784] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 130.974227][ T7042] rxe_eth0 speed is unknown, defaulting to 1000 [ 131.270526][ T7069] Bluetooth: MGMT ver 1.22 [ 131.850506][ T7042] chnl_net:caif_netlink_parms(): no params data found [ 132.139146][ T4456] hsr_slave_0: left promiscuous mode [ 132.162308][ T4456] hsr_slave_1: left promiscuous mode [ 132.174526][ T4456] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 132.186122][ T4456] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 132.201774][ T4456] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 132.218606][ T4456] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 132.232865][ T4456] bridge_slave_1: left allmulticast mode [ 132.244599][ T4456] bridge_slave_1: left promiscuous mode [ 132.276433][ T4456] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.390801][ T4456] veth1_macvtap: left promiscuous mode [ 132.406186][ T4456] veth0_macvtap: left promiscuous mode [ 132.417799][ T4456] veth1_vlan: left promiscuous mode [ 132.428912][ T4456] veth0_vlan: left promiscuous mode [ 132.746541][ T7123] x86/PAT: syz.4.311:7123 freeing invalid memtype [mem 0xfe004000-0xfe004fff] [ 132.772413][ T5784] Bluetooth: hci1: command tx timeout [ 132.929954][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.942589][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.649592][ T4456] team0 (unregistering): Port device team_slave_1 removed [ 133.713643][ T4456] team0 (unregistering): Port device team_slave_0 removed [ 133.778046][ T4456] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 133.841694][ T4456] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 134.384546][ T4456] bond0 (unregistering): Released all slaves [ 134.562385][ T7042] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.574291][ T7042] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.596488][ T7042] bridge_slave_0: entered allmulticast mode [ 134.603801][ T7042] bridge_slave_0: entered promiscuous mode [ 134.638805][ T7042] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.668787][ T7042] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.692863][ T7042] bridge_slave_1: entered allmulticast mode [ 134.700484][ T7042] bridge_slave_1: entered promiscuous mode [ 134.761810][ T7042] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 134.816551][ T7042] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 134.839080][ T5784] Bluetooth: hci1: command tx timeout [ 134.930186][ T7042] team0: Port device team_slave_0 added [ 134.988791][ T7042] team0: Port device team_slave_1 added [ 135.105126][ T7042] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 135.129061][ T7149] loop0: detected capacity change from 0 to 512 [ 135.140126][ T7042] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 135.150618][ T7149] EXT4-fs: Ignoring removed bh option [ 135.224656][ T7042] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 135.239339][ T7149] EXT4-fs warning (device loop0): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 135.251990][ T7149] EXT4-fs warning (device loop0): dx_probe:881: Enable large directory feature to access it [ 135.267490][ T7149] EXT4-fs warning (device loop0): dx_probe:966: inode #2: comm syz.0.319: Corrupt directory, running e2fsck is recommended [ 135.308795][ T7042] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 135.339703][ T7042] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 135.367562][ T7149] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -117 [ 135.414596][ T7149] EXT4-fs error (device loop0): ext4_iget_extra_inode:4752: inode #15: comm syz.0.319: corrupted in-inode xattr: e_name out of bounds [ 135.433328][ T7042] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 135.481102][ T7149] EXT4-fs error (device loop0): ext4_orphan_get:1413: comm syz.0.319: couldn't read orphan inode 15 (err -117) [ 135.546264][ T7149] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 135.608122][ T7149] EXT4-fs warning (device loop0): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 135.668804][ T7149] EXT4-fs warning (device loop0): dx_probe:881: Enable large directory feature to access it [ 135.682026][ T7042] hsr_slave_0: entered promiscuous mode [ 135.699506][ T7149] EXT4-fs warning (device loop0): dx_probe:966: inode #2: comm syz.0.319: Corrupt directory, running e2fsck is recommended [ 135.713242][ T7042] hsr_slave_1: entered promiscuous mode [ 135.732713][ T7042] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 135.744297][ T7161] EXT4-fs warning (device loop0): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 135.757822][ T7042] Cannot create hsr debugfs directory [ 135.778545][ T7161] EXT4-fs warning (device loop0): dx_probe:881: Enable large directory feature to access it [ 135.835363][ T7161] EXT4-fs warning (device loop0): dx_probe:966: inode #2: comm syz.0.319: Corrupt directory, running e2fsck is recommended [ 135.879202][ T7149] EXT4-fs warning (device loop0): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 135.920514][ T7163] EXT4-fs warning (device loop0): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 135.949441][ T7149] EXT4-fs warning (device loop0): dx_probe:881: Enable large directory feature to access it [ 135.980743][ T7163] EXT4-fs warning (device loop0): dx_probe:881: Enable large directory feature to access it [ 136.022267][ T7149] EXT4-fs error (device loop0): ext4_readdir:263: inode #2: block 3: comm syz.0.319: path /91/file0: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=4294967295, rec_len=17, size=1024 fake=0 [ 136.171225][ T5785] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.377185][ T7170] ip_tables: iptables: counters copy to user failed while replacing table [ 136.442930][ T7042] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 136.500029][ T7170] syzkaller1: entered promiscuous mode [ 136.516270][ T7170] syzkaller1: entered allmulticast mode [ 136.607468][ T7176] loop2: detected capacity change from 0 to 2048 [ 136.654516][ T7042] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 136.672426][ T7042] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 136.697114][ T7176] NILFS (loop2): invalid segment: Magic number mismatch [ 136.704577][ T7176] NILFS (loop2): trying rollback from an earlier position [ 136.717189][ T7042] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 136.789028][ T7176] NILFS (loop2): recovery complete [ 136.848350][ T7180] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 136.916714][ T5784] Bluetooth: hci1: command tx timeout [ 136.968849][ T7042] 8021q: adding VLAN 0 to HW filter on device bond0 [ 137.049872][ T7042] 8021q: adding VLAN 0 to HW filter on device team0 [ 137.077847][ T7184] loop0: detected capacity change from 0 to 8 [ 137.113907][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.121120][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 137.151478][ T7184] SQUASHFS error: Failed to read block 0x4de: -5 [ 137.164717][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.171914][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 137.188618][ T7184] SQUASHFS error: Failed to read block 0x4de: -5 [ 137.200834][ T27] audit: type=1800 audit(1793131412.930:22): pid=7184 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.325" name="file1" dev="loop0" ino=5 res=0 errno=0 [ 137.223631][ T7184] SQUASHFS error: Failed to read block 0x4de: -5 [ 137.271821][ T7184] SQUASHFS error: Failed to read block 0x4de: -5 [ 137.579112][ T7042] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 137.992736][ T7042] veth0_vlan: entered promiscuous mode [ 138.022776][ T7210] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 138.075670][ T7042] veth1_vlan: entered promiscuous mode [ 138.200406][ T7042] veth0_macvtap: entered promiscuous mode [ 138.238562][ T7042] veth1_macvtap: entered promiscuous mode [ 138.281903][ T7042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 138.310922][ T7042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 138.335861][ T7042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 138.359415][ T7042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 138.402378][ T7042] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 138.439033][ T7042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 138.476049][ T7042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 138.501886][ T7042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 138.515837][ T7042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 138.531509][ T7042] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 138.573363][ T7042] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.583198][ T7042] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.599668][ T7042] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.609711][ T7042] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.724772][ T7226] loop2: detected capacity change from 0 to 256 [ 138.743445][ T7226] exfat: Deprecated parameter 'namecase' [ 138.750253][ T7226] exfat: Deprecated parameter 'namecase' [ 138.800534][ T7226] exFAT-fs (loop2): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 138.906949][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 138.946621][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 138.996359][ T5784] Bluetooth: hci1: command tx timeout [ 139.035358][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 139.058229][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 139.683371][ T7256] loop2: detected capacity change from 0 to 256 [ 139.763031][ T7256] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x1f3a413c, utbl_chksum : 0xe619d30d) [ 140.675913][ T6859] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 140.856488][ T7293] loop2: detected capacity change from 0 to 256 [ 140.886866][ T6859] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 140.907614][ T7270] loop0: detected capacity change from 0 to 32768 [ 140.917096][ T7293] exFAT-fs (loop2): invalid boot record signature [ 140.923548][ T7293] exFAT-fs (loop2): failed to read boot sector [ 140.934446][ T6859] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 140.968992][ T6859] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 140.979705][ T7293] exFAT-fs (loop2): failed to recognize exfat type [ 141.007877][ T6859] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 141.072235][ T6859] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 141.088075][ T7270] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 141.159053][ T6859] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 141.168675][ T6859] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 141.218891][ T6859] usb 6-1: Product: syz [ 141.223104][ T6859] usb 6-1: Manufacturer: syz [ 141.485812][ T7306] loop2: detected capacity change from 0 to 32768 [ 141.501779][ T7270] XFS (loop0): Ending clean mount [ 141.511325][ T6859] cdc_wdm 6-1:1.0: skipping garbage [ 141.516848][ T6859] cdc_wdm 6-1:1.0: skipping garbage [ 141.526278][ T6859] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 141.532695][ T6859] cdc_wdm 6-1:1.0: Unknown control protocol [ 141.555555][ T7306] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 142.107444][ T5785] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 142.823097][ T7325] loop0: detected capacity change from 0 to 512 [ 142.855032][ T7325] EXT4-fs: Ignoring removed nomblk_io_submit option [ 142.887568][ T7325] EXT4-fs: Ignoring removed nomblk_io_submit option [ 142.913708][ T7325] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 142.975521][ T7325] EXT4-fs (loop0): 1 truncate cleaned up [ 142.998118][ T7325] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 143.269985][ T5785] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 143.414641][ T5949] usb 6-1: USB disconnect, device number 2 [ 143.688480][ T7345] loop0: detected capacity change from 0 to 512 [ 143.750895][ T7345] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 143.811796][ T7345] EXT4-fs (loop0): 1 truncate cleaned up [ 143.832382][ T7345] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 144.003377][ T5786] ocfs2: Unmounting device (7,2) on (node local) [ 144.318871][ T5785] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.513438][ T7360] loop0: detected capacity change from 0 to 128 [ 144.942774][ T7375] warning: `syz.5.366' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 145.217016][ T5890] input: syz0 as /devices/virtual/misc/uhid/0005:FFFD057E:0305.0005/input/input6 [ 145.279133][ T5890] hid-generic 0005:FFFD057E:0305.0005: input,hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 145.506152][ T175] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 145.618193][ T7370] loop0: detected capacity change from 0 to 40427 [ 145.661179][ T7370] F2FS-fs (loop0): Fix alignment : internally, start(4096) end(16896) block(12288) [ 145.690522][ T7370] F2FS-fs (loop0): invalid crc value [ 145.706642][ T175] usb 3-1: unable to get BOS descriptor or descriptor too short [ 145.722621][ T175] usb 3-1: no configurations [ 145.736370][ T175] usb 3-1: can't read configurations, error -22 [ 145.761548][ T7370] F2FS-fs (loop0): Found nat_bits in checkpoint [ 145.918256][ T7370] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 145.960884][ T7399] FAULT_INJECTION: forcing a failure. [ 145.960884][ T7399] name failslab, interval 1, probability 0, space 0, times 0 [ 145.987073][ T7370] F2FS-fs (loop0): Try to recover all the superblocks, ret: 0 [ 145.995166][ T7399] CPU: 0 PID: 7399 Comm: syz.5.371 Not tainted syzkaller #0 [ 146.002833][ T7399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 146.012910][ T7399] Call Trace: [ 146.016190][ T7399] [ 146.019115][ T7399] dump_stack_lvl+0x18c/0x250 [ 146.023799][ T7399] ? show_regs_print_info+0x20/0x20 [ 146.029006][ T7399] ? load_image+0x420/0x420 [ 146.033515][ T7399] ? __lock_acquire+0x7eb0/0x7eb0 [ 146.038550][ T7399] ? kasan_set_track+0x5f/0x70 [ 146.043352][ T7399] should_fail_ex+0x394/0x4c0 [ 146.048040][ T7399] should_failslab+0x9/0x20 [ 146.052541][ T7399] slab_pre_alloc_hook+0x59/0x300 [ 146.057566][ T7399] ? copy_array+0x64/0xf0 [ 146.061890][ T7399] ? copy_array+0x64/0xf0 [ 146.066212][ T7399] __kmem_cache_alloc_node+0x53/0x260 [ 146.071584][ T7399] ? copy_array+0x64/0xf0 [ 146.075936][ T7399] __kmalloc_node_track_caller+0xa4/0x230 [ 146.081660][ T7399] krealloc+0x86/0x120 [ 146.085736][ T7399] copy_array+0x64/0xf0 [ 146.089892][ T7399] copy_verifier_state+0xb2/0xda0 [ 146.094917][ T7399] do_check+0x3b28/0xd040 [ 146.099252][ T7399] ? __stack_depot_save+0x1f/0x660 [ 146.104381][ T7399] ? kasan_set_track+0x4e/0x70 [ 146.109146][ T7399] ? bpf_prog_load+0x10fa/0x1610 [ 146.114075][ T7399] ? __sys_bpf+0x5ba/0x890 [ 146.118516][ T7399] ? __x64_sys_bpf+0x7c/0x90 [ 146.123127][ T7399] ? init_func_state+0x2d10/0x2d10 [ 146.128240][ T7399] ? __asan_memset+0x22/0x40 [ 146.132833][ T7399] ? init_func_state+0x1dc6/0x2d10 [ 146.137948][ T7399] ? btf_check_subprog_arg_match+0x142/0x2a0 [ 146.143935][ T7399] do_check_common+0xacc/0x1410 [ 146.148793][ T7399] bpf_check+0x6813/0xfe50 [ 146.153257][ T7399] ? deref_stack_reg+0x1ab/0x230 [ 146.158192][ T7399] ? is_bpf_text_address+0x26/0x2a0 [ 146.163394][ T7399] ? bpf_get_btf_vmlinux+0x70/0x70 [ 146.168503][ T7399] ? mark_lock+0x94/0x320 [ 146.172831][ T7399] ? mark_lock+0x94/0x320 [ 146.177158][ T7399] ? __lock_acquire+0x1431/0x7eb0 [ 146.182180][ T7399] ? mark_lock+0x94/0x320 [ 146.186594][ T7399] ? __lock_acquire+0x135d/0x7eb0 [ 146.191619][ T7399] ? mark_lock+0x94/0x320 [ 146.195956][ T7399] ? __lock_acquire+0x1431/0x7eb0 [ 146.201011][ T7399] ? verify_lock_unused+0x140/0x140 [ 146.206211][ T7399] ? verify_lock_unused+0x140/0x140 [ 146.211404][ T7399] ? verify_lock_unused+0x140/0x140 [ 146.216605][ T7399] ? pcpu_memcg_post_alloc_hook+0xef/0x3f0 [ 146.222423][ T7399] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 146.228396][ T7399] ? __lock_acquire+0x7eb0/0x7eb0 [ 146.233419][ T7399] ? lock_chain_count+0x20/0x20 [ 146.238271][ T7399] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 146.244515][ T7399] ? lockdep_hardirqs_on+0x98/0x150 [ 146.249714][ T7399] ? ktime_get_with_offset+0x103/0x330 [ 146.255170][ T7399] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 146.261409][ T7399] ? ktime_get_real_ts64+0x440/0x440 [ 146.266693][ T7399] ? do_raw_spin_unlock+0x121/0x230 [ 146.271894][ T7399] ? __asan_memset+0x22/0x40 [ 146.276484][ T7399] ? bpf_obj_name_cpy+0x194/0x1e0 [ 146.281508][ T7399] bpf_prog_load+0x10fa/0x1610 [ 146.286276][ T7399] ? map_freeze+0x420/0x420 [ 146.290799][ T7399] ? __might_fault+0xaa/0x120 [ 146.295467][ T7399] ? __might_fault+0xc6/0x120 [ 146.300137][ T7399] ? __might_fault+0xaa/0x120 [ 146.304808][ T7399] ? bpf_lsm_bpf+0x9/0x10 [ 146.309135][ T7399] ? security_bpf+0x7e/0xa0 [ 146.313636][ T7399] __sys_bpf+0x5ba/0x890 [ 146.317876][ T7399] ? bpf_link_show_fdinfo+0x560/0x560 [ 146.323339][ T7399] ? lock_chain_count+0x20/0x20 [ 146.328191][ T7399] __x64_sys_bpf+0x7c/0x90 [ 146.332602][ T7399] do_syscall_64+0x55/0xb0 [ 146.337012][ T7399] ? clear_bhb_loop+0x40/0x90 [ 146.341688][ T7399] ? clear_bhb_loop+0x40/0x90 [ 146.346366][ T7399] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 146.352257][ T7399] RIP: 0033:0x7fc6e759f559 [ 146.356670][ T7399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.376368][ T7399] RSP: 002b:00007fc6e83bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 146.384792][ T7399] RAX: ffffffffffffffda RBX: 00007fc6e7825fa0 RCX: 00007fc6e759f559 [ 146.392938][ T7399] RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005 [ 146.400902][ T7399] RBP: 00007fc6e7636b20 R08: 0000000000000000 R09: 0000000000000000 [ 146.408867][ T7399] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 146.416834][ T7399] R13: 00007fc6e7826038 R14: 00007fc6e7825fa0 R15: 00007ffd72173f48 [ 146.424817][ T7399] [ 146.505556][ T7401] f2fs_ckpt-7:0: attempt to access beyond end of device [ 146.505556][ T7401] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 146.564368][ T7401] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 147.472009][ T42] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.525826][ T175] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 147.599161][ T42] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.712248][ T175] usb 1-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 147.746066][ T175] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.765602][ T42] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.774543][ T175] usb 1-1: Product: syz [ 147.780401][ T175] usb 1-1: Manufacturer: syz [ 147.802739][ T175] usb 1-1: SerialNumber: syz [ 147.824537][ T175] usb 1-1: config 0 descriptor?? [ 147.851936][ T175] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 147.928558][ T42] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.751855][ T7429] loop2: detected capacity change from 0 to 512 [ 148.870681][ T7429] EXT4-fs error (device loop2): ext4_validate_block_bitmap:430: comm syz.2.385: bg 0: block 5: invalid block bitmap [ 148.912960][ T7429] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 149.046024][ T7429] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.385: invalid indirect mapped block 3 (level 2) [ 149.136993][ T5789] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 149.150476][ T5789] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 149.160324][ T5789] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 149.169867][ T7429] EXT4-fs (loop2): 1 orphan inode deleted [ 149.175637][ T7429] EXT4-fs (loop2): 1 truncate cleaned up [ 149.185885][ T5789] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 149.196040][ T5789] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 149.205625][ T7429] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 149.218326][ T5789] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 149.336344][ T175] gspca_stk1135: reg_w 0xf err -71 [ 149.342556][ T175] gspca_stk1135: serial bus timeout: status=0x00 [ 149.348966][ T175] gspca_stk1135: Sensor write failed [ 149.354290][ T175] gspca_stk1135: serial bus timeout: status=0x00 [ 149.360845][ T175] gspca_stk1135: Sensor write failed [ 149.367481][ T175] gspca_stk1135: serial bus timeout: status=0x00 [ 149.373840][ T175] gspca_stk1135: Sensor read failed [ 149.379108][ T175] gspca_stk1135: serial bus timeout: status=0x00 [ 149.385462][ T175] gspca_stk1135: Sensor read failed [ 149.387787][ T7435] rxe_eth0 speed is unknown, defaulting to 1000 [ 149.390844][ T175] gspca_stk1135: Detected sensor type unknown (0x0) [ 149.403865][ T175] gspca_stk1135: serial bus timeout: status=0x00 [ 149.410264][ T175] gspca_stk1135: Sensor read failed [ 149.415491][ T175] gspca_stk1135: serial bus timeout: status=0x00 [ 149.432970][ T175] gspca_stk1135: Sensor read failed [ 149.445756][ T175] gspca_stk1135: serial bus timeout: status=0x00 [ 149.476335][ T175] gspca_stk1135: Sensor write failed [ 149.500845][ T175] gspca_stk1135: serial bus timeout: status=0x00 [ 149.522807][ T5786] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 149.525398][ T175] gspca_stk1135: Sensor write failed [ 149.578016][ T5789] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 149.589171][ T175] stk1135: probe of 1-1:0.0 failed with error -71 [ 149.595771][ T5789] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 149.605262][ T5789] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 149.617986][ T175] usb 1-1: USB disconnect, device number 6 [ 149.625522][ T5789] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 149.643119][ T5789] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 149.653279][ T5789] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 149.749415][ T7445] loop2: detected capacity change from 0 to 512 [ 149.870621][ T7445] EXT4-fs error (device loop2): ext4_iget_extra_inode:4752: inode #15: comm syz.2.386: corrupted in-inode xattr: invalid ea_ino [ 149.888672][ T7445] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.386: couldn't read orphan inode 15 (err -117) [ 150.031173][ T7445] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 150.304309][ T5786] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 150.365118][ T7442] rxe_eth0 speed is unknown, defaulting to 1000 [ 150.841305][ T7463] netlink: 'syz.2.389': attribute type 1 has an invalid length. [ 150.924905][ T7468] loop0: detected capacity change from 0 to 512 [ 150.998838][ T7468] EXT4-fs: Ignoring removed orlov option [ 151.004535][ T7468] EXT4-fs: Ignoring removed mblk_io_submit option [ 151.043702][ T7468] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 151.134796][ T175] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 151.174985][ T175] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 151.180353][ T7468] EXT4-fs error (device loop0): ext4_iget_extra_inode:4752: inode #15: comm syz.0.390: corrupted in-inode xattr: e_value size too large [ 151.244478][ T7477] fido_id[7477]: Failed to read report descriptor at '/sys/devices/virtual/misc/uhid/0000:0000:0000.0006/report_descriptor': No such device [ 151.282581][ T7468] EXT4-fs error (device loop0): ext4_orphan_get:1413: comm syz.0.390: couldn't read orphan inode 15 (err -117) [ 151.315828][ T5789] Bluetooth: hci1: command tx timeout [ 151.359308][ T7468] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 151.482452][ T7435] chnl_net:caif_netlink_parms(): no params data found [ 151.547234][ T5785] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 151.718620][ T5789] Bluetooth: hci0: command tx timeout [ 151.916399][ T42] hsr_slave_0: left promiscuous mode [ 151.923023][ T42] hsr_slave_1: left promiscuous mode [ 151.930377][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 151.938102][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 151.955175][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 151.980236][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 151.987899][ T175] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 152.027644][ T42] bridge_slave_1: left allmulticast mode [ 152.042038][ T42] bridge_slave_1: left promiscuous mode [ 152.061326][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 152.079335][ T42] bridge_slave_0: left allmulticast mode [ 152.084992][ T42] bridge_slave_0: left promiscuous mode [ 152.091878][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.117406][ T42] veth1_macvtap: left promiscuous mode [ 152.123030][ T42] veth0_macvtap: left promiscuous mode [ 152.128854][ T42] veth1_vlan: left promiscuous mode [ 152.134158][ T42] veth0_vlan: left promiscuous mode [ 152.206061][ T175] usb 1-1: Using ep0 maxpacket: 32 [ 152.213852][ T175] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 152.223066][ T175] usb 1-1: config 0 has no interface number 0 [ 152.232471][ T175] usb 1-1: config 0 interface 184 has no altsetting 0 [ 152.243109][ T175] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 152.259369][ T175] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.270319][ T175] usb 1-1: Product: syz [ 152.274583][ T175] usb 1-1: Manufacturer: syz [ 152.279802][ T175] usb 1-1: SerialNumber: syz [ 152.288463][ T175] usb 1-1: config 0 descriptor?? [ 152.305347][ T175] smsc75xx v1.0.0 [ 152.825024][ T42] team0 (unregistering): Port device team_slave_1 removed [ 152.872061][ T42] team0 (unregistering): Port device team_slave_0 removed [ 152.918202][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 152.968984][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 153.324458][ T175] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 153.343965][ T42] bond0 (unregistering): Released all slaves [ 153.407427][ T5789] Bluetooth: hci1: command tx timeout [ 153.465243][ T7435] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.488614][ T7435] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.496656][ T7435] bridge_slave_0: entered allmulticast mode [ 153.504318][ T7435] bridge_slave_0: entered promiscuous mode [ 153.514158][ T7435] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.522567][ T7435] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.534888][ T175] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 153.546107][ T7435] bridge_slave_1: entered allmulticast mode [ 153.553437][ T7435] bridge_slave_1: entered promiscuous mode [ 153.559597][ T175] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 153.569817][ T175] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 153.596223][ T175] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 153.609335][ T175] smsc75xx: probe of 1-1:0.184 failed with error -71 [ 153.643336][ T175] usb 1-1: USB disconnect, device number 7 [ 153.666526][ T7435] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 153.676528][ T7442] chnl_net:caif_netlink_parms(): no params data found [ 153.697640][ T7435] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 153.795957][ T5789] Bluetooth: hci0: command tx timeout [ 153.923847][ T7435] team0: Port device team_slave_0 added [ 153.988101][ T7435] team0: Port device team_slave_1 added [ 154.068606][ T7435] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 154.076409][ T7435] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 154.156963][ T7435] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 154.181926][ T7442] bridge0: port 1(bridge_slave_0) entered blocking state [ 154.199627][ T7442] bridge0: port 1(bridge_slave_0) entered disabled state [ 154.216141][ T7442] bridge_slave_0: entered allmulticast mode [ 154.237052][ T7442] bridge_slave_0: entered promiscuous mode [ 154.259228][ T7435] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 154.273045][ T7530] loop0: detected capacity change from 0 to 256 [ 154.275737][ T7435] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 154.308612][ T7530] exFAT-fs (loop0): bogus sectors bits per cluster : 46 [ 154.332794][ T7530] exFAT-fs (loop0): failed to read boot sector [ 154.335733][ T7435] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 154.350190][ T7530] exFAT-fs (loop0): failed to recognize exfat type [ 154.387347][ T7527] tipc: Started in network mode [ 154.392272][ T7527] tipc: Node identity 1001001, cluster identity 4711 [ 154.402339][ T7527] tipc: Node number set to 16781313 [ 154.423858][ T7442] bridge0: port 2(bridge_slave_1) entered blocking state [ 154.437136][ T7442] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.454581][ T7442] bridge_slave_1: entered allmulticast mode [ 154.467826][ T7442] bridge_slave_1: entered promiscuous mode [ 154.584181][ T7442] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 154.623085][ T7535] gre1: entered promiscuous mode [ 154.686765][ T7435] hsr_slave_0: entered promiscuous mode [ 154.721791][ T7435] hsr_slave_1: entered promiscuous mode [ 154.742110][ T7435] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 154.750463][ T7435] Cannot create hsr debugfs directory [ 154.765209][ T7442] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 154.938779][ T7442] team0: Port device team_slave_0 added [ 154.971752][ T7442] team0: Port device team_slave_1 added [ 155.191735][ T42] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.239346][ T7555] loop0: detected capacity change from 0 to 2048 [ 155.305550][ T7555] loop0: p1 p2 < > p3 p4 < p5 > [ 155.323141][ T7555] loop0: partition table partially beyond EOD, truncated [ 155.346218][ T7555] loop0: p2 start 4294902784 is beyond EOD, truncated [ 155.346466][ T7442] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 155.353015][ T7555] loop0: p3 start 3724543488 is beyond EOD, truncated [ 155.377521][ T7442] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.406422][ T7442] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 155.450087][ T42] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.486823][ T5784] Bluetooth: hci1: command tx timeout [ 155.530199][ T7442] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 155.552231][ T7442] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.615747][ T7442] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 155.799339][ T42] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.876260][ T5784] Bluetooth: hci0: command tx timeout [ 155.921191][ T42] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 156.083902][ T7442] hsr_slave_0: entered promiscuous mode [ 156.093854][ T7442] hsr_slave_1: entered promiscuous mode [ 156.111941][ T7442] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 156.123480][ T7578] 9pnet: p9_errstr2errno: server reported unknown error n$[ [ 156.123480][ T7578] Q&|x6mem [ 156.125749][ T7442] Cannot create hsr debugfs directory [ 156.241992][ T7435] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 156.299756][ T7435] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 156.323280][ T7435] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 156.341157][ T7435] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 156.583334][ T7590] FAULT_INJECTION: forcing a failure. [ 156.583334][ T7590] name failslab, interval 1, probability 0, space 0, times 0 [ 156.605037][ T7590] CPU: 1 PID: 7590 Comm: syz.2.414 Not tainted syzkaller #0 [ 156.612387][ T7590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 156.622465][ T7590] Call Trace: [ 156.625772][ T7590] [ 156.628720][ T7590] dump_stack_lvl+0x18c/0x250 [ 156.633436][ T7590] ? show_regs_print_info+0x20/0x20 [ 156.638673][ T7590] ? load_image+0x420/0x420 [ 156.643204][ T7590] ? __might_sleep+0xe0/0xe0 [ 156.647826][ T7590] ? __lock_acquire+0x7eb0/0x7eb0 [ 156.652884][ T7590] should_fail_ex+0x394/0x4c0 [ 156.657595][ T7590] should_failslab+0x9/0x20 [ 156.662111][ T7590] slab_pre_alloc_hook+0x59/0x300 [ 156.667162][ T7590] ? snd_pcm_hw_rule_add+0x18c/0x7f0 [ 156.672479][ T7590] ? snd_pcm_hw_rule_add+0x18c/0x7f0 [ 156.677808][ T7590] __kmem_cache_alloc_node+0x53/0x260 [ 156.683215][ T7590] ? snd_pcm_hw_rule_add+0x18c/0x7f0 [ 156.688534][ T7590] __kmalloc_node_track_caller+0xa4/0x230 [ 156.694292][ T7590] ? lockdep_softirqs_off+0x440/0x440 [ 156.699700][ T7590] krealloc+0x86/0x120 [ 156.703807][ T7590] snd_pcm_hw_rule_add+0x18c/0x7f0 [ 156.708948][ T7590] ? snd_pcm_post_pause+0x290/0x290 [ 156.714159][ T7590] ? __raw_spin_lock_init+0x45/0x100 [ 156.719447][ T7590] ? snd_interval_ranges+0x300/0x300 [ 156.724728][ T7590] ? snd_pcm_attach_substream+0x841/0xad0 [ 156.730450][ T7590] snd_pcm_open_substream+0xb1c/0x2540 [ 156.735919][ T7590] ? snd_pcm_drop+0x250/0x250 [ 156.740599][ T7590] snd_pcm_oss_open+0xf6d/0x1bf0 [ 156.745550][ T7590] ? snd_pcm_oss_mmap+0x680/0x680 [ 156.750575][ T7590] ? soundcore_open+0x274/0x4c0 [ 156.755427][ T7590] ? do_task_dead+0xd0/0xd0 [ 156.759939][ T7590] chrdev_open+0x58c/0x600 [ 156.764393][ T7590] ? cd_forget+0x160/0x160 [ 156.768809][ T7590] ? fsnotify_perm+0x3ed/0x5e0 [ 156.773570][ T7590] do_dentry_open+0x880/0x14b0 [ 156.778337][ T7590] ? cd_forget+0x160/0x160 [ 156.782751][ T7590] path_openat+0x284f/0x3270 [ 156.787350][ T7590] ? do_sys_openat2+0xda/0x1d0 [ 156.792106][ T7590] ? __x64_sys_openat+0x139/0x160 [ 156.797136][ T7590] ? verify_lock_unused+0x140/0x140 [ 156.802346][ T7590] ? do_filp_open+0x430/0x430 [ 156.807035][ T7590] do_filp_open+0x1f2/0x430 [ 156.811540][ T7590] ? vfs_tmpfile+0x620/0x620 [ 156.816147][ T7590] ? _raw_spin_unlock+0x28/0x40 [ 156.820990][ T7590] ? alloc_fd+0x590/0x640 [ 156.825324][ T7590] do_sys_openat2+0x134/0x1d0 [ 156.830000][ T7590] ? do_sys_open+0xe0/0xe0 [ 156.834413][ T7590] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 156.840387][ T7590] ? lock_chain_count+0x20/0x20 [ 156.845235][ T7590] __x64_sys_openat+0x139/0x160 [ 156.850088][ T7590] do_syscall_64+0x55/0xb0 [ 156.854504][ T7590] ? clear_bhb_loop+0x40/0x90 [ 156.859180][ T7590] ? clear_bhb_loop+0x40/0x90 [ 156.863859][ T7590] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 156.869748][ T7590] RIP: 0033:0x7fe05379f559 [ 156.874157][ T7590] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.893792][ T7590] RSP: 002b:00007fe05461d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 156.902205][ T7590] RAX: ffffffffffffffda RBX: 00007fe053a25fa0 RCX: 00007fe05379f559 [ 156.910172][ T7590] RDX: 0000000000101000 RSI: 0000200000000700 RDI: ffffffffffffff9c [ 156.918139][ T7590] RBP: 00007fe053836b20 R08: 0000000000000000 R09: 0000000000000000 [ 156.926109][ T7590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 156.934076][ T7590] R13: 00007fe053a26038 R14: 00007fe053a25fa0 R15: 00007ffe46b39c68 [ 156.942057][ T7590] [ 156.979253][ T7442] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 157.011581][ T7442] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 157.036814][ T7442] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 157.074409][ T7442] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 157.242995][ T7435] 8021q: adding VLAN 0 to HW filter on device bond0 [ 157.348051][ T7435] 8021q: adding VLAN 0 to HW filter on device team0 [ 157.364744][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 157.371926][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 157.474038][ T3516] bridge0: port 2(bridge_slave_1) entered blocking state [ 157.481208][ T3516] bridge0: port 2(bridge_slave_1) entered forwarding state [ 157.556032][ T5784] Bluetooth: hci1: command tx timeout [ 157.732523][ T7616] loop0: detected capacity change from 0 to 512 [ 157.777403][ T7616] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.421: invalid indirect mapped block 4294967295 (level 1) [ 157.818625][ T7616] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.421: invalid indirect mapped block 4294967295 (level 1) [ 157.837720][ T7442] 8021q: adding VLAN 0 to HW filter on device bond0 [ 157.888026][ T7616] EXT4-fs (loop0): 2 truncates cleaned up [ 157.910507][ T7442] 8021q: adding VLAN 0 to HW filter on device team0 [ 157.936483][ T7616] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 157.956159][ T5784] Bluetooth: hci0: command tx timeout [ 158.012080][ T3516] bridge0: port 1(bridge_slave_0) entered blocking state [ 158.019263][ T3516] bridge0: port 1(bridge_slave_0) entered forwarding state [ 158.067664][ T7435] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 158.134389][ T5785] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 158.173186][ T3516] bridge0: port 2(bridge_slave_1) entered blocking state [ 158.180332][ T3516] bridge0: port 2(bridge_slave_1) entered forwarding state [ 158.680983][ T7435] veth0_vlan: entered promiscuous mode [ 158.701153][ T7646] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 158.750032][ T7435] veth1_vlan: entered promiscuous mode [ 158.907151][ T7435] veth0_macvtap: entered promiscuous mode [ 158.931119][ T7435] veth1_macvtap: entered promiscuous mode [ 159.086900][ T42] hsr_slave_0: left promiscuous mode [ 159.092936][ T42] hsr_slave_1: left promiscuous mode [ 159.106260][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 159.113814][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 159.127336][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 159.134768][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 159.159149][ T42] bridge_slave_1: left allmulticast mode [ 159.164914][ T42] bridge_slave_1: left promiscuous mode [ 159.174069][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.199795][ T42] bridge_slave_0: left allmulticast mode [ 159.215820][ T42] bridge_slave_0: left promiscuous mode [ 159.221720][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 159.268867][ T42] veth1_macvtap: left promiscuous mode [ 159.274523][ T42] veth0_macvtap: left promiscuous mode [ 159.282020][ T42] veth1_vlan: left promiscuous mode [ 159.288913][ T42] veth0_vlan: left promiscuous mode [ 160.005402][ T42] team0 (unregistering): Port device team_slave_1 removed [ 160.042657][ T5784] Bluetooth: hci0: command tx timeout [ 160.060366][ T42] team0 (unregistering): Port device team_slave_0 removed [ 160.105506][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 160.154809][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 160.480942][ T42] bond0 (unregistering): Released all slaves [ 160.533389][ T7442] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 160.567635][ T7675] netlink: 24 bytes leftover after parsing attributes in process `syz.0.431'. [ 160.647809][ T7435] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.659486][ T7435] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.677377][ T7435] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 160.749699][ T7435] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 160.765741][ T7435] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.795420][ T7435] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 160.831339][ T7435] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.853310][ T7435] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.872413][ T7435] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.892088][ T7435] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.003254][ T27] audit: type=1326 audit(1793131437.735:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.081537][ T7442] veth0_vlan: entered promiscuous mode [ 161.083809][ T27] audit: type=1326 audit(1793131437.735:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.168036][ T27] audit: type=1326 audit(1793131437.735:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.213861][ T27] audit: type=1326 audit(1793131437.735:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.247808][ T7442] veth1_vlan: entered promiscuous mode [ 161.285491][ T27] audit: type=1326 audit(1793131437.735:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.292880][ T3516] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 161.348235][ T3516] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 161.382593][ T27] audit: type=1326 audit(1793131437.735:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.393270][ T7442] veth0_macvtap: entered promiscuous mode [ 161.438892][ T4456] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 161.442003][ T7442] veth1_macvtap: entered promiscuous mode [ 161.462681][ T4456] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 161.478817][ T27] audit: type=1326 audit(1793131437.735:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.523602][ T27] audit: type=1326 audit(1793131437.735:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.555510][ T27] audit: type=1326 audit(1793131437.735:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.582724][ T27] audit: type=1326 audit(1793131437.735:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7685 comm="syz.2.434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe05379f559 code=0x7fc00000 [ 161.609386][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 161.633235][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.645282][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 161.675789][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.698175][ T7442] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 161.740054][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 161.772009][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.802642][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 161.822012][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.835654][ T7442] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 161.861389][ T7442] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.871786][ T7442] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.881600][ T7442] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.891622][ T7442] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 162.087933][ T3516] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 162.127629][ T3516] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 162.182928][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 162.202713][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 162.351623][ T7705] loop2: detected capacity change from 0 to 32768 [ 162.379879][ T7705] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.437 (7705) [ 162.437910][ T7705] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 162.468590][ T7705] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 162.489438][ T7705] BTRFS info (device loop2): setting nodatasum [ 162.519131][ T7705] BTRFS info (device loop2): force zlib compression, level 3 [ 162.539404][ T7705] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 162.569863][ T7705] BTRFS info (device loop2): use lzo compression, level 0 [ 162.590109][ T7705] BTRFS info (device loop2): turning on flush-on-commit [ 162.613353][ T7705] BTRFS info (device loop2): enabling auto defrag [ 162.631112][ T7722] rxe_eth0 speed is unknown, defaulting to 1000 [ 162.645430][ T7705] BTRFS info (device loop2): max_inline at 4096 [ 162.666706][ T7705] BTRFS info (device loop2): using free space tree [ 162.797811][ T7705] BTRFS info (device loop2): enabling ssd optimizations [ 163.218404][ T5786] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 163.763368][ T7782] loop2: detected capacity change from 0 to 512 [ 164.543424][ T7812] loop6: detected capacity change from 0 to 512 [ 164.718297][ T7812] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 164.789397][ T7812] ext4 filesystem being mounted at /6/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 164.829155][ T7828] syz_tun: entered allmulticast mode [ 164.979433][ T7435] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 167.312549][ T7917] loop6: detected capacity change from 0 to 2048 [ 167.387978][ T7917] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 167.421483][ T7924] sock: sock_set_timeout: `syz.7.487' (pid 7924) tries to set negative timeout [ 167.524001][ T7928] input: syz0 as /devices/virtual/input/input7 [ 167.634643][ T7915] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 167.679716][ T7915] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 64 with error 28 [ 167.693962][ T7915] EXT4-fs (loop6): This should not happen!! Data will be lost [ 167.693962][ T7915] [ 167.736897][ T7915] EXT4-fs (loop6): Total free blocks count 0 [ 167.766529][ T7915] EXT4-fs (loop6): Free/Dirty block details [ 167.772589][ T7915] EXT4-fs (loop6): free_blocks=66060288 [ 167.815793][ T7915] EXT4-fs (loop6): dirty_blocks=64 [ 167.820970][ T7915] EXT4-fs (loop6): Block reservation details [ 167.833670][ T7915] EXT4-fs (loop6): i_reserved_data_blocks=4 [ 167.970857][ T7435] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 168.253633][ T7964] loop7: detected capacity change from 0 to 128 [ 168.459679][ T7970] FAULT_INJECTION: forcing a failure. [ 168.459679][ T7970] name failslab, interval 1, probability 0, space 0, times 0 [ 168.515940][ T7970] CPU: 0 PID: 7970 Comm: syz.0.498 Not tainted syzkaller #0 [ 168.523294][ T7970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 168.533463][ T7970] Call Trace: [ 168.536766][ T7970] [ 168.539718][ T7970] dump_stack_lvl+0x18c/0x250 [ 168.544430][ T7970] ? show_regs_print_info+0x20/0x20 [ 168.549668][ T7970] ? load_image+0x420/0x420 [ 168.554206][ T7970] ? __might_sleep+0xe0/0xe0 [ 168.558826][ T7970] ? __lock_acquire+0x7eb0/0x7eb0 [ 168.563883][ T7970] should_fail_ex+0x394/0x4c0 [ 168.568593][ T7970] should_failslab+0x9/0x20 [ 168.573122][ T7970] slab_pre_alloc_hook+0x59/0x300 [ 168.578175][ T7970] ? crypto_create_tfm_node+0x77/0x380 [ 168.583673][ T7970] ? crypto_create_tfm_node+0x77/0x380 [ 168.589166][ T7970] __kmem_cache_alloc_node+0x53/0x260 [ 168.594553][ T7970] ? __lock_acquire+0x7eb0/0x7eb0 [ 168.599590][ T7970] ? crypto_create_tfm_node+0x77/0x380 [ 168.605084][ T7970] __kmalloc_node+0xa6/0x240 [ 168.609703][ T7970] crypto_create_tfm_node+0x77/0x380 [ 168.615000][ T7970] crypto_spawn_tfm2+0x5c/0x90 [ 168.619775][ T7970] hmac_init_tfm+0x7e/0x1a0 [ 168.624276][ T7970] crypto_shash_init_tfm+0x1be/0x310 [ 168.629567][ T7970] crypto_create_tfm_node+0x155/0x380 [ 168.634938][ T7970] ? crypto_alg_mod_lookup+0x1ad/0x570 [ 168.640399][ T7970] crypto_alloc_tfm_node+0x17b/0x360 [ 168.645702][ T7970] sctp_auth_init_hmacs+0x1c4/0x4a0 [ 168.650915][ T7970] sctp_auth_init+0x288/0x460 [ 168.655600][ T7970] sctp_setsockopt_auth_supported+0x302/0x530 [ 168.661670][ T7970] sctp_setsockopt+0x571/0x11e0 [ 168.666521][ T7970] ? sock_common_recvmsg+0x190/0x190 [ 168.671813][ T7970] do_sock_setsockopt+0x175/0x1a0 [ 168.676834][ T7970] ? __fdget+0x180/0x210 [ 168.681085][ T7970] __x64_sys_setsockopt+0x182/0x200 [ 168.686286][ T7970] do_syscall_64+0x55/0xb0 [ 168.690716][ T7970] ? clear_bhb_loop+0x40/0x90 [ 168.695392][ T7970] ? clear_bhb_loop+0x40/0x90 [ 168.700070][ T7970] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 168.705968][ T7970] RIP: 0033:0x7f5fde79f559 [ 168.710383][ T7970] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.730080][ T7970] RSP: 002b:00007f5fdf5dc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 168.738503][ T7970] RAX: ffffffffffffffda RBX: 00007f5fdea25fa0 RCX: 00007f5fde79f559 [ 168.746473][ T7970] RDX: 0000000000000081 RSI: 0000000000000084 RDI: 0000000000000004 [ 168.754452][ T7970] RBP: 00007f5fde836b20 R08: 0000000000000008 R09: 0000000000000000 [ 168.762428][ T7970] R10: 0000200000000480 R11: 0000000000000246 R12: 0000000000000000 [ 168.770403][ T7970] R13: 00007f5fdea26038 R14: 00007f5fdea25fa0 R15: 00007fff5ea6ea38 [ 168.778396][ T7970] [ 168.973311][ T5784] Bluetooth: hci2: link tx timeout [ 168.979704][ T5784] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 169.381467][ T42] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.548177][ T42] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.714623][ T42] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.878574][ T42] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.542191][ T5797] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 170.553836][ T5797] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 170.565093][ T5797] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 170.577805][ T8024] loop2: detected capacity change from 0 to 128 [ 170.585819][ T5797] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 170.595437][ T5797] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 170.604718][ T5797] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 170.641045][ T8024] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 170.682000][ T8024] ext4 filesystem being mounted at /159/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 170.824257][ T8027] macvlan2: entered promiscuous mode [ 170.849495][ T5786] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 170.860704][ T8027] bond0: entered promiscuous mode [ 170.877025][ T8027] bond_slave_0: entered promiscuous mode [ 170.887453][ T8027] bond_slave_1: entered promiscuous mode [ 170.903737][ T8027] macvlan2: entered allmulticast mode [ 170.909327][ T8027] bond0: entered allmulticast mode [ 170.914594][ T8027] bond_slave_0: entered allmulticast mode [ 170.920654][ T8027] bond_slave_1: entered allmulticast mode [ 170.928538][ T8027] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 170.937724][ T8027] bond0: left allmulticast mode [ 170.943028][ T8027] bond_slave_0: left allmulticast mode [ 170.961277][ T8027] bond_slave_1: left allmulticast mode [ 170.976825][ T8027] bond0: left promiscuous mode [ 170.999865][ T5797] Bluetooth: hci2: command 0x0406 tx timeout [ 171.011367][ T8027] bond_slave_0: left promiscuous mode [ 171.026254][ T8027] bond_slave_1: left promiscuous mode [ 171.035601][ T8038] mmap: syz.2.515 (8038) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 171.261893][ T8021] rxe_eth0 speed is unknown, defaulting to 1000 [ 172.124627][ T8021] chnl_net:caif_netlink_parms(): no params data found [ 172.148005][ T8076] gadgetfs: bound to dummy_udc driver [ 172.435840][ T5890] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 172.443590][ C0] gadgetfs: connected [ 172.455420][ T5890] gadgetfs: disconnected [ 172.656311][ C0] gadgetfs: connected [ 172.665895][ T5890] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 172.676050][ T5789] Bluetooth: hci0: command tx timeout [ 172.684107][ T8021] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.698232][ T5890] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 172.722877][ T8021] bridge0: port 1(bridge_slave_0) entered disabled state [ 172.732415][ T5890] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.744948][ T8021] bridge_slave_0: entered allmulticast mode [ 172.762922][ T8021] bridge_slave_0: entered promiscuous mode [ 172.770895][ C0] gadgetfs: configuration #1 [ 172.802088][ T42] hsr_slave_0: left promiscuous mode [ 172.811482][ T42] hsr_slave_1: left promiscuous mode [ 172.827894][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 172.845547][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 172.871825][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 172.887061][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 172.903054][ T42] bridge_slave_1: left allmulticast mode [ 172.915651][ T8079] loop6: detected capacity change from 0 to 40427 [ 172.923257][ T42] bridge_slave_1: left promiscuous mode [ 172.929105][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 172.940292][ T8079] F2FS-fs (loop6): build fault injection attr: rate: 174, type: 0x7ffff [ 172.959629][ T42] bridge_slave_0: left allmulticast mode [ 172.965330][ T42] bridge_slave_0: left promiscuous mode [ 172.978514][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 172.992272][ T8073] gadgetfs: suspended from state 3 [ 173.008427][ T5861] usb 1-1: USB disconnect, device number 8 [ 173.018623][ T8073] gadgetfs: disconnected [ 173.084079][ T42] veth1_macvtap: left promiscuous mode [ 173.101797][ T42] veth0_macvtap: left promiscuous mode [ 173.121640][ T42] veth1_vlan: left promiscuous mode [ 173.127300][ T42] veth0_vlan: left promiscuous mode [ 174.059971][ T42] team0 (unregistering): Port device team_slave_1 removed [ 174.109955][ T42] team0 (unregistering): Port device team_slave_0 removed [ 174.158303][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 174.214844][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 174.553100][ T42] bond0 (unregistering): Released all slaves [ 174.613627][ T8021] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.621971][ T8021] bridge0: port 2(bridge_slave_1) entered disabled state [ 174.629871][ T8021] bridge_slave_1: entered allmulticast mode [ 174.639040][ T8021] bridge_slave_1: entered promiscuous mode [ 174.651150][ T8100] netlink: 8 bytes leftover after parsing attributes in process `syz.0.533'. [ 174.674837][ T8101] netlink: 8 bytes leftover after parsing attributes in process `syz.0.533'. [ 174.699414][ T8104] netlink: 67 bytes leftover after parsing attributes in process `syz.6.534'. [ 174.756709][ T5789] Bluetooth: hci0: command tx timeout [ 174.763699][ T8021] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 174.801294][ T8021] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.889419][ T8021] team0: Port device team_slave_0 added [ 174.902696][ T8021] team0: Port device team_slave_1 added [ 174.906363][ T8112] ip_tables: iptables: counters copy to user failed while replacing table [ 175.011105][ T8021] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 175.041728][ T8021] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 175.112840][ T8021] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 175.154151][ T8021] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 175.197145][ T8021] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 175.255115][ T8021] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 175.274743][ T8124] netlink: 8 bytes leftover after parsing attributes in process `syz.2.541'. [ 175.461753][ T8021] hsr_slave_0: entered promiscuous mode [ 175.478542][ T8138] gadgetfs: bound to dummy_udc driver [ 175.509423][ T8021] hsr_slave_1: entered promiscuous mode [ 175.518101][ T8021] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 175.528301][ T8021] Cannot create hsr debugfs directory [ 175.638685][ T5785] ================================================================== [ 175.646789][ T5785] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfc/0xc80 [ 175.654188][ T5785] Read of size 8 at addr ffff888028cb5460 by task syz-executor/5785 [ 175.662185][ T5785] [ 175.664518][ T5785] CPU: 0 PID: 5785 Comm: syz-executor Not tainted syzkaller #0 [ 175.672073][ T5785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 175.682137][ T5785] Call Trace: [ 175.685432][ T5785] [ 175.688370][ T5785] dump_stack_lvl+0x18c/0x250 [ 175.693068][ T5785] ? __lock_acquire+0x7eb0/0x7eb0 [ 175.698108][ T5785] ? show_regs_print_info+0x20/0x20 [ 175.703334][ T5785] ? load_image+0x420/0x420 [ 175.707854][ T5785] ? __virt_addr_valid+0x10c/0x380 [ 175.712986][ T5785] ? __virt_addr_valid+0x10c/0x380 [ 175.718202][ T5785] ? __virt_addr_valid+0x10c/0x380 [ 175.723421][ T5785] print_report+0xa8/0x210 [ 175.727854][ T5785] ? __mutex_lock+0xfc/0xc80 [ 175.732459][ T5785] kasan_report+0x117/0x150 [ 175.736976][ T5785] ? tomoyo_check_open_permission+0x384/0x460 [ 175.743065][ T5785] ? __mutex_lock+0xfc/0xc80 [ 175.747684][ T5785] __mutex_lock+0xfc/0xc80 [ 175.752123][ T5785] ? end_current_label_crit_section+0x170/0x170 [ 175.758401][ T5785] ? ep_open+0x4e/0x270 [ 175.762582][ T5785] ? mutex_lock_nested+0x20/0x20 [ 175.767541][ T5785] ? apparmor_file_open+0x5ab/0x760 [ 175.772764][ T5785] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 175.778332][ T5785] ? __rwlock_init+0x150/0x150 [ 175.783118][ T5785] ep_open+0x4e/0x270 [ 175.787128][ T5785] ? do_dentry_open+0x86f/0x14b0 [ 175.792098][ T5785] do_dentry_open+0x880/0x14b0 [ 175.796890][ T5785] ? ep_ioctl+0x1c0/0x1c0 [ 175.801247][ T5785] path_openat+0x284f/0x3270 [ 175.805859][ T5785] ? do_sys_openat2+0xda/0x1d0 [ 175.810633][ T5785] ? __x64_sys_openat+0x139/0x160 [ 175.815653][ T5785] ? verify_lock_unused+0x140/0x140 [ 175.820846][ T5785] ? do_filp_open+0x430/0x430 [ 175.825564][ T5785] do_filp_open+0x1f2/0x430 [ 175.830067][ T5785] ? vfs_tmpfile+0x620/0x620 [ 175.834708][ T5785] ? _raw_spin_unlock+0x28/0x40 [ 175.839556][ T5785] ? alloc_fd+0x590/0x640 [ 175.843879][ T5785] do_sys_openat2+0x134/0x1d0 [ 175.848731][ T5785] ? do_sys_open+0xe0/0xe0 [ 175.853164][ T5785] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 175.859308][ T5785] ? fsnotify_link_count+0xf0/0xf0 [ 175.864411][ T5785] ? lock_chain_count+0x20/0x20 [ 175.869269][ T5785] __x64_sys_openat+0x139/0x160 [ 175.874119][ T5785] do_syscall_64+0x55/0xb0 [ 175.878530][ T5785] ? clear_bhb_loop+0x40/0x90 [ 175.883220][ T5785] ? clear_bhb_loop+0x40/0x90 [ 175.887889][ T5785] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 175.893770][ T5785] RIP: 0033:0x7f5fde75fd8e [ 175.898172][ T5785] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 175.917776][ T5785] RSP: 002b:00007fff5ea6cb08 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 175.926192][ T5785] RAX: ffffffffffffffda RBX: 0000555570aea500 RCX: 00007f5fde75fd8e [ 175.934146][ T5785] RDX: 0000000000000000 RSI: 00007fff5ea6cc70 RDI: ffffffffffffff9c [ 175.942106][ T5785] RBP: 00007fff5ea6cc70 R08: 0000000000000000 R09: 0000000000000000 [ 175.950062][ T5785] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff5ea6dd60 [ 175.958024][ T5785] R13: 00007f5fde835f63 R14: 0000555570aea4e8 R15: 0000000000000006 [ 175.966001][ T5785] [ 175.969008][ T5785] [ 175.971313][ T5785] Allocated by task 8138: [ 175.975629][ T5785] kasan_set_track+0x4e/0x70 [ 175.980209][ T5785] __kasan_kmalloc+0x8f/0xa0 [ 175.984786][ T5785] gadgetfs_bind+0x25f/0x830 [ 175.989378][ T5785] gadget_bind_driver+0x2b3/0x770 [ 175.994411][ T5785] really_probe+0x24a/0xae0 [ 175.998914][ T5785] __driver_probe_device+0x1f5/0x390 [ 176.004194][ T5785] driver_probe_device+0x4f/0x420 [ 176.009211][ T5785] __driver_attach+0x444/0x6d0 [ 176.013976][ T5785] bus_for_each_dev+0x235/0x2b0 [ 176.018822][ T5785] bus_add_driver+0x340/0x630 [ 176.023489][ T5785] driver_register+0x23a/0x310 [ 176.028243][ T5785] usb_gadget_register_driver_owner+0xf9/0x270 [ 176.034396][ T5785] dev_config+0xe49/0x1260 [ 176.038817][ T5785] vfs_write+0x299/0x9a0 [ 176.043072][ T5785] ksys_write+0x151/0x260 [ 176.047404][ T5785] do_syscall_64+0x55/0xb0 [ 176.051807][ T5785] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 176.057695][ T5785] [ 176.060010][ T5785] Freed by task 5890: [ 176.063966][ T5785] kasan_set_track+0x4e/0x70 [ 176.068543][ T5785] kasan_save_free_info+0x28/0x40 [ 176.073556][ T5785] ____kasan_slab_free+0x126/0x1f0 [ 176.078682][ T5785] slab_free_freelist_hook+0x154/0x240 [ 176.084143][ T5785] __kmem_cache_free+0xba/0x1f0 [ 176.088979][ T5785] destroy_ep_files+0x282/0x330 [ 176.093821][ T5785] gadgetfs_unbind+0x109/0x2b0 [ 176.098596][ T5785] gadget_unbind_driver+0x1bf/0x3e0 [ 176.103823][ T5785] device_release_driver_internal+0x408/0x6f0 [ 176.109876][ T5785] driver_detach+0x1f3/0x2d0 [ 176.114527][ T5785] bus_remove_driver+0x221/0x2f0 [ 176.119651][ T5785] usb_gadget_unregister_driver+0x4e/0x70 [ 176.125355][ T5785] dev_release+0x86/0x200 [ 176.129673][ T5785] __fput+0x221/0x940 [ 176.133636][ T5785] delayed_fput+0x58/0x80 [ 176.137952][ T5785] process_scheduled_works+0xa60/0x1600 [ 176.143488][ T5785] worker_thread+0xa5e/0xfe0 [ 176.148068][ T5785] kthread+0x2fa/0x390 [ 176.152128][ T5785] ret_from_fork+0x48/0x80 [ 176.156537][ T5785] ret_from_fork_asm+0x11/0x20 [ 176.161291][ T5785] [ 176.163609][ T5785] Last potentially related work creation: [ 176.169315][ T5785] kasan_save_stack+0x3e/0x60 [ 176.173976][ T5785] __kasan_record_aux_stack+0xaf/0xc0 [ 176.179346][ T5785] kvfree_call_rcu+0xee/0x780 [ 176.184029][ T5785] mld_clear_delrec+0x1ee/0x650 [ 176.188871][ T5785] ipv6_mc_destroy_dev+0x45/0x590 [ 176.193895][ T5785] addrconf_ifdown+0x13b8/0x18a0 [ 176.198813][ T5785] addrconf_notify+0x6c6/0x1010 [ 176.203646][ T5785] notifier_call_chain+0x18f/0x380 [ 176.208749][ T5785] unregister_netdevice_many_notify+0x1037/0x1910 [ 176.215162][ T5785] default_device_exit_batch+0x5e3/0x670 [ 176.220774][ T5785] cleanup_net+0x785/0xb00 [ 176.225170][ T5785] process_scheduled_works+0xa60/0x1600 [ 176.230706][ T5785] worker_thread+0xa5e/0xfe0 [ 176.235284][ T5785] kthread+0x2fa/0x390 [ 176.239338][ T5785] ret_from_fork+0x48/0x80 [ 176.243737][ T5785] ret_from_fork_asm+0x11/0x20 [ 176.248487][ T5785] [ 176.250795][ T5785] Second to last potentially related work creation: [ 176.257353][ T5785] kasan_save_stack+0x3e/0x60 [ 176.262019][ T5785] __kasan_record_aux_stack+0xaf/0xc0 [ 176.267379][ T5785] call_rcu+0x153/0x900 [ 176.271524][ T5785] ip6_route_add+0x10d/0x160 [ 176.276099][ T5785] addrconf_add_dev+0x29c/0x3b0 [ 176.280932][ T5785] inet6_addr_add+0x25d/0xb30 [ 176.285608][ T5785] inet6_rtm_newaddr+0x6fd/0x9d0 [ 176.290548][ T5785] rtnetlink_rcv_msg+0x843/0xf90 [ 176.295470][ T5785] netlink_rcv_skb+0x235/0x4c0 [ 176.300231][ T5785] netlink_unicast+0x7b1/0x930 [ 176.305002][ T5785] netlink_sendmsg+0x8d0/0xbf0 [ 176.309745][ T5785] ____sys_sendmsg+0x61b/0x980 [ 176.314491][ T5785] ___sys_sendmsg+0x2a6/0x360 [ 176.319148][ T5785] __se_sys_sendmsg+0x1d0/0x2c0 [ 176.323977][ T5785] do_syscall_64+0x55/0xb0 [ 176.328377][ T5785] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 176.334256][ T5785] [ 176.336565][ T5785] The buggy address belongs to the object at ffff888028cb5400 [ 176.336565][ T5785] which belongs to the cache kmalloc-512 of size 512 [ 176.350608][ T5785] The buggy address is located 96 bytes inside of [ 176.350608][ T5785] freed 512-byte region [ffff888028cb5400, ffff888028cb5600) [ 176.364304][ T5785] [ 176.366612][ T5785] The buggy address belongs to the physical page: [ 176.373015][ T5785] page:ffffea0000a32d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28cb4 [ 176.383150][ T5785] head:ffffea0000a32d00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 176.392090][ T5785] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 176.400054][ T5785] page_type: 0xffffffff() [ 176.404383][ T5785] raw: 00fff00000000840 ffff888018c41c80 ffffea0001750000 dead000000000002 [ 176.412947][ T5785] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 176.421519][ T5785] page dumped because: kasan: bad access detected [ 176.427934][ T5785] page_owner tracks the page as allocated [ 176.433637][ T5785] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2466, tgid 2466 (kworker/u4:7), ts 17267711970, free_ts 0 [ 176.454111][ T5785] post_alloc_hook+0x1c1/0x200 [ 176.458868][ T5785] get_page_from_freelist+0x2181/0x22a0 [ 176.464402][ T5785] __alloc_pages+0x1f0/0x460 [ 176.468977][ T5785] alloc_slab_page+0x5d/0x180 [ 176.473670][ T5785] new_slab+0x87/0x2d0 [ 176.477739][ T5785] ___slab_alloc+0xc5c/0x12f0 [ 176.482486][ T5785] __kmem_cache_alloc_node+0x122/0x260 [ 176.487928][ T5785] kmalloc_trace+0x2a/0xe0 [ 176.492331][ T5785] alloc_bprm+0x56/0x9a0 [ 176.496580][ T5785] kernel_execve+0x98/0x980 [ 176.501073][ T5785] call_usermodehelper_exec_async+0x20b/0x350 [ 176.507125][ T5785] ret_from_fork+0x48/0x80 [ 176.511526][ T5785] ret_from_fork_asm+0x11/0x20 [ 176.516280][ T5785] page_owner free stack trace missing [ 176.521632][ T5785] [ 176.523939][ T5785] Memory state around the buggy address: [ 176.529549][ T5785] ffff888028cb5300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 176.537608][ T5785] ffff888028cb5380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 176.545659][ T5785] >ffff888028cb5400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 176.553713][ T5785] ^ [ 176.560896][ T5785] ffff888028cb5480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 176.568948][ T5785] ffff888028cb5500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 176.577004][ T5785] ================================================================== [ 176.586737][ T5785] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 176.593956][ T5785] CPU: 1 PID: 5785 Comm: syz-executor Not tainted syzkaller #0 [ 176.601505][ T5785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 176.611564][ T5785] Call Trace: [ 176.614847][ T5785] [ 176.617780][ T5785] dump_stack_lvl+0x18c/0x250 [ 176.622473][ T5785] ? show_regs_print_info+0x20/0x20 [ 176.627766][ T5785] ? load_image+0x420/0x420 [ 176.632258][ T5785] panic+0x2ca/0x720 [ 176.636154][ T5785] ? bpf_jit_dump+0xd0/0xd0 [ 176.640655][ T5785] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 176.646618][ T5785] ? _raw_spin_unlock+0x40/0x40 [ 176.651448][ T5785] ? print_memory_metadata+0x314/0x400 [ 176.656892][ T5785] ? __mutex_lock+0xfc/0xc80 [ 176.661468][ T5785] check_panic_on_warn+0x84/0xa0 [ 176.666391][ T5785] ? __mutex_lock+0xfc/0xc80 [ 176.670972][ T5785] end_report+0x6f/0x130 [ 176.675237][ T5785] kasan_report+0x128/0x150 [ 176.679725][ T5785] ? tomoyo_check_open_permission+0x384/0x460 [ 176.685809][ T5785] ? __mutex_lock+0xfc/0xc80 [ 176.690424][ T5785] __mutex_lock+0xfc/0xc80 [ 176.694854][ T5785] ? end_current_label_crit_section+0x170/0x170 [ 176.701118][ T5785] ? ep_open+0x4e/0x270 [ 176.705287][ T5785] ? mutex_lock_nested+0x20/0x20 [ 176.710215][ T5785] ? apparmor_file_open+0x5ab/0x760 [ 176.715404][ T5785] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 176.720933][ T5785] ? __rwlock_init+0x150/0x150 [ 176.725686][ T5785] ep_open+0x4e/0x270 [ 176.729698][ T5785] ? do_dentry_open+0x86f/0x14b0 [ 176.734624][ T5785] do_dentry_open+0x880/0x14b0 [ 176.739386][ T5785] ? ep_ioctl+0x1c0/0x1c0 [ 176.743722][ T5785] path_openat+0x284f/0x3270 [ 176.748301][ T5785] ? do_sys_openat2+0xda/0x1d0 [ 176.753056][ T5785] ? __x64_sys_openat+0x139/0x160 [ 176.758071][ T5785] ? verify_lock_unused+0x140/0x140 [ 176.763252][ T5785] ? do_filp_open+0x430/0x430 [ 176.767915][ T5785] do_filp_open+0x1f2/0x430 [ 176.772405][ T5785] ? vfs_tmpfile+0x620/0x620 [ 176.776987][ T5785] ? _raw_spin_unlock+0x28/0x40 [ 176.781815][ T5785] ? alloc_fd+0x590/0x640 [ 176.786138][ T5785] do_sys_openat2+0x134/0x1d0 [ 176.790834][ T5785] ? do_sys_open+0xe0/0xe0 [ 176.795254][ T5785] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 176.801219][ T5785] ? fsnotify_link_count+0xf0/0xf0 [ 176.806331][ T5785] ? lock_chain_count+0x20/0x20 [ 176.811164][ T5785] __x64_sys_openat+0x139/0x160 [ 176.816028][ T5785] do_syscall_64+0x55/0xb0 [ 176.820434][ T5785] ? clear_bhb_loop+0x40/0x90 [ 176.825091][ T5785] ? clear_bhb_loop+0x40/0x90 [ 176.829749][ T5785] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 176.835622][ T5785] RIP: 0033:0x7f5fde75fd8e [ 176.835990][ T5789] Bluetooth: hci0: command tx timeout [ 176.845377][ T5785] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 176.864993][ T5785] RSP: 002b:00007fff5ea6cb08 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 176.873431][ T5785] RAX: ffffffffffffffda RBX: 0000555570aea500 RCX: 00007f5fde75fd8e [ 176.881389][ T5785] RDX: 0000000000000000 RSI: 00007fff5ea6cc70 RDI: ffffffffffffff9c [ 176.889354][ T5785] RBP: 00007fff5ea6cc70 R08: 0000000000000000 R09: 0000000000000000 [ 176.897343][ T5785] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff5ea6dd60 [ 176.905297][ T5785] R13: 00007f5fde835f63 R14: 0000555570aea4e8 R15: 0000000000000006 [ 176.913273][ T5785] [ 176.916566][ T5785] Kernel Offset: disabled [ 176.920893][ T5785] Rebooting in 86400 seconds..