last executing test programs: 3.26660886s ago: executing program 3 (id=822): r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x401, 0x1000004, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503, 0x20000}, [@IFLA_LINK_NETNSID={0x8, 0x25, 0x1}, @IFLA_OPERSTATE={0x5, 0x10, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac141400340008"], 0x2c}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mountinfo\x00') socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000140)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, 0x0, 0xfdef) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@bridge_delneigh={0x30, 0x1c, 0x1, 0x4, 0x0, {0x7, 0x0, 0x0, r7, 0x80, 0xf2, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}}, @NDA_FLAGS_EXT={0x8}]}, 0x30}, 0x1, 0x1000000, 0x0, 0x2c048040}, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/query\x00', 0x2, 0x0) 2.296343463s ago: executing program 3 (id=852): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x5}, @HCI_OP_USER_CONFIRM_NEG_REPLY}}, 0x45) 1.937851592s ago: executing program 3 (id=854): r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) sched_setscheduler(r2, 0x5, &(0x7f0000001140)) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/4096, 0x1000, 0x0, &(0x7f0000001180)=""/82, 0x61}, &(0x7f0000001100)=0xfffffe6d) 1.844228771s ago: executing program 3 (id=857): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000080), 0x12) connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) connect$x25(r1, 0x0, 0x0) 1.564009669s ago: executing program 1 (id=866): socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000ee86dd6015690900132f00fc020000000000000000000000000000ff0200000000000000000000000000012420"], 0x0) 1.559273309s ago: executing program 1 (id=867): syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x4000, &(0x7f0000000100)={[{@errors_remount}, {@dioread_lock}, {@i_version}, {@stripe={'stripe', 0x3d, 0xf0}}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x1}}, {@bh}, {@noblock_validity}]}, 0x3, 0x453, &(0x7f0000000600)="$eJzs281vFOUfAPDvzLbw+/HWivgColbR2PjS0oLKwYtGEw+amOgBj7UtBFmooTUR0mg1Bo+GxLvxaOJf4EkvRj2ZeNW7ISHaC+hpzczOlO2yu7R06xb280kGnmfm2T7Pt888O8/MMw2gb41k/yQRuyLit4gYqmdXFxip/3dteXH67+XF6SRqtTf/TPJyV5cXp8ui5ed2FpnRNCL9NCkqWW3+/IXTU9Xq7LkiP75w5r3x+fMXnjl1Zurk7MnZs5PHjh09MvH8c5PPrj2YJGl7aHfW1gMfzh3c/+rbl16fPn7pnZ++yUrvKo43xrERaUN6JAv8r1quudzj3ahsC9ndkE4Gbl6GraESEVl3Debjfygqcb3zhuKVT3raOGBTZdem7e0PL9VaqbTcC9x2kuh1C4DeKC/02f1vuf1HU48t4cqL9Rugq8ni9LXl+lY/MrByLz+4ifeuIxFxfOmfL7MtuvgcAgCgne+y+c/TreZ/adzbUG5PsTY0HBF3RcTeiLg7IvZFxD0Redn7IuL+G2pIO9bfvDR04/wnvXzLwa1BNv97oVjbWj3/W2n3cKXI7c7jH0xOnKrOHi5+J6MxuD3LT3So4/uXf/283bHG+V+2ZfWXc8GiHZcHmh7QzUwtTOWT0i648nHEgYFW8ScrKwFJROyPiAPr+9F7ysSpJ78+2K7QzePvoM0603rUvop4Iuv/WrIUTfGXks7rk+P/i+rs4fHyrLjRz79cfKNd/RuKvwuy/t+x+vxvLjKcNK7Xzq+/jou/f9b2nuZWz/9tyVt5v2wr9n0wtbBwbiJiW/Janl+1f/L6Z8t8WT6Lf/RQ6/G/t/hMVs8DEZGdxA9GxEMR8XDR9kci4tGIONQh/h9feuzdW49/c2Xxz7T8/ls5/5v6f/2Jyukfvm1X/9r6/2ieGi325N9/N7HWBm7kdwcAAAC3izR/Bz5Jx1bSaTo2Vn+Hf1/sSKtz8wtPnZh7/+xM/V354RhMyyddQw3PQyeSpeIn1vOTxbPi8viR4rnxF5X/5/mx6bnqTI9jh363s834z/xR6XXrgE3XhXU04DbVPP47v7IB3Elc/6F/Gf/Qv4x/6F+txv9HTXlrAXBncv2H/mX8Q/8y/qF/Gf/Qlzbyd/0S/ZyIdEs0Y5MSQ1ujGT1M9PqbCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDv+DQAA//82merZ") r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x100, 0x52) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x8004587d, &(0x7f0000000080)={@id={0x2, 0x0, @auto="b2fc991555cf4f1b83cafc8889c21fcf"}}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) chdir(&(0x7f0000000240)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x10) 1.257277369s ago: executing program 4 (id=869): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000001c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x6a) preadv2(r1, &(0x7f00000018c0)=[{&(0x7f0000000580)=""/107, 0x6b}], 0x1, 0x2a5, 0x4, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000000)='7', 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x20c, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f00000000c0)={0xa, 0x4, 0xfa00, {r3}}, 0xc) 1.240312809s ago: executing program 1 (id=870): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev/mapper/control\x00', &(0x7f0000000340)='bfs\x00', 0xc8021, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$restrict_keyring(0x1d, r1, &(0x7f0000000080)='asymmetric\x00', &(0x7f0000000180)='k%y_ing:\x00\x00\x00\x00\x00\x00\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a48000000060a010400000000000000000a0000050900020073797a32000000001c000480180001800d00010073796e70726f787900c72b00040002800900010073797a310000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0xe0}}, 0x0) close(r5) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, 0x0, &(0x7f0000000000), &(0x7f0000000080)) r6 = socket(0x10, 0x803, 0x0) sendto(r6, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r6, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000040)=""/102, 0x38a}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f00000023c0)=""/4098, 0x1e1}, {&(0x7f00000000c0)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x5b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0xa}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000880)=""/207, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000000000)={0x77359400}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000006e0100003801000001000032") 1.168167795s ago: executing program 4 (id=871): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="34000000200081dcfcffffff03000000020000000080000000000000050016000400000008000200ac1414bb080017004e214e22"], 0x34}, 0x1, 0x0, 0x0, 0x81}, 0x44004) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x439, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1313}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x40008c0) socket$inet_tcp(0x2, 0x1, 0x0) 1.129502949s ago: executing program 4 (id=873): r0 = syz_io_uring_setup(0x4f00, &(0x7f0000000140)={0x0, 0x5961, 0x10, 0x0, 0x2b3}, &(0x7f0000000240)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_SENDMSG_ZC={0x30, 0x8, 0x2d, 0xffffffffffffffff, 0x0, &(0x7f0000001cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc7}, 0x835a, 0x4014, 0x0, {0x1}}) memfd_create(&(0x7f0000001cc0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc0sr\x95\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\x00\x01\x00\x00\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xda\xd3\xcd\xfd\xbdnC\xec', 0x3) socket$nl_generic(0x10, 0x3, 0x10) io_uring_enter(r0, 0x2000, 0xfffffffa, 0x9, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mountinfo\x00') read$FUSE(r4, &(0x7f00000061c0)={0x2020}, 0x2020) 1.105710294s ago: executing program 4 (id=875): mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mount$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) sched_setscheduler(r0, 0x5, &(0x7f0000000240)=0x2007) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1, 0x12, r2, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) pread64(r3, &(0x7f0000000180)=""/79, 0xfffffe69, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = socket(0x28, 0x5, 0x0) shutdown(r4, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) read(r7, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="50000000100001042cbd70000000000000002010", @ANYRES32=0x0, @ANYBLOB="99800300040000001c0012800e00010069703665727370616e0000000800028004001200140003006e696376663000"/56], 0x50}, 0x1, 0x0, 0x0, 0x40881}, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getxattr(0x0, &(0x7f0000000280)=@known='system.posix_acl_default\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r9, 0xc004743e, &(0x7f00000000c0)) 831.747291ms ago: executing program 3 (id=878): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x5}, @HCI_OP_USER_CONFIRM_NEG_REPLY}}, 0x45) 721.285582ms ago: executing program 2 (id=880): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x80) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x8}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x24000804) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x20004014) 720.810935ms ago: executing program 3 (id=881): r0 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() r2 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000100)={0x0, 'veth1_to_batadv\x00', {0x4}, 0x26}) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = dup(r5) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x3, @empty, 0x3}], 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in={{0x2, 0x4c23, @remote}}, 0x2, 0x8}, 0x90) sendmsg$inet6(r6, &(0x7f0000000540)={&(0x7f00000000c0)={0xa, 0x4e24, 0x8004, @loopback, 0x7fff}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000100)="f0", 0x1}], 0x1}, 0x400d4) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e22, @empty}}, 0xabb6, 0x9, 0xa4f, 0xc4, 0xa, 0x0, 0xa9}, 0x9c) r7 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$nfc_llcp_NFC_LLCP_RW(r0, 0x118, 0x0, 0x0, 0x0) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, r8, 0x1, 0x70bd2f, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_RX_USECS_IRQ={0x8, 0x4, 0x3}, @ETHTOOL_A_COALESCE_TX_USECS_HIGH={0x8, 0x15, 0xfffffff1}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_TX={0x5, 0x18, 0x1}]}, 0x44}}, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) ptrace$ARCH_MAP_VDSO_32(0x1e, r1, 0xf30f, 0x2002) close(r0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="0000000000190000000000000010000000000000cf5b44276796867d081d991de8ce3be4a89c55040f4e545af17625320900a4fc89a84f79d84b95761b34bfd189e122fdfc7030d1ca52473e5b1853183bde6f5c35ad69e8ca4434b39eeff2d08dfbd874eaa8cd9e912051dd774854e1c7df54e14f8ae6480d5a3d082397a67b5626", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) 677.372778ms ago: executing program 0 (id=882): syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000c40)='./file0\x00', 0x808080, &(0x7f0000000c80)={[{@discard}, {@bh}, {@noblock_validity}]}, 0x0, 0x52c, &(0x7f0000000640)="$eJzs3d9rY1kdAPBvMv2Rdjrbru7DKuqO6+oowyRtZrcs+6DriyDLssK6TyKzpc2U0qQpTbpua8EO+Oar4IBP+if4IPggzJPvvumbLyMojDo4TAWRyE1uOm2adMq0aWaazwcuOefc2/s9J3DP6T1J7glgaF2NiN2IGIuIjyNiOi3PpFu829qS4x4/3Fnce7izmIlG48N/jqRH7iy2j2+7nJ4zF/FBkh/vEre2tb26UC6XNtJ8oV5ZL9S2tm+sVBaWS8ultWJxfm5+9u2bbxXPrK2vVX7z4Dsr7330+9998f4fd7/x46TO32rtGkvadmaBDmi9L6MxdaAseefe60ewAbiUtmds0BXhmWQj4jMR8Xqa3pcbXJ0AgP5qNKajMX0w31vmBMcAAM+/5J5/KjLZfHr/PxXZbD7fnMPLvRKT2XK1Vr9+u7q5thTNOayZGM3eXimXZtO5wpkYzST5uWb6Sb7Ykb8ZES9HxM/HJ5r5/GK1vDSof3oAYMhd7hj/H423xv8T8AkBALzIjOQAMHyOjv+jA6kHAHB+3P8DwPA5MP53+60uAHAB5Tp++w8AXHwH7v9Huh7wavzkh+dXHQDgHPj8HwCGyvfefz/ZGnvp86+XPtnaXK1+cmOpVFvNVzYX84vVjfX8crW63HxmT+Vp5ytXq+tzb8bmp4V6qVYv1La2b1Wqm2v1W83net8q+WEBAAzey6/d+3MmInbfmWhu0V7LwRcC4MJzmcPwujToCgAD0/37PsAwMB8PZJ6yv+dXhO72/puJU9QH6L9rn+sx/9/tf4M7+6n/Nc6vikCfmP+H4XW6+X+zB/AiM/8Pw6vRyFjPHwCGzAnu4H1FEC64Z/78HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIbYVHPLZPPpWuBTkc3m8xFXImJmYjRze6Vcmo2IlyLiT+Oj40l+btCVBgBOKfv3TLr+17XpN6Y6945l/jPefI2IH/3yw198ulCvb8wl5f/aL6/fTcuLXQOM978NAMABI50F7XG6PY631/d9/HBnsb2dZwUffLu1uGgSdy/d2lVvVT4XoxEx+e/MocZkzmhh4t07EfFqZ/uz+/tn0pVPO+Mnsa/0LX40Wzh1KH72UPxsc1/rNXkvPnsGdYFhcy/pf97tdv1l42rzNb3+Moc701z87Gjn+gza/d9eo7P/a13vH1zJNfuabv3f1ZPGePMP3+25786lxudHIvaO9L/tFaFzzdSR+CMRb3Q74U+/+Wizo+gvX/jS673iN34VcS2Oi99KFeqV9UJta/vGSmVhubRcWisW5+fmZ9+++Vax0JyjLrRnqo/6xzvXX+rd/ojJHvFzx7U/Ir7a66Qdfv3fj3/w5WPif/0r3eJn45Vj4idj4tdOGH9h8rc9l+9O4i/1aP/Iofhjh/4uKbt+wvj3/7q9dMJDAYBzUNvaXl0ol0sbEqdN5Pp15svPSQMleiT+9tGha2rg9TmTxMC6JOCcPLnoB10TAAAAAAAAAAAAAACgl9r300f+9fHHcINuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABfX/wMAAP//OkHLZw==") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x8) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') setxattr$system_posix_acl(&(0x7f0000000000)='./file1\x00', &(0x7f0000000380)='system.posix_acl_access\x00', &(0x7f0000000180)={{}, {0x1, 0x6}, [], {0x4, 0x5}, [], {0x10, 0x3}, {0x20, 0x2}}, 0x24, 0x2) 232.045241ms ago: executing program 1 (id=883): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r0, &(0x7f0000000300)="0303ec58000000004500001c0000000040110000ac14140b7f000001", 0x1c, 0x0, &(0x7f0000000400)={0x2, 0x0, @dev}, 0x10) 231.361463ms ago: executing program 0 (id=884): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x8) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x92012, r0, 0x26000) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4048000) msgget$private(0x0, 0x1c0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x220, 0x308, 0x220, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0xffffff00, 0x1, 0x0, {@empty, {[0x0, 0x0, 0xff]}}, {@mac=@local}, 0x0, 0x7, 0x2, 0x0, 0x800, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00', {}, {}, 0x0, 0x180}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @loopback, @broadcast, 0x6, 0xfffffffe}}}, {{@arp={@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101, 0x0, 0x0, 0x0, 0xfd, {}, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00', {}, {}, 0x0, 0xc}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}, @broadcast, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x9}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x20058) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r4, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) ioctl$DVB_DEMUX_DMX_STOP(r0, 0x6f2a) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="5c000000090603000000000000000000050000400900020073797a3100000000050001000700000034000780060004404e21000005000700ff0000000c00018008000140e000400005f80300000000000c00148008000140ffff001195309d620feaf35827212839ee586da6932e98d841bac0fa6e19b3bd0291544881d3f94d21cc869907cc8035776308ba51fc958001a270dfd2438a6aad40b12835c4ca07938c195c30106f6e7a4ecd539f38689fea8ce86c4771f9c7bd326287c0ced5ad71e6a6dd2ec0f46e97a258ab2514ecd36ec13d694fb762a5734c223cd7102495f997543c48ed1ac451929378d573737e7c7e76d4461faab39b1f4d920e1fad3d99ac75db297d6ab52681652a1411e2545f2287a538c8cf986c469bf5177d4247aca5d6f3"], 0x5c}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 224.962399ms ago: executing program 1 (id=885): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x2, 0x0, {}, [@NHA_OIF={0x8, 0x5, r3}]}, 0x20}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000001800dd8d000000000000000002001000fe0400050000002008001e0002"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, 0x0, 0x1, 0x70bd2b, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_RX={0x5, 0x19, 0x1}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x2c, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0x5}, {0xffff, 0xffff}, {0xfff3, 0x10}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x7}]}, 0x2c}}, 0x44080) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff000000000200000000000000040001000800"], 0x50}}, 0x4000850) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x1c, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x1c, {[@window={0xa, 0x3}, @timestamp={0x5, 0xa}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x4e) 203.995492ms ago: executing program 2 (id=886): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg$unix(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x10102) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) 143.441623ms ago: executing program 0 (id=887): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x20, 0x0, [{@multicast2}, {@dev}]}}) r1 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$llc_int(r1, 0x10c, 0x5, &(0x7f00000000c0)=0x10, 0x4) setsockopt$sock_int(r1, 0x1, 0x3e, &(0x7f00000040c0)=0x7, 0x4) sendmmsg$inet(r1, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x3284b164842c97f7, 0x8014) 120.093907ms ago: executing program 0 (id=888): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000280)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000400)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0xf}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x12}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 119.384789ms ago: executing program 2 (id=889): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz1\x00', 0x1ff) write$cgroup_subtree(r1, 0x0, 0x6a) preadv2(r1, &(0x7f00000018c0)=[{&(0x7f0000000140)=""/135, 0x87}], 0x1, 0x9, 0xa7, 0x2) 79.568607ms ago: executing program 4 (id=890): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f0000000000)='7', 0x1) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x140b, 0x100, 0x70bd29, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x4000000) r2 = socket$packet(0x11, 0x3, 0x300) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000001080)={0x1, 0x7, 0x0, 0x0, 0x10000, 0x8}) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x1, 0x6}, 0x4) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x2, 0xffffffff}]}, 0x10) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) 79.363198ms ago: executing program 2 (id=891): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x5}, @HCI_OP_USER_CONFIRM_NEG_REPLY}}, 0x45) 77.627426ms ago: executing program 1 (id=892): connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x12}}, 0x2, 0x0, 0x0, 0x2}}, 0x2e) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0xa00008, &(0x7f0000000000)={[{@grpquota}, {@errors_remount}]}, 0x3, 0x7b5, &(0x7f00000007c0)="$eJzs3c9rG9kdAPDvyJbtOGntQqFNT4ZCawiR69RNWig0pYdSaCDQnpMYWTGpZStYcoiNIQml0EsPLT0sbC45b3azt1z3x3X3sn/DHpaE7K4TNsseFi8jjRLZlhwltuQs/nxgrPdmnvTeV2/mzbNmkAI4tCbSP7mI4xH5NDmWrU8iWxGDEWcb5Z5urBfTJYnNzb99kdTLPNlYL0bLc1JHs8xPI+KDf0WcyO2st7q6tjBbLpeWs/xUbfHqVHV17eSVxdn50nxp6fT0zMypM785c3r/Yv3q47VjD//751++c/abf/7k3n8+TOJsHMu2tcaxXyZiIntP8ulbuMWf9ruyA5Z0VaabUvRTemgONI7yOB5jMbBLH/2hry0DAHrlRkRsAgCHTOL8DwCHTPNzgCcb68XmEo3rOTcP9IOJPnn0x4gYacTfvL7Z2DLYuGb3yUj9Oujok6R+jaQpiYjxfah/IiJu379wN12iR9chAdq5eSsiLo1PbB//0xFu+z0LL+tXXZSZ2JY3/kH/vJfOf367c/4XkcuO/5H63+3zn+E2x+6rePHxn3uwJZvfh0pbpPO/37fc2/a0Jf7M+ECW+0F9zpdPLl8pl9Kx7YcRMRn54TQ/vUsdk4+/fdxpW+v878v//eOttP708XmJ3IPB4a3PmZutze4l5laPbkX8bLBd/Mmz/k86zH/Pd1nHX3737zc7bUvjT+NtLjvj763NOxG/aNv/z++DSna9P3GqvjtMNXeKNt799I3RTvW39v/t+2lN68Xm/wL9kPb/6O7xjyet92tWX76Oj+6Mvd9p29b4L9xN698af/v9fyj5ez09lK27PlurLU9HDCV/3bn+1PPnNvPN8mn8kz9vf/zvtv+nw9ClLL35gtsaBx9+/varx99bafxzaf8nWRAv7P+XT9x7ujDQqf7u+n+mnprM1uwc/wZ3vG63DdzTmwcAAAAAAAAAAAAAAAAAAAAAAAAAXcpFxLFIcoVn6VyuUGj8hvePYzRXrlRrJy5XVpbmov5b2eORzzW/6nKs5ftQp7Pvw2/mT23L/zoifhQR/x8+Us8XipXy3EEHDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZox1+/z/12fBBtw4A6JmRg24AANB3zv8AcPh0OP8PtV99pKdtAQD6o37+TwYPuhkAQB/5/B8ADh/nfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHrs/Llz6bL59cZ6Mc3PXVtdWahcOzlXqi4UFleKhWJl+WphvlKZL5cKxcpixxe62XgoVypXZ2Jp5fpUrVStTVVX1y4uVlaWahevLM7Oly6W8n2LDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC6V11dW5gtl0vLErsnbrwWzbiVddueXzAfr0M4EntLDEdEr6poHSWOHMzgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA98F0AAAD///BHHvM=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x1, &(0x7f0000000400)=ANY=[], 0xfd, 0x347, &(0x7f0000000080)="$eJzs3U2IG2UYwPEn2Y/OrO4miAoK6qO9qEjo5ihCu5SuiIGKNlItCFN3oiFjsmRCNEU2KRR68eDFr7MKIoUF8SAIpR48yS6ld0/2tgfXk6LFVyaZcWabmaxGuz30/zvMPrzv88wzmTcMu2/Y3Z1n3n/rD2NMzelIXnKSPyaD3I2cFCUvkYE88fbm1YdeeuXV51cqlRMvqq6unFouq+rSI5fPvHvpsSudu17+eunbQ7JVfG1nt3x96/6tB3b+PPVm3de6r81WRx21wpPp2od+o6T6guc6vqv1pu+2g/mzrVbHOeu5WvNa6+s9dZprdy+st13fV6fZ04bb005LO+2eOm849aaWSiVdXBCkOj88WiKXup+sZKdVv/zNGNnt/GDMoYEYY8Iq3Ck0/Dpaf1tE3stOPr54UJeFA5J4qFsi3sVutVsV8ZaCY2ClJnXxxJUjUpAbEjwjzKebZvioCI7vlDcr1578/jtVLcqG1w/r+93qTFxvnnZleT7RNa5ffa5yYllH9tbPyUKyf1kKcu+oZiSuL6fWz8vjhxP1JSnItdelJZ5sX3701+snL34U1W8sqx4/WRnW5yWqt2UtulxLvvgl/fYVb+3qAAAAAAAAAAAwnZKqqi2atX9fChIuBNFiUTaiz4SD+VEU7q/nkp8PRPvzM2H2kdT9+Vk5dlteMQAAAAAAdx6/dyGMeucajue5bd+OgmAk+hk+HkkEdjwym5WTCO5b2ptjjOnHOdEVZZZPDOypqsLAmrLpuYZjT7o/w+Cz8/udx5Zo5OHVyU0PH53ZDhsO4qm5m1fwXweWuO25m6ceNMbsHZkXkWla/H46OVKY6lLFGq/KjyfP/v3O3veEw1RLJuVYEu9iZeXMRYEtKefJ5UbVaS1+nnq9kkHYIFjBjPfhs2d+/Grf88yP3Z9xo229K//XswcAAADAwYq/6T8q/do33f7ppz74h6WmMPzdcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8F9N8SfHtj9Om9IguOfzaORqYiq1cW43+jcBWX66da8aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAg9lcAAAD//wcPnf8=") r1 = socket$inet_sctp(0x2, 0x1, 0x84) close(0x3) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r2, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30, 0x180}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, &(0x7f0000000080)={r5, 0x3ff}, 0x8) pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61) renameat2(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="2700000007ea614f6ea0bb089eb0fdecb3b8f3e4"], 0x50) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r7, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x44, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@msdu=@type10={{}, {}, @from_mac=@broadcast, @device_b, @device_a, {0x0, 0x45}}}}]}, 0x44}}, 0x800) bind$bt_hci(r6, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) 72.777081ms ago: executing program 0 (id=893): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/ipc\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket$l2tp6(0xa, 0x2, 0x73) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @private0}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$ptp0(0xffffffffffffff9c, &(0x7f0000002040), 0x82401, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x1, 0x6, 0x6, 0x0, 0x7, 0x8, 0x652, 0x7, 0x8000009657, 0x1, 0x6, 0x0, 0x10, 0x800000000b, 0x80000000000000, 0xcc0, 0x1, 0x1, 0x94d6, 0x10000000000001, 0x0, 0x809, 0x0, 0xfffffffffffffffa, 0x80003, 0xf64d}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/vlan/vlan1\x00') readlinkat(r2, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x37}}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000002900)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="600000000206050000000000000000000100000405000400000000000900020073797a310000000014000780050015000200000008001240000000000500050002000000050001000600000011000300686173683a6e65742c6e6574"], 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a140000001100010040000000000000000000000a"], 0x28}}, 0x0) sendmmsg$inet(r0, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) 29.017384ms ago: executing program 2 (id=894): syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000c40)='./file0\x00', 0x808080, &(0x7f0000000c80)={[{@discard}, {@bh}, {@noblock_validity}]}, 0x0, 0x52c, &(0x7f0000000640)="$eJzs3d9rY1kdAPBvMv2Rdjrbru7DKuqO6+oowyRtZrcs+6DriyDLssK6TyKzpc2U0qQpTbpua8EO+Oar4IBP+if4IPggzJPvvumbLyMojDo4TAWRyE1uOm2adMq0aWaazwcuOefc2/s9J3DP6T1J7glgaF2NiN2IGIuIjyNiOi3PpFu829qS4x4/3Fnce7izmIlG48N/jqRH7iy2j2+7nJ4zF/FBkh/vEre2tb26UC6XNtJ8oV5ZL9S2tm+sVBaWS8ultWJxfm5+9u2bbxXPrK2vVX7z4Dsr7330+9998f4fd7/x46TO32rtGkvadmaBDmi9L6MxdaAseefe60ewAbiUtmds0BXhmWQj4jMR8Xqa3pcbXJ0AgP5qNKajMX0w31vmBMcAAM+/5J5/KjLZfHr/PxXZbD7fnMPLvRKT2XK1Vr9+u7q5thTNOayZGM3eXimXZtO5wpkYzST5uWb6Sb7Ykb8ZES9HxM/HJ5r5/GK1vDSof3oAYMhd7hj/H423xv8T8AkBALzIjOQAMHyOjv+jA6kHAHB+3P8DwPA5MP53+60uAHAB5Tp++w8AXHwH7v9Huh7wavzkh+dXHQDgHPj8HwCGyvfefz/ZGnvp86+XPtnaXK1+cmOpVFvNVzYX84vVjfX8crW63HxmT+Vp5ytXq+tzb8bmp4V6qVYv1La2b1Wqm2v1W83net8q+WEBAAzey6/d+3MmInbfmWhu0V7LwRcC4MJzmcPwujToCgAD0/37PsAwMB8PZJ6yv+dXhO72/puJU9QH6L9rn+sx/9/tf4M7+6n/Nc6vikCfmP+H4XW6+X+zB/AiM/8Pw6vRyFjPHwCGzAnu4H1FEC64Z/78HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIbYVHPLZPPpWuBTkc3m8xFXImJmYjRze6Vcmo2IlyLiT+Oj40l+btCVBgBOKfv3TLr+17XpN6Y6945l/jPefI2IH/3yw198ulCvb8wl5f/aL6/fTcuLXQOM978NAMABI50F7XG6PY631/d9/HBnsb2dZwUffLu1uGgSdy/d2lVvVT4XoxEx+e/MocZkzmhh4t07EfFqZ/uz+/tn0pVPO+Mnsa/0LX40Wzh1KH72UPxsc1/rNXkvPnsGdYFhcy/pf97tdv1l42rzNb3+Moc701z87Gjn+gza/d9eo7P/a13vH1zJNfuabv3f1ZPGePMP3+25786lxudHIvaO9L/tFaFzzdSR+CMRb3Q74U+/+Wizo+gvX/jS673iN34VcS2Oi99KFeqV9UJta/vGSmVhubRcWisW5+fmZ9+++Vax0JyjLrRnqo/6xzvXX+rd/ojJHvFzx7U/Ir7a66Qdfv3fj3/w5WPif/0r3eJn45Vj4idj4tdOGH9h8rc9l+9O4i/1aP/Iofhjh/4uKbt+wvj3/7q9dMJDAYBzUNvaXl0ol0sbEqdN5Pp15svPSQMleiT+9tGha2rg9TmTxMC6JOCcPLnoB10TAAAAAAAAAAAAAACgl9r300f+9fHHcINuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABfX/wMAAP//OkHLZw==") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x8) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') setxattr$system_posix_acl(&(0x7f0000000000)='./file1\x00', &(0x7f0000000380)='system.posix_acl_access\x00', &(0x7f0000000180)={{}, {0x1, 0x6}, [], {0x4, 0x5}, [], {0x10, 0x3}, {0x20, 0x2}}, 0x24, 0x2) 28.714001ms ago: executing program 4 (id=895): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000600)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000a0000000500000003000006040000000100000000000000070000000500000006000000ffff0000005f7f2e515f"], &(0x7f0000000540)=""/191, 0x46, 0xbf, 0x1}, 0x28) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000000200)=ANY=[], 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) sendto$inet6(r1, &(0x7f0000000080)='\x00', 0x1, 0x8081, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x4}, 0x1c) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000200)=0x2, 0x4) recvmmsg(r1, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/181, 0xb5}, 0x8001}], 0x4000000000001c7, 0x10140, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_read_part_table(0x104a, &(0x7f0000001080)="$eJzsz7GpAlEQBdA7j893IyMLMDUx0QLWIuxnK7AQi7MDecLKJhoLCuckw8xlGCZ8i3FdSQ5Jen8L2/HSXme7JMPS/D/Lvc37fUxWyfS3xJXN/lRJbW/JUPOBKefr594BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgN/xCAAA///6yQxg") read$FUSE(0xffffffffffffffff, &(0x7f0000000440)={0x2020}, 0x2020) sendto$inet(r2, &(0x7f0000000300)="0303ec58000000004500001c00000000402f0000ac14140b7f000001", 0x1c, 0x0, &(0x7f0000000400)={0x2, 0x0, @dev}, 0x10) 296.08µs ago: executing program 2 (id=896): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r0, &(0x7f0000000300)="0303ec58000000004500001c0000000040110000ac14140b7f0000014e21", 0x1e, 0x0, &(0x7f0000000400)={0x2, 0x0, @dev}, 0x10) 0s ago: executing program 0 (id=897): r0 = socket(0x10, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x5, 0x4, 0x8, 0xc}, 0x50) syz_emit_ethernet(0x3a, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0xe000, 0x0, 0x5, 0x0, @dev={0xac, 0x14, 0x14, 0xff}, @private=0xa010100, {[@generic={0x89, 0x2}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000180)={r1, &(0x7f0000000040)='%%.\x00', 0x400, &(0x7f0000000080)={@align=0x40, {0x9, 0x4, 0xf, 0xad88}}, 0x4, &(0x7f00000000c0), &(0x7f0000000140)=0xf98}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000800)={r2, 0xe0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000480)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, &(0x7f00000004c0)=[0x0, 0x0, 0x0], &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x9b, &(0x7f0000000540)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000580), &(0x7f0000000680), 0x8, 0xf, 0x8, 0x8, &(0x7f00000006c0)}}, 0x10) r4 = open_tree(r2, &(0x7f0000000840)='./file0\x00', 0x88101) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000900)={0x2, r1, 0x2}) r6 = syz_io_uring_complete(0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000009c0)={{r1}, &(0x7f0000000940), &(0x7f0000000980)='%-010d \x00'}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000a80)=@bpf_ext={0x1c, 0x6, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}]}, &(0x7f0000000400)='syzkaller\x00', 0x3ff, 0x33, &(0x7f0000000440)=""/51, 0x41000, 0x21, '\x00', r3, 0x0, r4, 0x8, &(0x7f0000000880)={0x1, 0x4}, 0x8, 0x10, &(0x7f00000008c0)={0x5, 0x2}, 0x10, 0x13f42, r2, 0x1, &(0x7f0000000a00)=[r2, r1, r5, r1, r2, r2, r2, r6, r1, r4], &(0x7f0000000a40)=[{0x5, 0x1, 0x8, 0x2}], 0x10, 0x800}, 0x94) write(r0, &(0x7f0000000000)="240000001e005f80004000000000000001000000000000000000080008000100000000ff", 0x24) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="4000000009060e0600000000000000000200000205000100070000000900020073797a3000000000180007800c00018008000140000000000800ef4000000000"], 0x40}}, 0x0) kernel console output (not intermixed with test programs): vice netdevsim2 [ 30.830417][ T4719] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 30.832461][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.839540][ T4709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.852426][ T4709] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.856440][ T262] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.857931][ T262] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.866539][ T4710] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.868882][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.870838][ T4710] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.873034][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.874736][ T4710] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.877192][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.878853][ T4710] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.881543][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.887512][ T262] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.887561][ T262] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.902343][ T262] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.902381][ T262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.912336][ T4714] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.915125][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.922877][ T4714] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.925301][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.925607][ T4714] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.927309][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.928288][ T4714] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.931372][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.964364][ T4715] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.967084][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.977308][ T4715] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.979767][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.983372][ T4715] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.985528][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.991531][ T4710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.993816][ T4715] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.996015][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.004425][ T4710] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.019085][ T4719] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.022513][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.022557][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.028646][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.028697][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.038006][ T4719] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.049037][ T4714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.066088][ T4719] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.066119][ T4719] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.074340][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.074384][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.074725][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.074745][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.082661][ T4714] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.095083][ T4715] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.099018][ T262] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.099070][ T262] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.118717][ T4715] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.123958][ T262] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.123999][ T262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.139066][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.139107][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.144651][ T4710] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.161472][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.161514][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.168480][ T4709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.192613][ T4715] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.206376][ T4709] veth0_vlan: entered promiscuous mode [ 31.209686][ T4709] veth1_vlan: entered promiscuous mode [ 31.221062][ T4709] veth0_macvtap: entered promiscuous mode [ 31.224383][ T4709] veth1_macvtap: entered promiscuous mode [ 31.228900][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.232094][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.233825][ T262] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.234017][ T262] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.234285][ T262] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.265759][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.265792][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.309856][ T262] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.309891][ T262] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.310982][ T1057] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.350736][ T4719] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.368000][ T4709] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.439303][ T4710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.456332][ T4891] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 31.458195][ T4715] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.475795][ T4714] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.486322][ T4893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.487016][ T4893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.507623][ T4710] veth0_vlan: entered promiscuous mode [ 31.515336][ T4719] veth0_vlan: entered promiscuous mode [ 31.518801][ T4715] veth0_vlan: entered promiscuous mode [ 31.524415][ T4719] veth1_vlan: entered promiscuous mode [ 31.526831][ T4710] veth1_vlan: entered promiscuous mode [ 31.537694][ T4715] veth1_vlan: entered promiscuous mode [ 31.542427][ T4710] veth0_macvtap: entered promiscuous mode [ 31.543956][ T4714] veth0_vlan: entered promiscuous mode [ 31.547290][ T4714] veth1_vlan: entered promiscuous mode [ 31.553457][ T4710] veth1_macvtap: entered promiscuous mode [ 31.558857][ T4714] veth0_macvtap: entered promiscuous mode [ 31.563559][ T4714] veth1_macvtap: entered promiscuous mode [ 31.568521][ T4715] veth0_macvtap: entered promiscuous mode [ 31.569553][ T4715] veth1_macvtap: entered promiscuous mode [ 31.573314][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.583760][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.585352][ T4719] veth0_macvtap: entered promiscuous mode [ 31.586826][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.592383][ T4719] veth1_macvtap: entered promiscuous mode [ 31.594624][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.599626][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.607389][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.616229][ T4719] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.631923][ T4719] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.659002][ T1057] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.662512][ T262] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662559][ T262] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662590][ T262] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662612][ T262] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662633][ T262] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662653][ T262] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662672][ T262] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662691][ T262] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662710][ T262] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662728][ T262] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662747][ T262] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662765][ T262] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662783][ T262] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662801][ T262] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662819][ T262] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.662837][ T262] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.664251][ T1057] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.687477][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.687489][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.699484][ T262] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.699517][ T262] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.716988][ T1057] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.717010][ T1057] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.727575][ T1057] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.727601][ T1057] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.739667][ T1057] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.739691][ T1057] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.739789][ T1057] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.739801][ T1057] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.764687][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.764716][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.803848][ T4899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.804051][ T4899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.010866][ T50] Bluetooth: hci3: command tx timeout [ 32.010964][ T50] Bluetooth: hci1: command tx timeout [ 32.011037][ T50] Bluetooth: hci2: command tx timeout [ 32.011100][ T50] Bluetooth: hci4: command tx timeout [ 32.011161][ T50] Bluetooth: hci0: command tx timeout [ 32.024136][ T4907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.024325][ T4907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.041354][ T4810] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.431262][ T4810] usb 1-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 32.432538][ T4810] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.640984][ T4810] dln2 1-1:1.0: USB write failed: -110 [ 32.641091][ T4810] dln2 1-1:1.0: failed to initialize hardware [ 32.645593][ T4810] dln2 1-1:1.0: probe with driver dln2 failed with error -110 [ 32.859751][ T26] usb 1-1: USB disconnect, device number 2 [ 32.931008][ T4916] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 32.959870][ T4916] ======================================================= [ 32.959870][ T4916] WARNING: The mand mount option has been deprecated and [ 32.959870][ T4916] and is ignored by this kernel. Remove the mand [ 32.959870][ T4916] option from the mount to silence this warning. [ 32.959870][ T4916] ======================================================= [ 33.159359][ T4922] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 12 out of range (51000000..2150000000) [ 33.365546][ T4950] loop4: detected capacity change from 0 to 512 [ 33.387479][ T4817] IPVS: starting estimator thread 0... [ 33.403795][ T4950] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.412450][ T4960] Bluetooth: ISO socket layer initialized [ 33.470462][ T4955] IPVS: using max 60 ests per chain, 144000 per kthread [ 33.526916][ T4970] netlink: 12 bytes leftover after parsing attributes in process `syz.0.34'. [ 33.572242][ T4970] Zero length message leads to an empty skb [ 33.705793][ T4989] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.874792][ T5002] FAULT_INJECTION: forcing a failure. [ 33.874792][ T5002] name failslab, interval 1, probability 0, space 0, times 1 [ 33.877148][ T5002] CPU: 0 UID: 0 PID: 5002 Comm: syz.1.42 Tainted: G L syzkaller #0 PREEMPT [ 33.877165][ T5002] Tainted: [L]=SOFTLOCKUP [ 33.877169][ T5002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 33.877176][ T5002] Call trace: [ 33.877180][ T5002] show_stack+0x2c/0x3c (C) [ 33.877203][ T5002] __dump_stack+0x30/0x40 [ 33.877216][ T5002] dump_stack_lvl+0xd8/0x12c [ 33.877227][ T5002] dump_stack+0x1c/0x28 [ 33.877239][ T5002] should_fail_ex+0x41c/0x590 [ 33.877248][ T5002] should_failslab+0xc4/0x120 [ 33.877257][ T5002] kmem_cache_alloc_noprof+0x94/0x5d8 [ 33.877267][ T5002] taskstats_exit+0x30c/0x89c [ 33.877277][ T5002] do_exit+0x50c/0x1a74 [ 33.877288][ T5002] do_group_exit+0x198/0x238 [ 33.877295][ T5002] get_signal+0xfb0/0x1094 [ 33.877303][ T5002] arch_do_signal_or_restart+0x288/0x444c [ 33.877313][ T5002] exit_to_user_mode_loop+0x70/0x17c [ 33.877322][ T5002] el0_svc+0x18c/0x260 [ 33.877332][ T5002] el0t_64_sync_handler+0x44/0x104 [ 33.877340][ T5002] el0t_64_sync+0x198/0x19c [ 33.932038][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.937707][ T5021] Unsupported ieee802154 address type: 0 [ 34.037865][ T5019] FAULT_INJECTION: forcing a failure. [ 34.037865][ T5019] name failslab, interval 1, probability 0, space 0, times 0 [ 34.037910][ T5019] CPU: 0 UID: 0 PID: 5019 Comm: syz.1.45 Tainted: G L syzkaller #0 PREEMPT [ 34.037929][ T5019] Tainted: [L]=SOFTLOCKUP [ 34.037934][ T5019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 34.037941][ T5019] Call trace: [ 34.037945][ T5019] show_stack+0x2c/0x3c (C) [ 34.037967][ T5019] __dump_stack+0x30/0x40 [ 34.037981][ T5019] dump_stack_lvl+0xd8/0x12c [ 34.037993][ T5019] dump_stack+0x1c/0x28 [ 34.038004][ T5019] should_fail_ex+0x41c/0x590 [ 34.038014][ T5019] should_failslab+0xc4/0x120 [ 34.038023][ T5019] kmem_cache_alloc_noprof+0x94/0x5d8 [ 34.038033][ T5019] __kernfs_new_node+0xf0/0x7d8 [ 34.038044][ T5019] kernfs_new_node+0xe8/0x130 [ 34.038053][ T5019] __kernfs_create_file+0x60/0x2e0 [ 34.038063][ T5019] sysfs_add_file_mode_ns+0x1e8/0x2a4 [ 34.038074][ T5019] sysfs_merge_group+0x164/0x2ac [ 34.038086][ T5019] dpm_sysfs_add+0xc8/0x258 [ 34.038097][ T5019] device_add+0x468/0x9e0 [ 34.038106][ T5019] device_register+0x28/0x38 [ 34.038118][ T5019] tty_register_device_attr+0x31c/0x5e8 [ 34.038129][ T5019] tty_register_device+0x3c/0x50 [ 34.038139][ T5019] gsm_activate_mux+0xdc/0x284 [ 34.038151][ T5019] gsmld_ioctl+0xea8/0x1414 [ 34.038161][ T5019] tty_ioctl+0x8a8/0xcb0 [ 34.038170][ T5019] __arm64_sys_ioctl+0x154/0x1cc [ 34.038183][ T5019] invoke_syscall+0x98/0x244 [ 34.038195][ T5019] el0_svc_common+0xec/0x23c [ 34.038207][ T5019] do_el0_svc+0x4c/0x5c [ 34.038219][ T5019] el0_svc+0x64/0x260 [ 34.038230][ T5019] el0t_64_sync_handler+0x44/0x104 [ 34.038240][ T5019] el0t_64_sync+0x198/0x19c [ 34.090706][ T4712] Bluetooth: hci4: command tx timeout [ 34.090745][ T4712] Bluetooth: hci2: command tx timeout [ 34.090759][ T4712] Bluetooth: hci1: command tx timeout [ 34.090785][ T4712] Bluetooth: hci3: command tx timeout [ 34.152198][ T5040] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 34.152242][ T5040] overlayfs: failed to set xattr on upper [ 34.152250][ T5040] overlayfs: ...falling back to redirect_dir=nofollow. [ 34.152259][ T5040] overlayfs: ...falling back to uuid=null. [ 34.275833][ T5050] netlink: 4 bytes leftover after parsing attributes in process `syz.1.53'. [ 34.277724][ T5050] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 34.288057][ T5050] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 34.347555][ T5060] Bluetooth: hci5: Frame reassembly failed (-84) [ 35.390485][ T5109] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 35.394085][ T4989] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.425720][ T4989] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.487065][ T4989] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.690667][ T4712] Bluetooth: hci0: command 0x040f tx timeout [ 35.691131][ T4984] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 35.692434][ T4984] Bluetooth: hci0: Opcode 0x0406 failed: -110 [ 36.170401][ T4712] Bluetooth: hci3: command tx timeout [ 36.171188][ T4720] Bluetooth: hci2: command tx timeout [ 36.171237][ T4723] Bluetooth: hci1: command tx timeout [ 36.619959][ T4984] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 36.624295][ T4984] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 36.624353][ T4984] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 36.627176][ T4984] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 36.629438][ T4984] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 36.629495][ T4984] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 36.635199][ T4984] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 36.635628][ T5134] overlayfs: failed to clone lowerpath [ 37.770551][ T4712] Bluetooth: hci0: command 0x040f tx timeout [ 38.650886][ T4712] Bluetooth: hci3: command 0x0419 tx timeout [ 38.650930][ T4712] Bluetooth: hci2: command 0x0c1a tx timeout [ 38.650976][ T4712] Bluetooth: hci1: command 0x0c1a tx timeout [ 39.632579][ T5139] loop1: detected capacity change from 0 to 512 [ 39.644243][ T5139] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.646248][ T5139] i2c i2c-0: dtv_property_process_set: SET cmd 0x49349a66 undefined [ 39.654870][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.850535][ T4723] Bluetooth: hci0: command 0x040f tx timeout [ 40.732005][ T4984] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 40.732086][ T4984] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 40.736138][ T4984] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 40.736184][ T4984] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 40.738720][ T4984] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 40.740431][ T4723] Bluetooth: hci1: command 0x0c1a tx timeout [ 40.740469][ T4723] Bluetooth: hci2: command 0x0c1a tx timeout [ 40.740493][ T4723] Bluetooth: hci3: command 0x0419 tx timeout [ 40.794053][ T5164] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 40.797573][ T5165] FAULT_INJECTION: forcing a failure. [ 40.797573][ T5165] name failslab, interval 1, probability 0, space 0, times 0 [ 40.800998][ T5165] CPU: 0 UID: 0 PID: 5165 Comm: syz.3.78 Tainted: G L syzkaller #0 PREEMPT [ 40.801016][ T5165] Tainted: [L]=SOFTLOCKUP [ 40.801020][ T5165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 40.801026][ T5165] Call trace: [ 40.801030][ T5165] show_stack+0x2c/0x3c (C) [ 40.801053][ T5165] __dump_stack+0x30/0x40 [ 40.801067][ T5165] dump_stack_lvl+0xd8/0x12c [ 40.801078][ T5165] dump_stack+0x1c/0x28 [ 40.801090][ T5165] should_fail_ex+0x41c/0x590 [ 40.801099][ T5165] should_failslab+0xc4/0x120 [ 40.801109][ T5165] __kmalloc_cache_noprof+0x94/0x5ec [ 40.801119][ T5165] psi_cgroup_alloc+0x60/0x1d8 [ 40.801129][ T5165] cgroup_mkdir+0x414/0xbac [ 40.801140][ T5165] kernfs_iop_mkdir+0xe0/0x128 [ 40.801151][ T5165] vfs_mkdir+0x2dc/0x464 [ 40.801162][ T5165] filename_mkdirat+0x228/0x3f4 [ 40.801172][ T5165] __arm64_sys_mkdirat+0x9c/0xc0 [ 40.801182][ T5165] invoke_syscall+0x98/0x244 [ 40.801195][ T5165] el0_svc_common+0xec/0x23c [ 40.801207][ T5165] do_el0_svc+0x4c/0x5c [ 40.801218][ T5165] el0_svc+0x64/0x260 [ 40.801229][ T5165] el0t_64_sync_handler+0x44/0x104 [ 40.801239][ T5165] el0t_64_sync+0x198/0x19c [ 40.843425][ T5167] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.81'. [ 40.897619][ T5175] binder: 5174:5175 tried to acquire reference to desc 0, got 1 instead [ 40.897969][ T5175] binder: 5174:5175 got transaction with out-of-order buffer fixup [ 40.897991][ T5175] binder: 5175:5174 failed to fixup parent [ 40.898040][ T5175] binder: 5174:5175 transaction call to 5174:0 failed 5/29201/-22, code 0 size 104-24 line 3717 [ 40.898552][ T4803] binder: undelivered TRANSACTION_ERROR: 29201 [ 40.949169][ T4472] IPVS: starting estimator thread 0... [ 40.974758][ T5184] syzkaller0: entered promiscuous mode [ 40.975904][ T5184] syzkaller0: entered allmulticast mode [ 41.030443][ T5180] IPVS: using max 61 ests per chain, 146400 per kthread [ 41.064723][ T5190] FAULT_INJECTION: forcing a failure. [ 41.064723][ T5190] name failslab, interval 1, probability 0, space 0, times 0 [ 41.067299][ T5190] CPU: 0 UID: 0 PID: 5190 Comm: syz.0.92 Tainted: G L syzkaller #0 PREEMPT [ 41.067321][ T5190] Tainted: [L]=SOFTLOCKUP [ 41.067326][ T5190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 41.067332][ T5190] Call trace: [ 41.067336][ T5190] show_stack+0x2c/0x3c (C) [ 41.067361][ T5190] __dump_stack+0x30/0x40 [ 41.067375][ T5190] dump_stack_lvl+0xd8/0x12c [ 41.067387][ T5190] dump_stack+0x1c/0x28 [ 41.067399][ T5190] should_fail_ex+0x41c/0x590 [ 41.067408][ T5190] should_failslab+0xc4/0x120 [ 41.067420][ T5190] kmem_cache_alloc_node_noprof+0x98/0x5f8 [ 41.067431][ T5190] __alloc_skb+0x1f0/0x610 [ 41.067444][ T5190] inet_netconf_notify_devconf+0x50/0x118 [ 41.067454][ T5190] __devinet_sysctl_unregister+0xa8/0xc0 [ 41.067463][ T5190] devinet_sysctl_unregister+0x94/0xf0 [ 41.067472][ T5190] inetdev_event+0x568/0x1180 [ 41.067480][ T5190] notifier_call_chain+0x1a4/0x624 [ 41.067493][ T5190] raw_notifier_call_chain+0x3c/0x50 [ 41.067504][ T5190] call_netdevice_notifiers_info+0xb8/0x120 [ 41.067513][ T5190] netif_set_mtu_ext+0x39c/0x574 [ 41.067525][ T5190] netif_set_mtu+0xc4/0x180 [ 41.067536][ T5190] dev_set_mtu+0x104/0x1f4 [ 41.067546][ T5190] dev_ifsioc+0x374/0xc34 [ 41.067558][ T5190] dev_ioctl+0x444/0xc88 [ 41.067570][ T5190] sock_do_ioctl+0x198/0x254 [ 41.067582][ T5190] sock_ioctl+0x55c/0x7ec [ 41.067594][ T5190] __arm64_sys_ioctl+0x154/0x1cc [ 41.067607][ T5190] invoke_syscall+0x98/0x244 [ 41.067619][ T5190] el0_svc_common+0xec/0x23c [ 41.067631][ T5190] do_el0_svc+0x4c/0x5c [ 41.067642][ T5190] el0_svc+0x64/0x260 [ 41.067653][ T5190] el0t_64_sync_handler+0x44/0x104 [ 41.067663][ T5190] el0t_64_sync+0x198/0x19c [ 41.113849][ T5194] Bluetooth: MGMT ver 1.23 [ 41.115361][ T4723] Bluetooth: hci1: unexpected cc 0x042d length: 63 > 7 [ 41.115582][ T4723] Bluetooth: hci1: unexpected event for opcode 0x042d [ 41.182038][ T5199] netlink: 28 bytes leftover after parsing attributes in process `syz.3.96'. [ 41.192942][ T5199] syz.3.96 uses obsolete (PF_INET,SOCK_PACKET) [ 41.279793][ T5207] binder: tried to use weak ref as strong ref [ 41.279826][ T5207] binder: 5206:5207 Acquire 1 refcount change on invalid ref 0 ret -22 [ 41.282344][ T5207] binder: 5206:5207 got transaction to invalid handle, 1 [ 41.282356][ T5207] binder: 5206:5207 cannot find target node [ 41.282368][ T5207] binder: 5206:5207 transaction call to 0:0 failed 8/29201/-22, code 0 size 104-24 line 3252 [ 41.282596][ T4311] binder: undelivered TRANSACTION_ERROR: 29201 [ 41.302184][ T5213] netlink: 8 bytes leftover after parsing attributes in process `syz.3.103'. [ 41.323090][ T5215] loop2: detected capacity change from 0 to 512 [ 41.326526][ T5215] EXT4-fs: Ignoring removed bh option [ 41.361905][ T5215] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 41.361944][ T5215] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 41.361977][ T5215] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 41.376630][ T5215] EXT4-fs (loop2): warning: mounting unchecked fs, running e2fsck is recommended [ 41.377060][ T5215] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 41.385640][ T5215] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.459855][ T4723] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 41.498231][ T4714] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.503771][ T5232] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.110'. [ 41.547659][ T5240] loop0: detected capacity change from 0 to 512 [ 41.549615][ T5240] EXT4-fs: Ignoring removed i_version option [ 41.555798][ T5240] EXT4-fs: Ignoring removed bh option [ 41.569922][ T5240] EXT4-fs error (device loop0): ext4_orphan_get:1399: comm syz.0.115: inode #13: comm syz.0.115: iget: illegal inode # [ 41.577054][ T5240] loop0: lost filesystem error report for type 5 error -117 [ 41.580390][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 41.580425][ C0] EXT4-fs (loop0): initial error at time 41: ext4_orphan_get:1399 [ 41.580459][ C0] EXT4-fs (loop0): last error at time 41: ext4_orphan_get:1399 [ 41.581260][ T5240] EXT4-fs (loop0): Remounting filesystem read-only [ 41.591839][ T5240] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.625468][ T4710] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.654592][ T5254] loop2: detected capacity change from 0 to 512 [ 41.676531][ T5257] loop1: detected capacity change from 0 to 512 [ 41.768907][ T5270] FAULT_INJECTION: forcing a failure. [ 41.768907][ T5270] name failslab, interval 1, probability 0, space 0, times 0 [ 41.768947][ T5270] CPU: 1 UID: 0 PID: 5270 Comm: syz.0.128 Tainted: G L syzkaller #0 PREEMPT [ 41.768962][ T5270] Tainted: [L]=SOFTLOCKUP [ 41.768966][ T5270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 41.768972][ T5270] Call trace: [ 41.768976][ T5270] show_stack+0x2c/0x3c (C) [ 41.768997][ T5270] __dump_stack+0x30/0x40 [ 41.769008][ T5270] dump_stack_lvl+0xd8/0x12c [ 41.769018][ T5270] dump_stack+0x1c/0x28 [ 41.769027][ T5270] should_fail_ex+0x41c/0x590 [ 41.769036][ T5270] should_failslab+0xc4/0x120 [ 41.769044][ T5270] __kmalloc_noprof+0x108/0x6b8 [ 41.769053][ T5270] tomoyo_realpath_from_path+0xbc/0x4dc [ 41.769062][ T5270] tomoyo_path_number_perm+0x1f0/0x500 [ 41.769070][ T5270] tomoyo_file_ioctl+0x2c/0x3c [ 41.769078][ T5270] security_file_ioctl+0xdc/0x2b0 [ 41.769086][ T5270] __arm64_sys_ioctl+0xb0/0x1cc [ 41.769097][ T5270] invoke_syscall+0x98/0x244 [ 41.769107][ T5270] el0_svc_common+0xec/0x23c [ 41.769116][ T5270] do_el0_svc+0x4c/0x5c [ 41.769126][ T5270] el0_svc+0x64/0x260 [ 41.769135][ T5270] el0t_64_sync_handler+0x44/0x104 [ 41.769143][ T5270] el0t_64_sync+0x198/0x19c [ 41.769153][ T5270] ERROR: Out of memory at tomoyo_realpath_from_path. [ 41.825677][ T5279] loop1: detected capacity change from 0 to 512 [ 41.828870][ T5279] EXT4-fs: Ignoring removed i_version option [ 41.828924][ T5279] EXT4-fs: Ignoring removed bh option [ 41.842559][ T5279] EXT4-fs error (device loop1): ext4_orphan_get:1399: comm syz.1.132: inode #13: comm syz.1.132: iget: illegal inode # [ 41.842610][ T5279] loop1: lost filesystem error report for type 5 error -117 [ 41.842752][ T5279] EXT4-fs (loop1): Remounting filesystem read-only [ 41.843200][ T5279] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.850584][ T5282] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.127'. [ 41.852701][ T5267] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.127'. [ 41.855119][ T5274] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.127'. [ 41.881829][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.889535][ T5286] binder: 5285:5286 got transaction to invalid handle, 1 [ 41.897492][ T5286] binder: 5285:5286 cannot find target node [ 41.897539][ T5286] binder: 5285:5286 transaction call to 0:0 failed 11/29201/-22, code 0 size 104-24 line 3252 [ 41.897734][ T4311] binder: undelivered TRANSACTION_ERROR: 29201 [ 41.924048][ T5292] netlink: 8 bytes leftover after parsing attributes in process `syz.0.137'. [ 41.926783][ T5294] netlink: 16 bytes leftover after parsing attributes in process `syz.0.137'. [ 41.931022][ T4723] Bluetooth: hci0: command 0x040f tx timeout [ 41.941161][ T262] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 41.942448][ T262] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 41.961873][ T4311] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 41.986734][ T5303] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 42.016664][ T5305] FAULT_INJECTION: forcing a failure. [ 42.016664][ T5305] name failslab, interval 1, probability 0, space 0, times 0 [ 42.016702][ T5305] CPU: 1 UID: 0 PID: 5305 Comm: syz.0.143 Tainted: G L syzkaller #0 PREEMPT [ 42.016716][ T5305] Tainted: [L]=SOFTLOCKUP [ 42.016720][ T5305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 42.016726][ T5305] Call trace: [ 42.016730][ T5305] show_stack+0x2c/0x3c (C) [ 42.016748][ T5305] __dump_stack+0x30/0x40 [ 42.016759][ T5305] dump_stack_lvl+0xd8/0x12c [ 42.016769][ T5305] dump_stack+0x1c/0x28 [ 42.016778][ T5305] should_fail_ex+0x41c/0x590 [ 42.016787][ T5305] should_failslab+0xc4/0x120 [ 42.016795][ T5305] __kmalloc_noprof+0x108/0x6b8 [ 42.016805][ T5305] tomoyo_encode2+0x10c/0x330 [ 42.016814][ T5305] tomoyo_encode+0x34/0x50 [ 42.016822][ T5305] tomoyo_realpath_from_path+0x488/0x4dc [ 42.016830][ T5305] tomoyo_path_number_perm+0x1f0/0x500 [ 42.016838][ T5305] tomoyo_file_ioctl+0x2c/0x3c [ 42.016846][ T5305] security_file_ioctl+0xdc/0x2b0 [ 42.016864][ T5305] __arm64_sys_ioctl+0xb0/0x1cc [ 42.016881][ T5305] invoke_syscall+0x98/0x244 [ 42.016893][ T5305] el0_svc_common+0xec/0x23c [ 42.016903][ T5305] do_el0_svc+0x4c/0x5c [ 42.016912][ T5305] el0_svc+0x64/0x260 [ 42.016922][ T5305] el0t_64_sync_handler+0x44/0x104 [ 42.016930][ T5305] el0t_64_sync+0x198/0x19c [ 42.016953][ T5305] ERROR: Out of memory at tomoyo_realpath_from_path. [ 42.023007][ T5311] loop3: detected capacity change from 0 to 512 [ 42.023301][ T5311] EXT4-fs: Ignoring removed bh option [ 42.034408][ T5311] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 42.034419][ T5311] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 42.035550][ T5311] EXT4-fs (loop3): warning: mounting unchecked fs, running e2fsck is recommended [ 42.035730][ T5311] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 42.036260][ T5311] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.079016][ T4709] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.138139][ T5324] binder: 5323:5324 got transaction to invalid handle, 1 [ 42.138177][ T5324] binder: 5323:5324 cannot find target node [ 42.275780][ T5339] FAULT_INJECTION: forcing a failure. [ 42.275780][ T5339] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 42.278301][ T5339] CPU: 0 UID: 0 PID: 5339 Comm: syz.0.157 Tainted: G L syzkaller #0 PREEMPT [ 42.278322][ T5339] Tainted: [L]=SOFTLOCKUP [ 42.278326][ T5339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 42.278332][ T5339] Call trace: [ 42.278335][ T5339] show_stack+0x2c/0x3c (C) [ 42.278358][ T5339] __dump_stack+0x30/0x40 [ 42.278369][ T5339] dump_stack_lvl+0xd8/0x12c [ 42.278379][ T5339] dump_stack+0x1c/0x28 [ 42.278389][ T5339] should_fail_ex+0x41c/0x590 [ 42.278397][ T5339] should_fail+0x14/0x24 [ 42.278403][ T5339] should_fail_usercopy+0x20/0x30 [ 42.278410][ T5339] _inline_copy_from_user+0x3c/0x188 [ 42.278419][ T5339] video_usercopy+0x2d0/0xe88 [ 42.278428][ T5339] video_ioctl2+0x3c/0x50 [ 42.278437][ T5339] v4l2_ioctl+0x148/0x18c [ 42.278446][ T5339] __arm64_sys_ioctl+0x154/0x1cc [ 42.278457][ T5339] invoke_syscall+0x98/0x244 [ 42.278467][ T5339] el0_svc_common+0xec/0x23c [ 42.278477][ T5339] do_el0_svc+0x4c/0x5c [ 42.278486][ T5339] el0_svc+0x64/0x260 [ 42.278495][ T5339] el0t_64_sync_handler+0x44/0x104 [ 42.278504][ T5339] el0t_64_sync+0x198/0x19c [ 42.286260][ T5336] loop2: detected capacity change from 0 to 2048 [ 42.306266][ T5336] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.314789][ T5336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.156'. [ 42.355282][ T5344] loop0: detected capacity change from 0 to 512 [ 42.355620][ T5344] EXT4-fs: Ignoring removed bh option [ 42.358403][ T4714] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.360949][ T5344] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 42.360987][ T5344] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem [ 42.361919][ T5344] EXT4-fs (loop0): warning: mounting unchecked fs, running e2fsck is recommended [ 42.362064][ T5344] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 42.362597][ T5344] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.383403][ T4710] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.479967][ T5359] binder: 5358:5359 got transaction to invalid handle, 1 [ 42.516103][ T5366] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 42.573848][ T4311] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 42.586133][ T5375] capability: warning: `syz.0.171' uses deprecated v2 capabilities in a way that may be insecure [ 42.588760][ T5375] ucma_write: process 88 (syz.0.171) changed security contexts after opening file descriptor, this is not allowed. [ 42.623127][ T30] audit: type=1326 audit(42.600:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5376 comm="syz.0.172" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffa4f792a8 code=0x0 [ 42.812959][ T50] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 42.813399][ T50] Bluetooth: hci3: command 0x0419 tx timeout [ 42.813419][ T50] Bluetooth: hci2: command 0x0c1a tx timeout [ 42.813434][ T50] Bluetooth: hci4: command 0x0419 tx timeout [ 42.892425][ T5385] binder: 5384:5385 got transaction to invalid handle, 1 [ 42.928698][ T5391] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 42.970529][ T26] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 42.980337][ T5387] device-mapper: ioctl: only supply one of name or uuid, cmd(9) [ 43.101293][ T5416] loop4: detected capacity change from 0 to 512 [ 43.105336][ T5416] EXT4-fs: Ignoring removed i_version option [ 43.105383][ T5416] EXT4-fs: Ignoring removed bh option [ 43.111694][ T5416] EXT4-fs error (device loop4): ext4_orphan_get:1399: comm syz.4.182: inode #13: comm syz.4.182: iget: illegal inode # [ 43.114213][ T5416] loop4: lost filesystem error report for type 5 error -117 [ 43.114552][ T5416] EXT4-fs (loop4): Remounting filesystem read-only [ 43.124108][ T5416] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 43.125516][ T5419] EXT4-fs: Ignoring removed bh option [ 43.127455][ T5419] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 43.127475][ T5419] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 43.128232][ T5419] EXT4-fs (loop1): warning: mounting unchecked fs, running e2fsck is recommended [ 43.128382][ T5419] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 43.129009][ T5419] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 43.159140][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.159643][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.187238][ T5424] Injecting memory failure for pfn 0x13351c at process virtual address 0x20001000 [ 43.189201][ T5423] Injecting memory failure for pfn 0x13351c at process virtual address 0x20001000 [ 43.221027][ T5424] Memory failure: 0x13351c: clean LRU page still referenced by 1 users [ 43.222946][ T5424] Memory failure: 0x13351c: recovery action for clean LRU page: Failed [ 43.225871][ T5423] Memory failure: 0x13351c: Sending SIGBUS to syz.4.185:5423 due to hardware memory corruption [ 43.225957][ T5423] Memory failure: 0x13351c: recovery action for already poisoned page: Failed [ 43.251868][ T5423] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 43.258505][ T5427] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 43.258534][ T5427] EXT4-fs (loop1): group descriptors corrupted! [ 43.324209][ T5432] binder: tried to use weak ref as strong ref [ 43.471077][ T5457] netlink: 'syz.3.198': attribute type 4 has an invalid length. [ 43.489636][ T5457] netlink: 'syz.3.198': attribute type 4 has an invalid length. [ 43.508289][ T5462] netlink: 'syz.3.198': attribute type 4 has an invalid length. [ 43.514604][ T5468] netlink: 'syz.3.198': attribute type 4 has an invalid length. [ 43.614968][ T5454] loop1: p1 p9 p11 [ 43.643643][ T5482] EXT4-fs (loop4): Test dummy encryption mode enabled [ 43.643681][ T5482] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 43.652491][ T5482] EXT4-fs error (device loop4): ext4_orphan_get:1425: comm syz.4.207: bad orphan inode 131083 [ 43.652529][ T5482] loop4: lost filesystem error report for type 5 error -117 [ 43.659775][ T5482] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 43.741411][ T4702] udevd[4702]: inotify_add_watch(7, /dev/loop1p9, 10) failed: No such file or directory [ 43.743291][ T4703] udevd[4703]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 43.752805][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.777225][ T4901] udevd[4901]: inotify_add_watch(7, /dev/loop1p11, 10) failed: No such file or directory [ 43.881871][ T5522] binder: 5521:5522 ioctl c0d05605 20000000 returned -22 [ 43.929531][ T5524] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.940683][ T5524] Quota error (device loop4): do_check_range: Getting block 150994949 out of range 1-5 [ 43.940760][ T5524] Quota error (device loop4): qtree_read_dquot: Can't read quota structure for id 0 [ 43.940786][ T5524] EXT4-fs error (device loop4): ext4_acquire_dquot:7041: comm syz.4.223: Failed to acquire dquot type 0 [ 43.949510][ T5524] EXT4-fs (loop4): Remounting filesystem read-only [ 43.952766][ T5524] EXT4-fs warning (device loop4): ext4_resize_begin:82: There are errors in the filesystem, so online resizing is not allowed [ 43.978721][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.012104][ T4723] Bluetooth: hci0: command 0x040f tx timeout [ 44.085651][ T5549] tipc: Invalid UDP bearer configuration [ 44.085746][ T5549] tipc: Enabling of bearer rejected, failed to enable media [ 44.194933][ T4795] kernel write not supported for file /input/mice (pid: 4795 comm: kworker/0:4) [ 44.205164][ T5558] Bluetooth: Invalid esc byte 0x04 [ 44.256054][ T5562] EXT4-fs (loop4): warning: mounting unchecked fs, running e2fsck is recommended [ 44.257981][ T5562] EXT4-fs (loop4): Errors on filesystem, clearing orphan list. [ 44.258413][ T5562] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 44.295701][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.311631][ T5565] bridge1: entered promiscuous mode [ 44.350032][ T5567] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.440761][ T5575] EXT4-fs: Ignoring removed bh option [ 44.443654][ T5575] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 44.446330][ T5575] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem [ 44.449847][ T5575] EXT4-fs (loop0): warning: mounting unchecked fs, running e2fsck is recommended [ 44.453174][ T5575] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 44.457631][ T5575] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.478162][ T4710] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.678327][ T5592] set_capacity_and_notify: 8 callbacks suppressed [ 44.678367][ T5592] loop0: detected capacity change from 0 to 512 [ 44.679629][ T5592] ext4: Bad value for 'mb_optimize_scan' [ 44.736064][ T5594] loop0: detected capacity change from 0 to 1024 [ 44.738284][ T5594] EXT4-fs: inline encryption not supported [ 44.738327][ T5594] EXT4-fs: Ignoring removed bh option [ 44.741026][ T5594] EXT4-fs (loop0): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 44.748421][ T5590] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.748914][ T5590] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.778479][ T5594] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.804502][ T4710] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.823543][ T5590] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 44.827768][ T5590] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 44.891693][ T50] Bluetooth: hci3: command 0x0419 tx timeout [ 44.893607][ T4723] Bluetooth: hci4: command 0x0419 tx timeout [ 44.933405][ T5595] geneve2: entered promiscuous mode [ 44.934942][ T5595] geneve2: entered allmulticast mode [ 44.951933][ T4854] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.951999][ T4854] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 44.952028][ T4854] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.952043][ T4854] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 44.952061][ T4854] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.952075][ T4854] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 44.952092][ T4854] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.952105][ T4854] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 45.036981][ T5607] loop0: detected capacity change from 0 to 512 [ 45.070806][ T5607] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 45.083516][ T5611] binder_alloc: 5610: binder_alloc_buf, no vma [ 45.096263][ T5607] syz.0.253: attempt to access beyond end of device [ 45.096263][ T5607] loop0: rw=8912896, sector=17179852706, nr_sectors = 16 limit=512 [ 45.097974][ T5607] syz.0.253: attempt to access beyond end of device [ 45.097974][ T5607] loop0: rw=8388608, sector=17179852706, nr_sectors = 8 limit=512 [ 45.102144][ T5607] syz.0.253: attempt to access beyond end of device [ 45.102144][ T5607] loop0: rw=8388608, sector=17179852706, nr_sectors = 8 limit=512 [ 45.131046][ T4723] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 45.131118][ T4723] Bluetooth: hci1: Injecting HCI hardware error event [ 45.131702][ T50] Bluetooth: hci1: hardware error 0x00 [ 45.208115][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.329442][ T5629] netlink: 'syz.0.263': attribute type 4 has an invalid length. [ 45.334321][ T5631] netlink: 'syz.0.263': attribute type 4 has an invalid length. [ 45.850493][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 45.924879][ T4472] kernel write not supported for file /101/net/netstat (pid: 4472 comm: kworker/0:3) [ 45.961985][ T5682] loop4: detected capacity change from 0 to 512 [ 45.965190][ T5683] Cannot find del_set index 3 as target [ 45.966807][ T5684] Cannot find del_set index 3 as target [ 46.047381][ T5688] loop3: detected capacity change from 0 to 256 [ 46.052438][ T5689] __nla_validate_parse: 8 callbacks suppressed [ 46.054070][ T5689] netlink: 8 bytes leftover after parsing attributes in process `syz.3.283'. [ 46.054138][ T5689] netlink: 8 bytes leftover after parsing attributes in process `syz.3.283'. [ 46.071383][ T5689] input: syz1 as /devices/virtual/input/input3 [ 46.078315][ T5688] FAT-fs (loop3): Directory bread(block 1285) failed [ 46.078357][ T5688] FAT-fs (loop3): Directory bread(block 1286) failed [ 46.078377][ T5688] FAT-fs (loop3): Directory bread(block 1287) failed [ 46.078422][ T5688] FAT-fs (loop3): Directory bread(block 1288) failed [ 46.173937][ T5703] binder: 5702:5703 ioctl c0306201 200001c0 returned -14 [ 46.189621][ T5703] binder_user_error: 12 callbacks suppressed [ 46.191130][ T5703] binder: 5702:5703 tried to acquire reference to desc 0, got 1 instead [ 46.193048][ T5703] binder: 5702:5703 got transaction with fd, -1, but target does not allow fds [ 46.194896][ T5703] binder_debug: 23 callbacks suppressed [ 46.195993][ T5703] binder: 5703:5702 translate fd failed [ 46.197417][ T5703] binder: 5702:5703 transaction call to 5702:0 failed 45/29201/-1, code 0 size 104-24 line 3593 [ 46.201478][ T26] binder: undelivered TRANSACTION_ERROR: 29201 [ 46.268633][ T5713] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 46.300620][ T5720] FAULT_INJECTION: forcing a failure. [ 46.300620][ T5720] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 46.303377][ T5720] CPU: 1 UID: 0 PID: 5720 Comm: syz.2.294 Tainted: G L syzkaller #0 PREEMPT [ 46.303405][ T5720] Tainted: [L]=SOFTLOCKUP [ 46.303409][ T5720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 46.303415][ T5720] Call trace: [ 46.303418][ T5720] show_stack+0x2c/0x3c (C) [ 46.303441][ T5720] __dump_stack+0x30/0x40 [ 46.303452][ T5720] dump_stack_lvl+0xd8/0x12c [ 46.303462][ T5720] dump_stack+0x1c/0x28 [ 46.303472][ T5720] should_fail_ex+0x41c/0x590 [ 46.303480][ T5720] should_fail+0x14/0x24 [ 46.303487][ T5720] should_fail_usercopy+0x20/0x30 [ 46.303494][ T5720] _inline_copy_from_user+0x3c/0x174 [ 46.303505][ T5720] move_addr_to_kernel+0x88/0x168 [ 46.303514][ T5720] __sys_sendto+0x1b0/0x328 [ 46.303523][ T5720] __arm64_sys_sendto+0xec/0x10c [ 46.303531][ T5720] invoke_syscall+0x98/0x244 [ 46.303542][ T5720] el0_svc_common+0xec/0x23c [ 46.303551][ T5720] do_el0_svc+0x4c/0x5c [ 46.303560][ T5720] el0_svc+0x64/0x260 [ 46.303570][ T5720] el0t_64_sync_handler+0x44/0x104 [ 46.303578][ T5720] el0t_64_sync+0x198/0x19c [ 46.509504][ T5732] FAULT_INJECTION: forcing a failure. [ 46.509504][ T5732] name failslab, interval 1, probability 0, space 0, times 0 [ 46.509539][ T5732] CPU: 0 UID: 0 PID: 5732 Comm: syz.0.300 Tainted: G L syzkaller #0 PREEMPT [ 46.509554][ T5732] Tainted: [L]=SOFTLOCKUP [ 46.509558][ T5732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 46.509564][ T5732] Call trace: [ 46.509567][ T5732] show_stack+0x2c/0x3c (C) [ 46.509587][ T5732] __dump_stack+0x30/0x40 [ 46.509598][ T5732] dump_stack_lvl+0xd8/0x12c [ 46.509608][ T5732] dump_stack+0x1c/0x28 [ 46.509617][ T5732] should_fail_ex+0x41c/0x590 [ 46.509625][ T5732] should_failslab+0xc4/0x120 [ 46.509633][ T5732] __kmalloc_cache_noprof+0x94/0x5ec [ 46.509642][ T5732] cgroup_show_path+0xac/0x5a0 [ 46.509651][ T5732] kernfs_sop_show_path+0xd4/0x114 [ 46.509660][ T5732] show_path+0x90/0xc4 [ 46.509669][ T5732] show_mountinfo+0x174/0x65c [ 46.509677][ T5732] m_show+0x6c/0x80 [ 46.509685][ T5732] seq_read_iter+0x808/0xbe8 [ 46.509691][ T5732] vfs_read+0x498/0x8c8 [ 46.509698][ T5732] ksys_read+0x12c/0x228 [ 46.509705][ T5732] __arm64_sys_read+0x84/0x98 [ 46.509711][ T5732] invoke_syscall+0x98/0x244 [ 46.509721][ T5732] el0_svc_common+0xec/0x23c [ 46.509731][ T5732] do_el0_svc+0x4c/0x5c [ 46.509740][ T5732] el0_svc+0x64/0x260 [ 46.509750][ T5732] el0t_64_sync_handler+0x44/0x104 [ 46.509758][ T5732] el0t_64_sync+0x198/0x19c [ 46.624429][ T5744] Driver unsupported XDP return value 0 on prog (id 9) dev N/A, expect packet loss! [ 46.744010][ T5753] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 46.829945][ T5757] loop2: detected capacity change from 0 to 512 [ 46.841243][ T5757] EXT4-fs: Ignoring removed i_version option [ 46.843832][ T5757] EXT4-fs: Ignoring removed bh option [ 46.848579][ T5757] EXT4-fs error (device loop2): ext4_orphan_get:1399: comm syz.2.312: inode #13: comm syz.2.312: iget: illegal inode # [ 46.850452][ T5757] loop2: lost filesystem error report for type 5 error -117 [ 46.851372][ T5757] EXT4-fs (loop2): Remounting filesystem read-only [ 46.853802][ T5757] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 46.892376][ T4714] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.958857][ T5771] FAULT_INJECTION: forcing a failure. [ 46.958857][ T5771] name failslab, interval 1, probability 0, space 0, times 0 [ 46.963030][ T5771] CPU: 1 UID: 0 PID: 5771 Comm: syz.4.317 Tainted: G L syzkaller #0 PREEMPT [ 46.963050][ T5771] Tainted: [L]=SOFTLOCKUP [ 46.963054][ T5771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 46.963059][ T5771] Call trace: [ 46.963063][ T5771] show_stack+0x2c/0x3c (C) [ 46.963088][ T5771] __dump_stack+0x30/0x40 [ 46.963099][ T5771] dump_stack_lvl+0xd8/0x12c [ 46.963110][ T5771] dump_stack+0x1c/0x28 [ 46.963119][ T5771] should_fail_ex+0x41c/0x590 [ 46.963128][ T5771] should_failslab+0xc4/0x120 [ 46.963140][ T5771] __kmalloc_cache_noprof+0x94/0x5ec [ 46.963150][ T5771] cgroup_show_path+0xac/0x5a0 [ 46.963160][ T5771] kernfs_sop_show_path+0xd4/0x114 [ 46.963168][ T5771] show_path+0x90/0xc4 [ 46.963178][ T5771] show_mountinfo+0x174/0x65c [ 46.963185][ T5771] m_show+0x6c/0x80 [ 46.963193][ T5771] seq_read_iter+0x808/0xbe8 [ 46.963200][ T5771] vfs_read+0x498/0x8c8 [ 46.963207][ T5771] ksys_read+0x12c/0x228 [ 46.963213][ T5771] __arm64_sys_read+0x84/0x98 [ 46.963220][ T5771] invoke_syscall+0x98/0x244 [ 46.963230][ T5771] el0_svc_common+0xec/0x23c [ 46.963240][ T5771] do_el0_svc+0x4c/0x5c [ 46.963249][ T5771] el0_svc+0x64/0x260 [ 46.963258][ T5771] el0t_64_sync_handler+0x44/0x104 [ 46.963267][ T5771] el0t_64_sync+0x198/0x19c [ 46.971013][ T4723] Bluetooth: hci4: command 0x0419 tx timeout [ 46.971035][ T4723] Bluetooth: hci3: command 0x0419 tx timeout [ 47.019517][ T5779] netlink: 40 bytes leftover after parsing attributes in process `syz.4.320'. [ 47.022147][ T5779] netlink: 40 bytes leftover after parsing attributes in process `syz.4.320'. [ 47.023300][ T5780] netlink: 40 bytes leftover after parsing attributes in process `syz.4.320'. [ 47.029414][ T5777] loop4: detected capacity change from 0 to 2048 [ 47.031649][ T5780] netlink: 40 bytes leftover after parsing attributes in process `syz.4.320'. [ 47.066913][ T5777] loop4: p1 < > p4 [ 47.066913][ T5777] p4: [ 47.070193][ T5777] loop4: p4 size 722688 extends beyond EOD, truncated [ 47.125213][ T5791] FAULT_INJECTION: forcing a failure. [ 47.125213][ T5791] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 47.125248][ T5791] CPU: 0 UID: 0 PID: 5791 Comm: syz.3.324 Tainted: G L syzkaller #0 PREEMPT [ 47.125264][ T5791] Tainted: [L]=SOFTLOCKUP [ 47.125268][ T5791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 47.125274][ T5791] Call trace: [ 47.125278][ T5791] show_stack+0x2c/0x3c (C) [ 47.125297][ T5791] __dump_stack+0x30/0x40 [ 47.125308][ T5791] dump_stack_lvl+0xd8/0x12c [ 47.125318][ T5791] dump_stack+0x1c/0x28 [ 47.125328][ T5791] should_fail_ex+0x41c/0x590 [ 47.125336][ T5791] should_fail+0x14/0x24 [ 47.125342][ T5791] should_fail_usercopy+0x20/0x30 [ 47.125349][ T5791] _inline_copy_from_user+0x3c/0x174 [ 47.125361][ T5791] move_addr_to_kernel+0x88/0x168 [ 47.125369][ T5791] __sys_sendto+0x1b0/0x328 [ 47.125378][ T5791] __arm64_sys_sendto+0xec/0x10c [ 47.125387][ T5791] invoke_syscall+0x98/0x244 [ 47.125397][ T5791] el0_svc_common+0xec/0x23c [ 47.125406][ T5791] do_el0_svc+0x4c/0x5c [ 47.125419][ T5791] el0_svc+0x64/0x260 [ 47.125429][ T5791] el0t_64_sync_handler+0x44/0x104 [ 47.125438][ T5791] el0t_64_sync+0x198/0x19c [ 47.176277][ T4703] udevd[4703]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 47.180201][ T4702] udevd[4702]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 47.191617][ T5801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.191823][ T5801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.210928][ T50] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 47.260621][ T5810] loop0: detected capacity change from 0 to 512 [ 47.263674][ T5810] EXT4-fs: Ignoring removed bh option [ 47.265685][ T5810] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 47.267393][ T5810] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem [ 47.269822][ T5810] EXT4-fs (loop0): warning: mounting unchecked fs, running e2fsck is recommended [ 47.274393][ T5810] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 47.276672][ T5810] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 47.281745][ T5810] overlayfs: failed to resolve './file1': -2 [ 47.294162][ T4710] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.320259][ T5818] loop0: detected capacity change from 0 to 512 [ 47.327073][ T5818] EXT4-fs error (device loop0): ext4_iget_extra_inode:5180: inode #15: comm syz.0.337: corrupted in-inode xattr: e_value out of bounds [ 47.327165][ T5818] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 47.330399][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 47.330429][ C1] EXT4-fs (loop0): initial error at time 47: ext4_iget_extra_inode:5180: inode 15 [ 47.330468][ C1] EXT4-fs (loop0): last error at time 47: ext4_iget_extra_inode:5180: inode 15 [ 47.331771][ T5818] EXT4-fs error (device loop0): ext4_orphan_get:1404: comm syz.0.337: couldn't read orphan inode 15 (err -117) [ 47.343811][ T5818] loop0: lost filesystem error report for type 5 error -117 [ 47.345129][ T5818] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.376790][ T4710] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.510094][ T5829] loop0: detected capacity change from 0 to 491 [ 47.515981][ T5829] EXT4-fs (loop0): bad geometry: block count 128 exceeds size of device (122 blocks) [ 48.075043][ T5853] EXT4-fs: Ignoring removed i_version option [ 48.075090][ T5853] EXT4-fs: Ignoring removed bh option [ 48.079481][ T5853] EXT4-fs error (device loop1): ext4_orphan_get:1399: comm syz.1.349: inode #13: comm syz.1.349: iget: illegal inode # [ 48.079516][ T5853] loop1: lost filesystem error report for type 5 error -117 [ 48.079649][ T5853] EXT4-fs (loop1): Remounting filesystem read-only [ 48.080100][ T5853] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 48.124671][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.168320][ T5860] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 48.245914][ T5864] trusted_key: syz.1.354 sent an empty control message without MSG_MORE. [ 48.267059][ T5864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.354'. [ 48.267086][ T5864] netlink: 4 bytes leftover after parsing attributes in process `syz.1.354'. [ 48.267103][ T5864] netlink: 'syz.1.354': attribute type 15 has an invalid length. [ 48.267111][ T5864] netlink: 'syz.1.354': attribute type 18 has an invalid length. [ 48.366331][ T5873] FAULT_INJECTION: forcing a failure. [ 48.366331][ T5873] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 48.366373][ T5873] CPU: 0 UID: 0 PID: 5873 Comm: syz.1.358 Tainted: G L syzkaller #0 PREEMPT [ 48.366387][ T5873] Tainted: [L]=SOFTLOCKUP [ 48.366391][ T5873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 48.366396][ T5873] Call trace: [ 48.366399][ T5873] show_stack+0x2c/0x3c (C) [ 48.366417][ T5873] __dump_stack+0x30/0x40 [ 48.366428][ T5873] dump_stack_lvl+0xd8/0x12c [ 48.366437][ T5873] dump_stack+0x1c/0x28 [ 48.366447][ T5873] should_fail_ex+0x41c/0x590 [ 48.366455][ T5873] should_fail+0x14/0x24 [ 48.366461][ T5873] should_fail_usercopy+0x20/0x30 [ 48.366468][ T5873] _copy_from_iter+0x188/0x1064 [ 48.366476][ T5873] copy_page_from_iter+0x220/0x2e8 [ 48.366484][ T5873] tun_get_user+0x1764/0x364c [ 48.366493][ T5873] tun_chr_write_iter+0xfc/0x168 [ 48.366503][ T5873] vfs_write+0x51c/0xa0c [ 48.366510][ T5873] ksys_write+0x12c/0x228 [ 48.366517][ T5873] __arm64_sys_write+0x84/0x98 [ 48.366524][ T5873] invoke_syscall+0x98/0x244 [ 48.366533][ T5873] el0_svc_common+0xec/0x23c [ 48.366543][ T5873] do_el0_svc+0x4c/0x5c [ 48.366552][ T5873] el0_svc+0x64/0x260 [ 48.366562][ T5873] el0t_64_sync_handler+0x44/0x104 [ 48.366570][ T5873] el0t_64_sync+0x198/0x19c [ 48.404043][ T5879] binder: BINDER_SET_CONTEXT_MGR already set [ 48.405772][ T5879] binder: 5877:5879 ioctl 4018620d 20000040 returned -16 [ 48.407275][ T5879] binder: 5877:5879 got transaction to invalid handle, 1 [ 48.408653][ T5879] binder: 5877:5879 cannot find target node [ 48.409786][ T5879] binder: 5877:5879 transaction call to 0:0 failed 48/29201/-22, code 0 size 104-24 line 3252 [ 48.412366][ T4810] binder: undelivered TRANSACTION_ERROR: 29201 [ 48.528629][ T5897] FAULT_INJECTION: forcing a failure. [ 48.528629][ T5897] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 48.528675][ T5897] CPU: 0 UID: 0 PID: 5897 Comm: syz.1.369 Tainted: G L syzkaller #0 PREEMPT [ 48.528689][ T5897] Tainted: [L]=SOFTLOCKUP [ 48.528693][ T5897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 48.528699][ T5897] Call trace: [ 48.528703][ T5897] show_stack+0x2c/0x3c (C) [ 48.528722][ T5897] __dump_stack+0x30/0x40 [ 48.528733][ T5897] dump_stack_lvl+0xd8/0x12c [ 48.528743][ T5897] dump_stack+0x1c/0x28 [ 48.528752][ T5897] should_fail_ex+0x41c/0x590 [ 48.528760][ T5897] should_fail+0x14/0x24 [ 48.528767][ T5897] should_fail_usercopy+0x20/0x30 [ 48.528774][ T5897] _inline_copy_from_user+0x3c/0x1f8 [ 48.528783][ T5897] csum_and_copy_from_iter_full+0x190/0x13a0 [ 48.528791][ T5897] ip_generic_getfrag+0x128/0x270 [ 48.528801][ T5897] raw_getfrag+0x21c/0x324 [ 48.528809][ T5897] __ip_append_data+0x1ad0/0x3744 [ 48.528818][ T5897] ip_append_data+0x104/0x180 [ 48.528826][ T5897] raw_sendmsg+0xf70/0x148c [ 48.528833][ T5897] inet_sendmsg+0xb4/0xd8 [ 48.528842][ T5897] __sock_sendmsg+0xc8/0x17c [ 48.528856][ T5897] __sys_sendto+0x250/0x328 [ 48.528866][ T5897] __arm64_sys_sendto+0xec/0x10c [ 48.528876][ T5897] invoke_syscall+0x98/0x244 [ 48.528887][ T5897] el0_svc_common+0xec/0x23c [ 48.528897][ T5897] do_el0_svc+0x4c/0x5c [ 48.528906][ T5897] el0_svc+0x64/0x260 [ 48.528915][ T5897] el0t_64_sync_handler+0x44/0x104 [ 48.528924][ T5897] el0t_64_sync+0x198/0x19c [ 48.583170][ T5904] FAULT_INJECTION: forcing a failure. [ 48.583170][ T5904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 48.583204][ T5904] CPU: 1 UID: 0 PID: 5904 Comm: syz.4.372 Tainted: G L syzkaller #0 PREEMPT [ 48.583220][ T5904] Tainted: [L]=SOFTLOCKUP [ 48.583225][ T5904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 48.583231][ T5904] Call trace: [ 48.583234][ T5904] show_stack+0x2c/0x3c (C) [ 48.583252][ T5904] __dump_stack+0x30/0x40 [ 48.583262][ T5904] dump_stack_lvl+0xd8/0x12c [ 48.583272][ T5904] dump_stack+0x1c/0x28 [ 48.583281][ T5904] should_fail_ex+0x41c/0x590 [ 48.583289][ T5904] should_fail+0x14/0x24 [ 48.583295][ T5904] should_fail_usercopy+0x20/0x30 [ 48.583302][ T5904] _inline_copy_from_user+0x3c/0x174 [ 48.583313][ T5904] move_addr_to_kernel+0x88/0x168 [ 48.583322][ T5904] __sys_connect+0xd4/0x194 [ 48.583330][ T5904] __arm64_sys_connect+0x84/0x9c [ 48.583339][ T5904] invoke_syscall+0x98/0x244 [ 48.583349][ T5904] el0_svc_common+0xec/0x23c [ 48.583359][ T5904] do_el0_svc+0x4c/0x5c [ 48.583368][ T5904] el0_svc+0x64/0x260 [ 48.583377][ T5904] el0t_64_sync_handler+0x44/0x104 [ 48.583386][ T5904] el0t_64_sync+0x198/0x19c [ 48.657125][ T5908] FAULT_INJECTION: forcing a failure. [ 48.657125][ T5908] name failslab, interval 1, probability 0, space 0, times 0 [ 48.657163][ T5908] CPU: 0 UID: 0 PID: 5908 Comm: syz.1.373 Tainted: G L syzkaller #0 PREEMPT [ 48.657179][ T5908] Tainted: [L]=SOFTLOCKUP [ 48.657184][ T5908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 48.657190][ T5908] Call trace: [ 48.657193][ T5908] show_stack+0x2c/0x3c (C) [ 48.657210][ T5908] __dump_stack+0x30/0x40 [ 48.657221][ T5908] dump_stack_lvl+0xd8/0x12c [ 48.657231][ T5908] dump_stack+0x1c/0x28 [ 48.657240][ T5908] should_fail_ex+0x41c/0x590 [ 48.657248][ T5908] should_failslab+0xc4/0x120 [ 48.657256][ T5908] kmem_cache_alloc_noprof+0x94/0x5d8 [ 48.657265][ T5908] sk_prot_alloc+0x60/0x1e8 [ 48.657273][ T5908] sk_alloc+0x44/0x3ac [ 48.657280][ T5908] inet_create+0x594/0xd48 [ 48.657289][ T5908] __sock_create+0x31c/0x670 [ 48.657298][ T5908] __sys_socket_create+0xc0/0x11c [ 48.657307][ T5908] __sys_socket+0x44/0xec [ 48.657315][ T5908] __arm64_sys_socket+0x84/0x9c [ 48.657324][ T5908] invoke_syscall+0x98/0x244 [ 48.657334][ T5908] el0_svc_common+0xec/0x23c [ 48.657343][ T5908] do_el0_svc+0x4c/0x5c [ 48.657353][ T5908] el0_svc+0x64/0x260 [ 48.657362][ T5908] el0t_64_sync_handler+0x44/0x104 [ 48.657370][ T5908] el0t_64_sync+0x198/0x19c [ 48.690061][ T5911] binder: BINDER_SET_CONTEXT_MGR already set [ 48.691435][ T5911] binder: 5910:5911 ioctl 4018620d 20000040 returned -16 [ 48.693217][ T5911] binder: 5910:5911 got transaction to invalid handle, 1 [ 48.694710][ T5911] binder: 5910:5911 cannot find target node [ 48.695966][ T5911] binder: 5910:5911 transaction call to 0:0 failed 51/29201/-22, code 0 size 104-24 line 3252 [ 48.698356][ T4803] binder: undelivered TRANSACTION_ERROR: 29201 [ 48.712289][ T5908] FAULT_INJECTION: forcing a failure. [ 48.712289][ T5908] name fail_futex, interval 1, probability 0, space 0, times 1 [ 48.714986][ T5908] CPU: 1 UID: 0 PID: 5908 Comm: syz.1.373 Tainted: G L syzkaller #0 PREEMPT [ 48.715007][ T5908] Tainted: [L]=SOFTLOCKUP [ 48.715010][ T5908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 48.715016][ T5908] Call trace: [ 48.715020][ T5908] show_stack+0x2c/0x3c (C) [ 48.715041][ T5908] __dump_stack+0x30/0x40 [ 48.715053][ T5908] dump_stack_lvl+0xd8/0x12c [ 48.715063][ T5908] dump_stack+0x1c/0x28 [ 48.715073][ T5908] should_fail_ex+0x41c/0x590 [ 48.715081][ T5908] should_fail+0x14/0x24 [ 48.715088][ T5908] get_futex_key+0x1ec/0x12b0 [ 48.715098][ T5908] futex_wait_setup+0x58/0x674 [ 48.715106][ T5908] __futex_wait+0x108/0x25c [ 48.715115][ T5908] futex_wait+0x108/0x2c0 [ 48.715123][ T5908] do_futex+0x320/0x378 [ 48.715131][ T5908] __arm64_sys_futex+0x2e4/0x418 [ 48.715139][ T5908] invoke_syscall+0x98/0x244 [ 48.715150][ T5908] el0_svc_common+0xec/0x23c [ 48.715159][ T5908] do_el0_svc+0x4c/0x5c [ 48.715169][ T5908] el0_svc+0x64/0x260 [ 48.715178][ T5908] el0t_64_sync_handler+0x44/0x104 [ 48.715187][ T5908] el0t_64_sync+0x198/0x19c [ 48.815758][ T5928] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.815963][ T5928] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.946058][ T5953] netlink: 292 bytes leftover after parsing attributes in process `syz.4.392'. [ 48.948367][ T5953] netlink: 292 bytes leftover after parsing attributes in process `syz.4.392'. [ 49.014683][ T5962] device-mapper: ioctl: name not supplied when creating device [ 49.049743][ T5969] FAULT_INJECTION: forcing a failure. [ 49.049743][ T5969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 49.049785][ T5969] CPU: 0 UID: 0 PID: 5969 Comm: syz.1.397 Tainted: G L syzkaller #0 PREEMPT [ 49.049797][ T5969] Tainted: [L]=SOFTLOCKUP [ 49.049800][ T5969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 49.049805][ T5969] Call trace: [ 49.049807][ T5969] show_stack+0x2c/0x3c (C) [ 49.049827][ T5969] __dump_stack+0x30/0x40 [ 49.049838][ T5969] dump_stack_lvl+0xd8/0x12c [ 49.049853][ T5969] dump_stack+0x1c/0x28 [ 49.049863][ T5969] should_fail_ex+0x41c/0x590 [ 49.049876][ T5969] should_fail+0x14/0x24 [ 49.049883][ T5969] should_fail_usercopy+0x20/0x30 [ 49.049891][ T5969] simple_read_from_buffer+0xc4/0x238 [ 49.049902][ T5969] proc_fail_nth_read+0x1a8/0x248 [ 49.049910][ T5969] vfs_read+0x230/0x8c8 [ 49.049918][ T5969] ksys_read+0x12c/0x228 [ 49.049924][ T5969] __arm64_sys_read+0x84/0x98 [ 49.049931][ T5969] invoke_syscall+0x98/0x244 [ 49.049941][ T5969] el0_svc_common+0xec/0x23c [ 49.049951][ T5969] do_el0_svc+0x4c/0x5c [ 49.049960][ T5969] el0_svc+0x64/0x260 [ 49.049970][ T5969] el0t_64_sync_handler+0x44/0x104 [ 49.049978][ T5969] el0t_64_sync+0x198/0x19c [ 49.052517][ T50] Bluetooth: hci4: command 0x0419 tx timeout [ 49.102744][ T5979] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 49.117342][ T5979] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e054c018, mo2=0002] [ 49.119013][ T5979] System zones: 0-1, 3-36 [ 49.122046][ T5979] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.152055][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.297949][ T6011] binder: 6006:6011 got transaction to invalid handle, 1 [ 49.297982][ T6011] binder: 6006:6011 cannot find target node [ 49.308815][ T6013] device-mapper: ioctl: name not supplied when creating device [ 49.463646][ T6031] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.472675][ T6048] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 49.496850][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.534718][ T6048] 9p: Bad value for 'wfdno' [ 49.550208][ T6056] device-mapper: ioctl: name not supplied when creating device [ 49.560838][ T6057] binder: 6055:6057 got transaction to invalid handle, 1 [ 49.675339][ T6076] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 49.777204][ T6048] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.777384][ T6048] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.826288][ T6081] could not allocate digest TFM handle rmd320-generic [ 49.865469][ T6092] binder: BINDER_SET_CONTEXT_MGR already set [ 49.865498][ T6092] binder: 6091:6092 ioctl 4018620d 20000040 returned -16 [ 49.966716][ T6099] set_capacity_and_notify: 5 callbacks suppressed [ 49.966755][ T6099] loop4: detected capacity change from 0 to 4096 [ 49.967989][ T6099] EXT4-fs: inline encryption not supported [ 49.971267][ T6099] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 49.971294][ T6099] EXT4-fs (loop4): Test dummy encryption mode enabled [ 49.973695][ T6099] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003] [ 49.973740][ T6099] System zones: 0-5 [ 49.974535][ T6099] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.984247][ T6099] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-ce" [ 49.997536][ T6103] loop1: detected capacity change from 0 to 2048 [ 49.999025][ T6099] fscrypt: AES-256-XTS using implementation "xts-aes-ce" [ 50.004691][ T6103] EXT4-fs (loop1): couldn't mount as ext3 due to feature incompatibilities [ 50.012084][ T6103] mmap: syz.1.442 (6103) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 50.074825][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.143551][ T6115] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 50.166808][ T6117] binder: BINDER_SET_CONTEXT_MGR already set [ 50.166837][ T6117] binder: 6116:6117 ioctl 4018620d 20000040 returned -16 [ 50.184207][ T6121] device-mapper: ioctl: name not supplied when creating device [ 50.302526][ T4709] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 50.406227][ T6141] loop3: detected capacity change from 0 to 2048 [ 50.425271][ T6141] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 50.430297][ T6142] EXT4-fs (loop3): shut down requested (1) [ 50.447169][ T6153] binder: BINDER_SET_CONTEXT_MGR already set [ 50.448515][ T6153] binder: 6152:6153 ioctl 4018620d 20000040 returned -16 [ 50.450308][ T50] Bluetooth: hci0: unexpected event for opcode 0x0000 [ 50.510059][ T4709] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.541184][ T6161] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 50.634461][ T6175] loop4: detected capacity change from 0 to 512 [ 50.636430][ T6175] EXT4-fs: Ignoring removed bh option [ 50.642518][ T6175] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 50.702830][ T6182] loop3: detected capacity change from 0 to 8 [ 50.709918][ T6182] squashfs: SQUASHFS error: Xattrs in filesystem, these will be ignored [ 50.709946][ T6182] unable to read xattr id index table [ 50.714209][ T6182] SQUASHFS error: zlib decompression failed, data probably corrupt [ 50.714238][ T6182] SQUASHFS error: Failed to read block 0x9b: -5 [ 50.714254][ T6182] SQUASHFS error: Unable to read metadata cache entry [99] [ 50.714265][ T6182] SQUASHFS error: Unable to read inode 0x127 [ 50.756510][ T6184] loop1: detected capacity change from 0 to 4096 [ 50.790127][ T6188] binder: 6186:6188 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 50.791079][ T6188] binder: 6186:6188 got transaction to invalid handle, 1 [ 51.130446][ T50] Bluetooth: hci4: command 0x0419 tx timeout [ 51.383649][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.421999][ T50] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 51.424029][ T50] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 51.425638][ T50] Bluetooth: hci2: unexpected event for opcode 0x0413 [ 51.425715][ T50] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 51.458496][ T6201] __nla_validate_parse: 4 callbacks suppressed [ 51.461868][ T6202] FAULT_INJECTION: forcing a failure. [ 51.461868][ T6202] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 51.461888][ T6202] CPU: 0 UID: 0 PID: 6202 Comm: syz.2.483 Tainted: G L syzkaller #0 PREEMPT [ 51.461901][ T6202] Tainted: [L]=SOFTLOCKUP [ 51.461905][ T6202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 51.461910][ T6202] Call trace: [ 51.461913][ T6202] show_stack+0x2c/0x3c (C) [ 51.461931][ T6202] __dump_stack+0x30/0x40 [ 51.461942][ T6202] dump_stack_lvl+0xd8/0x12c [ 51.461952][ T6202] dump_stack+0x1c/0x28 [ 51.461961][ T6202] should_fail_ex+0x41c/0x590 [ 51.461969][ T6202] should_fail+0x14/0x24 [ 51.461975][ T6202] should_fail_usercopy+0x20/0x30 [ 51.461982][ T6202] _copy_from_iter+0x188/0x1064 [ 51.461991][ T6202] netlink_sendmsg+0x570/0x948 [ 51.462001][ T6202] __sock_sendmsg+0xc8/0x17c [ 51.462011][ T6202] sock_write_iter+0x220/0x310 [ 51.462020][ T6202] vfs_write+0x51c/0xa0c [ 51.462028][ T6202] ksys_write+0x12c/0x228 [ 51.462034][ T6202] __arm64_sys_write+0x84/0x98 [ 51.462041][ T6202] invoke_syscall+0x98/0x244 [ 51.462051][ T6202] el0_svc_common+0xec/0x23c [ 51.462060][ T6202] do_el0_svc+0x4c/0x5c [ 51.462069][ T6202] el0_svc+0x64/0x260 [ 51.462079][ T6202] el0t_64_sync_handler+0x44/0x104 [ 51.462087][ T6202] el0t_64_sync+0x198/0x19c [ 51.483466][ T6201] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.482'. [ 51.547788][ T6210] loop1: detected capacity change from 0 to 256 [ 51.604081][ T6220] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 51.619514][ T6224] binder: 6223:6224 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 51.622786][ T6224] binder: 6223:6224 got transaction to invalid handle, 1 [ 51.622820][ T6224] binder_debug: 8 callbacks suppressed [ 51.622828][ T6224] binder: 6223:6224 cannot find target node [ 51.622844][ T6224] binder: 6223:6224 transaction call to 0:0 failed 68/29201/-22, code 0 size 104-24 line 3252 [ 51.623098][ T4817] binder: undelivered TRANSACTION_ERROR: 29201 [ 51.645159][ T6228] loop2: detected capacity change from 0 to 128 [ 51.647830][ T6228] vfat: Unknown parameter '0x0000000000000000' [ 51.757981][ T6239] FAULT_INJECTION: forcing a failure. [ 51.757981][ T6239] name failslab, interval 1, probability 0, space 0, times 0 [ 51.758025][ T6239] CPU: 0 UID: 0 PID: 6239 Comm: syz.4.499 Tainted: G L syzkaller #0 PREEMPT [ 51.758042][ T6239] Tainted: [L]=SOFTLOCKUP [ 51.758046][ T6239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 51.758050][ T6239] Call trace: [ 51.758053][ T6239] show_stack+0x2c/0x3c (C) [ 51.758071][ T6239] __dump_stack+0x30/0x40 [ 51.758082][ T6239] dump_stack_lvl+0xd8/0x12c [ 51.758091][ T6239] dump_stack+0x1c/0x28 [ 51.758100][ T6239] should_fail_ex+0x41c/0x590 [ 51.758109][ T6239] should_failslab+0xc4/0x120 [ 51.758117][ T6239] kmem_cache_alloc_noprof+0x94/0x5d8 [ 51.758126][ T6239] skb_clone+0x1ac/0x320 [ 51.758137][ T6239] __netlink_deliver_tap+0x364/0x6f4 [ 51.758147][ T6239] netlink_deliver_tap+0x1d8/0x1dc [ 51.758156][ T6239] netlink_unicast+0x5dc/0x7f8 [ 51.758164][ T6239] netlink_sendmsg+0x648/0x948 [ 51.758173][ T6239] __sock_sendmsg+0xc8/0x17c [ 51.758181][ T6239] sock_write_iter+0x220/0x310 [ 51.758190][ T6239] vfs_write+0x51c/0xa0c [ 51.758197][ T6239] ksys_write+0x12c/0x228 [ 51.758204][ T6239] __arm64_sys_write+0x84/0x98 [ 51.758211][ T6239] invoke_syscall+0x98/0x244 [ 51.758221][ T6239] el0_svc_common+0xec/0x23c [ 51.758230][ T6239] do_el0_svc+0x4c/0x5c [ 51.758239][ T6239] el0_svc+0x64/0x260 [ 51.758249][ T6239] el0t_64_sync_handler+0x44/0x104 [ 51.758257][ T6239] el0t_64_sync+0x198/0x19c [ 51.758280][ T6239] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.499'. [ 51.951994][ T6253] loop1: detected capacity change from 0 to 2048 [ 51.952340][ T6253] EXT4-fs: Ignoring removed i_version option [ 51.967936][ T6253] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.004508][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.088253][ T6269] binder: 6268:6269 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 52.098074][ T6269] binder: 6268:6269 got transaction to invalid handle, 1 [ 52.098104][ T6269] binder: 6268:6269 cannot find target node [ 52.098118][ T6269] binder: 6268:6269 transaction call to 0:0 failed 71/29201/-22, code 0 size 104-24 line 3252 [ 52.098287][ T4817] binder: undelivered TRANSACTION_ERROR: 29201 [ 52.165560][ T6279] binder: 6274:6279 ioctl c0306201 20000100 returned -14 [ 52.206223][ T6284] device-mapper: ioctl: populate_table: no targets specified [ 52.303189][ T6300] loop4: detected capacity change from 0 to 8 [ 52.345465][ T6305] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 52.415126][ T6312] EXT4-fs: Ignoring removed oldalloc option [ 52.415166][ T6312] ext4: Unknown parameter 'dont_appraise' [ 52.439760][ T6315] FAULT_INJECTION: forcing a failure. [ 52.439760][ T6315] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 52.439797][ T6315] CPU: 0 UID: 0 PID: 6315 Comm: syz.4.528 Tainted: G L syzkaller #0 PREEMPT [ 52.439811][ T6315] Tainted: [L]=SOFTLOCKUP [ 52.439815][ T6315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 52.439821][ T6315] Call trace: [ 52.439824][ T6315] show_stack+0x2c/0x3c (C) [ 52.439843][ T6315] __dump_stack+0x30/0x40 [ 52.439860][ T6315] dump_stack_lvl+0xd8/0x12c [ 52.439871][ T6315] dump_stack+0x1c/0x28 [ 52.439881][ T6315] should_fail_ex+0x41c/0x590 [ 52.439890][ T6315] should_fail+0x14/0x24 [ 52.439898][ T6315] should_fail_usercopy+0x20/0x30 [ 52.439905][ T6315] _inline_copy_from_user+0x3c/0x174 [ 52.439916][ T6315] copy_msghdr_from_user+0xb8/0x194 [ 52.439926][ T6315] ___sys_sendmsg+0x14c/0x224 [ 52.439936][ T6315] __sys_sendmsg+0x158/0x204 [ 52.439945][ T6315] __arm64_sys_sendmsg+0x88/0x9c [ 52.439954][ T6315] invoke_syscall+0x98/0x244 [ 52.439964][ T6315] el0_svc_common+0xec/0x23c [ 52.439974][ T6315] do_el0_svc+0x4c/0x5c [ 52.439983][ T6315] el0_svc+0x64/0x260 [ 52.439992][ T6315] el0t_64_sync_handler+0x44/0x104 [ 52.440001][ T6315] el0t_64_sync+0x198/0x19c [ 52.440395][ T6312] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 52.481916][ T6318] device-mapper: ioctl: populate_table: no targets specified [ 52.575978][ T6331] EXT4-fs (loop3): can't mount with data_err=abort, fs mounted w/o journal [ 52.578318][ T6330] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.535'. [ 52.582590][ T6330] FAULT_INJECTION: forcing a failure. [ 52.582590][ T6330] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 52.585554][ T6330] CPU: 1 UID: 0 PID: 6330 Comm: syz.2.535 Tainted: G L syzkaller #0 PREEMPT [ 52.585575][ T6330] Tainted: [L]=SOFTLOCKUP [ 52.585579][ T6330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 52.585585][ T6330] Call trace: [ 52.585588][ T6330] show_stack+0x2c/0x3c (C) [ 52.585613][ T6330] __dump_stack+0x30/0x40 [ 52.585624][ T6330] dump_stack_lvl+0xd8/0x12c [ 52.585635][ T6330] dump_stack+0x1c/0x28 [ 52.585644][ T6330] should_fail_ex+0x41c/0x590 [ 52.585653][ T6330] should_fail+0x14/0x24 [ 52.585659][ T6330] should_fail_usercopy+0x20/0x30 [ 52.585666][ T6330] simple_read_from_buffer+0xc4/0x238 [ 52.585677][ T6330] proc_fail_nth_read+0x1a8/0x248 [ 52.585685][ T6330] vfs_read+0x230/0x8c8 [ 52.585692][ T6330] ksys_read+0x12c/0x228 [ 52.585699][ T6330] __arm64_sys_read+0x84/0x98 [ 52.585706][ T6330] invoke_syscall+0x98/0x244 [ 52.585716][ T6330] el0_svc_common+0xec/0x23c [ 52.585725][ T6330] do_el0_svc+0x4c/0x5c [ 52.585737][ T6330] el0_svc+0x64/0x260 [ 52.585747][ T6330] el0t_64_sync_handler+0x44/0x104 [ 52.585756][ T6330] el0t_64_sync+0x198/0x19c [ 52.989294][ T6356] EXT4-fs: Ignoring removed bh option [ 52.993129][ T6356] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 52.993155][ T6356] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 52.999121][ T6356] EXT4-fs (loop3): warning: mounting unchecked fs, running e2fsck is recommended [ 52.999696][ T6356] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 53.000263][ T6356] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 53.012391][ T6356] overlayfs: failed to resolve './file1': -2 [ 53.028843][ T4709] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.455868][ T6368] EXT4-fs: inline encryption not supported [ 53.462557][ T6368] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 53.468260][ T6368] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=8842c019, mo2=0003] [ 53.472185][ T6368] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 53.479506][ T6368] EXT4-fs (loop4): shut down requested (2) [ 53.492278][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.610449][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 53.758415][ T6384] netlink: 8 bytes leftover after parsing attributes in process `syz.4.554'. [ 53.762150][ T6384] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 53.765122][ T6384] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 53.765176][ T6384] System zones: 1-12 [ 53.766840][ T6384] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 207 vs 220 free clusters [ 53.768153][ T6384] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2860: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 53.768491][ T6384] EXT4-fs (loop4): 1 truncate cleaned up [ 53.771250][ T6384] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 53.789898][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.811517][ T6396] binder: 6393:6396 tried to acquire reference to desc 0, got 1 instead [ 53.812095][ T6391] ext4: Unknown parameter 'uid' [ 53.812822][ T6396] binder: 6393:6396 got transaction with out-of-order buffer fixup [ 53.812833][ T6396] binder: 6396:6393 failed to fixup parent [ 53.812875][ T6396] binder: 6393:6396 transaction call to 6393:0 failed 76/29201/-22, code 0 size 104-24 line 3717 [ 53.813171][ T4795] binder: undelivered TRANSACTION_ERROR: 29201 [ 53.875419][ T6401] EXT4-fs: Ignoring removed bh option [ 53.878238][ T6401] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 53.878251][ T6401] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 53.910831][ T6401] EXT4-fs (loop1): warning: mounting unchecked fs, running e2fsck is recommended [ 53.911029][ T6401] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 53.911565][ T6401] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 53.919369][ T6401] overlayfs: failed to resolve './file1': -2 [ 53.975428][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 54.002676][ T6417] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 54.137569][ T6430] binder: 6429:6430 tried to acquire reference to desc 0, got 1 instead [ 54.141101][ T6430] binder: 6429:6430 got transaction with invalid fd, -1 [ 54.141132][ T6430] binder: 6430:6429 translate fd failed [ 54.312770][ T6442] EXT4-fs: Ignoring removed bh option [ 54.315644][ T6442] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 54.315671][ T6442] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 54.327303][ T6442] EXT4-fs (loop4): warning: mounting unchecked fs, running e2fsck is recommended [ 54.329623][ T6442] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 54.330208][ T6442] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 54.370212][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 54.565267][ T6455] EXT4-fs (loop4): orphan cleanup on readonly fs [ 54.565299][ T6455] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -13 [ 54.572496][ T6455] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 54.580873][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 54.580898][ C1] EXT4-fs (loop4): initial error at time 54: ext4_mb_generate_buddy:1317 [ 54.580926][ C1] EXT4-fs (loop4): last error at time 54: ext4_mb_generate_buddy:1317 [ 54.587999][ T6455] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #13: comm syz.4.581: attempt to clear invalid blocks 2 len 1 [ 54.588040][ T6455] loop4: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 54.591013][ T6455] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #13: comm syz.4.581: invalid indirect mapped block 1819239214 (level 0) [ 54.591048][ T6455] loop4: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 54.596373][ T6455] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #13: comm syz.4.581: invalid indirect mapped block 1819239214 (level 1) [ 54.596411][ T6455] loop4: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 54.601949][ T6455] EXT4-fs (loop4): 1 truncate cleaned up [ 54.602426][ T6455] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 54.650706][ T6455] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 54.827935][ T6455] EXT4-fs error (device loop4): __ext4_remount:6844: comm syz.4.581: Abort forced by user [ 54.831212][ T6455] EXT4-fs (loop4): Remounting filesystem read-only [ 54.831242][ T6455] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 54.859259][ T4719] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 54.900541][ T6463] binder: 6462:6463 tried to acquire reference to desc 0, got 1 instead [ 54.902502][ T6463] binder: 6462:6463 got transaction with invalid fd, -1 [ 55.124810][ T6483] set_capacity_and_notify: 10 callbacks suppressed [ 55.129849][ T6483] loop1: detected capacity change from 0 to 512 [ 55.141868][ T6485] loop2: detected capacity change from 0 to 512 [ 55.145360][ T6485] EXT4-fs: Ignoring removed i_version option [ 55.145413][ T6485] EXT4-fs: Ignoring removed bh option [ 55.169247][ T6485] EXT4-fs error (device loop2): ext4_orphan_get:1399: comm syz.2.591: inode #13: comm syz.2.591: iget: illegal inode # [ 55.169292][ T6485] loop2: lost filesystem error report for type 5 error -117 [ 55.170109][ T6485] EXT4-fs (loop2): Remounting filesystem read-only [ 55.185829][ T6485] EXT4-fs (loop2): shut down requested (2) [ 55.248605][ T6496] loop1: detected capacity change from 0 to 512 [ 55.250312][ T6496] EXT4-fs: Ignoring removed nobh option [ 55.298807][ T6496] EXT4-fs error (device loop1): ext4_find_dest_de:2050: inode #2: block 3: comm syz.1.593: bad entry in directory: inode out of bounds - offset=92, inode=117440528, rec_len=16, size=2048 fake=0 [ 55.963011][ T6526] FAULT_INJECTION: forcing a failure. [ 55.963011][ T6526] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 55.963050][ T6526] CPU: 0 UID: 0 PID: 6526 Comm: syz.0.603 Tainted: G L syzkaller #0 PREEMPT [ 55.963067][ T6526] Tainted: [L]=SOFTLOCKUP [ 55.963071][ T6526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 55.963076][ T6526] Call trace: [ 55.963080][ T6526] show_stack+0x2c/0x3c (C) [ 55.963098][ T6526] __dump_stack+0x30/0x40 [ 55.963109][ T6526] dump_stack_lvl+0xd8/0x12c [ 55.963119][ T6526] dump_stack+0x1c/0x28 [ 55.963128][ T6526] should_fail_ex+0x41c/0x590 [ 55.963136][ T6526] should_fail+0x14/0x24 [ 55.963142][ T6526] should_fail_usercopy+0x20/0x30 [ 55.963149][ T6526] _inline_copy_from_user+0x3c/0x174 [ 55.963161][ T6526] move_addr_to_kernel+0x88/0x168 [ 55.963169][ T6526] __sys_sendto+0x1b0/0x328 [ 55.963178][ T6526] __arm64_sys_sendto+0xec/0x10c [ 55.963187][ T6526] invoke_syscall+0x98/0x244 [ 55.963197][ T6526] el0_svc_common+0xec/0x23c [ 55.963206][ T6526] do_el0_svc+0x4c/0x5c [ 55.963216][ T6526] el0_svc+0x64/0x260 [ 55.963225][ T6526] el0t_64_sync_handler+0x44/0x104 [ 55.963233][ T6526] el0t_64_sync+0x198/0x19c [ 56.018252][ T6532] loop4: detected capacity change from 0 to 512 [ 56.024155][ T6532] EXT4-fs: Ignoring removed i_version option [ 56.024197][ T6532] EXT4-fs: Ignoring removed bh option [ 56.029910][ T6532] EXT4-fs error (device loop4): ext4_orphan_get:1399: comm syz.4.606: inode #13: comm syz.4.606: iget: illegal inode # [ 56.029944][ T6532] loop4: lost filesystem error report for type 5 error -117 [ 56.032776][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 56.032788][ C0] EXT4-fs (loop4): initial error at time 56: ext4_orphan_get:1399 [ 56.032803][ C0] EXT4-fs (loop4): last error at time 56: ext4_orphan_get:1399 [ 56.041558][ T6532] EXT4-fs (loop4): Remounting filesystem read-only [ 56.049531][ T6532] EXT4-fs (loop4): shut down requested (2) [ 56.083016][ T6535] FAULT_INJECTION: forcing a failure. [ 56.083016][ T6535] name failslab, interval 1, probability 0, space 0, times 0 [ 56.085469][ T6535] CPU: 0 UID: 0 PID: 6535 Comm: syz.0.607 Tainted: G L syzkaller #0 PREEMPT [ 56.085494][ T6535] Tainted: [L]=SOFTLOCKUP [ 56.085500][ T6535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 56.085506][ T6535] Call trace: [ 56.085510][ T6535] show_stack+0x2c/0x3c (C) [ 56.085528][ T6535] __dump_stack+0x30/0x40 [ 56.085539][ T6535] dump_stack_lvl+0xd8/0x12c [ 56.085548][ T6535] dump_stack+0x1c/0x28 [ 56.085558][ T6535] should_fail_ex+0x41c/0x590 [ 56.085566][ T6535] should_failslab+0xc4/0x120 [ 56.085574][ T6535] kmem_cache_alloc_noprof+0x94/0x5d8 [ 56.085583][ T6535] dst_alloc+0xf4/0x15c [ 56.085592][ T6535] xfrm_alloc_dst+0x7c/0x160 [ 56.085603][ T6535] xfrm_lookup_with_ifid+0x704/0x19e4 [ 56.085612][ T6535] xfrm_lookup_route+0x4c/0x1cc [ 56.085621][ T6535] ip_route_output_flow+0xd4/0x158 [ 56.085632][ T6535] udp_sendmsg+0xf5c/0x1bd4 [ 56.085640][ T6535] inet_sendmsg+0xb4/0xd8 [ 56.085648][ T6535] __sock_sendmsg+0xc8/0x17c [ 56.085657][ T6535] ____sys_sendmsg+0x3f8/0x6c8 [ 56.085666][ T6535] ___sys_sendmsg+0x198/0x224 [ 56.085675][ T6535] __sys_sendmmsg+0x204/0x580 [ 56.085684][ T6535] __arm64_sys_sendmmsg+0xac/0xc8 [ 56.085693][ T6535] invoke_syscall+0x98/0x244 [ 56.085703][ T6535] el0_svc_common+0xec/0x23c [ 56.085713][ T6535] do_el0_svc+0x4c/0x5c [ 56.085722][ T6535] el0_svc+0x64/0x260 [ 56.085731][ T6535] el0t_64_sync_handler+0x44/0x104 [ 56.085739][ T6535] el0t_64_sync+0x198/0x19c [ 56.124391][ T6537] loop3: detected capacity change from 0 to 256 [ 56.138245][ T6538] netlink: 4 bytes leftover after parsing attributes in process `syz.3.608'. [ 56.144410][ T6538] netlink: 24 bytes leftover after parsing attributes in process `syz.3.608'. [ 56.152220][ T6537] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 56.235701][ T6551] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 56.278608][ T6561] loop4: detected capacity change from 0 to 512 [ 56.287090][ T6550] loop1: detected capacity change from 0 to 4096 [ 56.309285][ T6561] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 56.314470][ T6561] EXT4-fs (loop4): 1 truncate cleaned up [ 56.318166][ T6551] tmpfs: Bad value for 'mpol' [ 56.656341][ T6579] netlink: 28 bytes leftover after parsing attributes in process `syz.4.618'. [ 56.707874][ T6538] IPVS: Error connecting to the multicast addr [ 56.769064][ T6582] binder: 6581:6582 tried to acquire reference to desc 0, got 1 instead [ 56.769344][ T6582] binder: 6581:6582 got transaction with out-of-order buffer fixup [ 56.769367][ T6582] binder_debug: 5 callbacks suppressed [ 56.769379][ T6582] binder: 6582:6581 failed to fixup parent [ 56.769446][ T6582] binder: 6581:6582 transaction call to 6581:0 failed 91/29201/-22, code 0 size 120-24 line 3717 [ 56.796809][ T6582] loop3: detected capacity change from 0 to 8192 [ 56.813993][ T6582] syz.3.619: attempt to access beyond end of device [ 56.813993][ T6582] loop3: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 56.814088][ T6582] Buffer I/O error on dev loop3, logical block 57847, async page read [ 56.816843][ T6582] syz.3.619: attempt to access beyond end of device [ 56.816843][ T6582] loop3: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 56.816870][ T6582] Buffer I/O error on dev loop3, logical block 57847, async page read [ 56.829704][ T4472] binder: undelivered TRANSACTION_ERROR: 29201 [ 56.932767][ T6600] syzkaller0: entered promiscuous mode [ 56.933958][ T6600] syzkaller0: entered allmulticast mode [ 57.005981][ T6615] loop0: detected capacity change from 0 to 256 [ 57.006402][ T6615] vfat: Bad value for 'allow_utime' [ 57.028663][ T6614] netlink: 28 bytes leftover after parsing attributes in process `syz.4.633'. [ 57.075235][ T6625] loop2: detected capacity change from 0 to 8 [ 57.075916][ T6625] squashfs: SQUASHFS error: Xattrs in filesystem, these will be ignored [ 57.075923][ T6625] unable to read xattr id index table [ 57.076215][ T6625] SQUASHFS error: zlib decompression failed, data probably corrupt [ 57.076226][ T6625] SQUASHFS error: Failed to read block 0x9b: -5 [ 57.076232][ T6625] SQUASHFS error: Unable to read metadata cache entry [99] [ 57.076238][ T6625] SQUASHFS error: Unable to read inode 0x127 [ 57.088608][ T6625] netlink: 'syz.2.637': attribute type 21 has an invalid length. [ 57.092810][ T6629] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 57.110226][ T6632] FAULT_INJECTION: forcing a failure. [ 57.110226][ T6632] name failslab, interval 1, probability 0, space 0, times 0 [ 57.110263][ T6632] CPU: 1 UID: 0 PID: 6632 Comm: syz.0.639 Tainted: G L syzkaller #0 PREEMPT [ 57.110279][ T6632] Tainted: [L]=SOFTLOCKUP [ 57.110282][ T6632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 57.110287][ T6632] Call trace: [ 57.110290][ T6632] show_stack+0x2c/0x3c (C) [ 57.110308][ T6632] __dump_stack+0x30/0x40 [ 57.110318][ T6632] dump_stack_lvl+0xd8/0x12c [ 57.110328][ T6632] dump_stack+0x1c/0x28 [ 57.110337][ T6632] should_fail_ex+0x41c/0x590 [ 57.110345][ T6632] should_failslab+0xc4/0x120 [ 57.110356][ T6632] __kmalloc_noprof+0x108/0x6b8 [ 57.110366][ T6632] hash_netportnet4_add+0x1260/0x27e8 [ 57.110376][ T6632] hash_netportnet4_uadt+0x6e4/0xfb8 [ 57.110383][ T6632] call_ad+0x1e0/0x764 [ 57.110391][ T6632] ip_set_ad+0x670/0x7c0 [ 57.110398][ T6632] ip_set_uadd+0x74/0x8c [ 57.110405][ T6632] nfnetlink_rcv_msg+0xad8/0x1044 [ 57.110413][ T6632] netlink_rcv_skb+0x238/0x414 [ 57.110422][ T6632] nfnetlink_rcv+0x218/0x16ec [ 57.110429][ T6632] netlink_unicast+0x600/0x7f8 [ 57.110437][ T6632] netlink_sendmsg+0x648/0x948 [ 57.110446][ T6632] __sock_sendmsg+0xc8/0x17c [ 57.110455][ T6632] ____sys_sendmsg+0x3d0/0x6c8 [ 57.110464][ T6632] ___sys_sendmsg+0x198/0x224 [ 57.110473][ T6632] __sys_sendmsg+0x158/0x204 [ 57.110482][ T6632] __arm64_sys_sendmsg+0x88/0x9c [ 57.110491][ T6632] invoke_syscall+0x98/0x244 [ 57.110501][ T6632] el0_svc_common+0xec/0x23c [ 57.110511][ T6632] do_el0_svc+0x4c/0x5c [ 57.110520][ T6632] el0_svc+0x64/0x260 [ 57.110529][ T6632] el0t_64_sync_handler+0x44/0x104 [ 57.110538][ T6632] el0t_64_sync+0x198/0x19c [ 57.209597][ T6638] trusted_key: encrypted_key: master key parameter '' is invalid [ 57.249344][ T6645] netlink: 8 bytes leftover after parsing attributes in process `syz.2.641'. [ 57.249382][ T6645] netlink: 8 bytes leftover after parsing attributes in process `syz.2.641'. [ 57.273352][ T6650] syzkaller0: entered promiscuous mode [ 57.273388][ T6650] syzkaller0: entered allmulticast mode [ 57.322983][ T6653] netlink: 176 bytes leftover after parsing attributes in process `syz.4.644'. [ 57.378023][ T6665] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.645'. [ 57.378196][ T6649] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.645'. [ 57.378324][ T6661] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.645'. [ 57.385747][ T6667] FAULT_INJECTION: forcing a failure. [ 57.385747][ T6667] name failslab, interval 1, probability 0, space 0, times 0 [ 57.388489][ T6667] CPU: 1 UID: 0 PID: 6667 Comm: syz.2.648 Tainted: G L syzkaller #0 PREEMPT [ 57.388512][ T6667] Tainted: [L]=SOFTLOCKUP [ 57.388516][ T6667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 57.388521][ T6667] Call trace: [ 57.388525][ T6667] show_stack+0x2c/0x3c (C) [ 57.388549][ T6667] __dump_stack+0x30/0x40 [ 57.388561][ T6667] dump_stack_lvl+0xd8/0x12c [ 57.388571][ T6667] dump_stack+0x1c/0x28 [ 57.388581][ T6667] should_fail_ex+0x41c/0x590 [ 57.388589][ T6667] should_failslab+0xc4/0x120 [ 57.388598][ T6667] __kvmalloc_node_noprof+0x160/0x7d8 [ 57.388607][ T6667] traverse+0xe4/0x4a4 [ 57.388614][ T6667] seq_read_iter+0xb00/0xbe8 [ 57.388621][ T6667] kernfs_fop_read_iter+0x13c/0x414 [ 57.388630][ T6667] do_iter_readv_writev+0x48c/0x6f8 [ 57.388638][ T6667] vfs_readv+0x21c/0x520 [ 57.388645][ T6667] do_preadv+0x11c/0x224 [ 57.388652][ T6667] __arm64_sys_preadv2+0xe4/0x118 [ 57.388659][ T6667] invoke_syscall+0x98/0x244 [ 57.388669][ T6667] el0_svc_common+0xec/0x23c [ 57.388679][ T6667] do_el0_svc+0x4c/0x5c [ 57.388688][ T6667] el0_svc+0x64/0x260 [ 57.388698][ T6667] el0t_64_sync_handler+0x44/0x104 [ 57.388706][ T6667] el0t_64_sync+0x198/0x19c [ 57.809027][ T6702] EXT4-fs: inline encryption not supported [ 57.813265][ T6702] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 57.816150][ T6702] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=8842c019, mo2=0003] [ 57.824539][ T6702] EXT4-fs (loop0): shut down requested (2) [ 57.859024][ T6709] FAULT_INJECTION: forcing a failure. [ 57.859024][ T6709] name failslab, interval 1, probability 0, space 0, times 0 [ 57.862572][ T6709] CPU: 1 UID: 0 PID: 6709 Comm: syz.2.660 Tainted: G L syzkaller #0 PREEMPT [ 57.862597][ T6709] Tainted: [L]=SOFTLOCKUP [ 57.862601][ T6709] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 57.862606][ T6709] Call trace: [ 57.862610][ T6709] show_stack+0x2c/0x3c (C) [ 57.862635][ T6709] __dump_stack+0x30/0x40 [ 57.862647][ T6709] dump_stack_lvl+0xd8/0x12c [ 57.862657][ T6709] dump_stack+0x1c/0x28 [ 57.862667][ T6709] should_fail_ex+0x41c/0x590 [ 57.862675][ T6709] should_failslab+0xc4/0x120 [ 57.862683][ T6709] __kmalloc_noprof+0x108/0x6b8 [ 57.862692][ T6709] tomoyo_realpath_from_path+0xbc/0x4dc [ 57.862702][ T6709] tomoyo_path_number_perm+0x1f0/0x500 [ 57.862709][ T6709] tomoyo_file_ioctl+0x2c/0x3c [ 57.862718][ T6709] security_file_ioctl+0xdc/0x2b0 [ 57.862726][ T6709] __arm64_sys_ioctl+0xb0/0x1cc [ 57.862736][ T6709] invoke_syscall+0x98/0x244 [ 57.862746][ T6709] el0_svc_common+0xec/0x23c [ 57.862756][ T6709] do_el0_svc+0x4c/0x5c [ 57.862765][ T6709] el0_svc+0x64/0x260 [ 57.862775][ T6709] el0t_64_sync_handler+0x44/0x104 [ 57.862783][ T6709] el0t_64_sync+0x198/0x19c [ 57.868715][ T6713] EXT4-fs (loop0): failed to initialize system zone (-117) [ 57.868769][ T6713] EXT4-fs (loop0): mount failed [ 57.875744][ T6712] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 57.885958][ T6709] ERROR: Out of memory at tomoyo_realpath_from_path. [ 57.976764][ T6722] overlayfs: failed to resolve './bus': -2 [ 57.978140][ T6722] EXT4-fs error (device loop3): ext4_lookup:1785: inode #14: comm syz.3.662: invalid fast symlink length 39 [ 58.013315][ T6727] syzkaller0: entered promiscuous mode [ 58.013344][ T6727] syzkaller0: entered allmulticast mode [ 58.024919][ T6728] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.661'. [ 58.027088][ T6720] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.661'. [ 58.146633][ T6739] EXT4-fs error (device loop2): ext4_lookup:1785: inode #12: comm syz.2.667: iget: bad i_size value: 2533274857506816 [ 58.150569][ T6739] EXT4-fs (loop2): Remounting filesystem read-only [ 58.217293][ T6755] binder: 6753:6755 tried to acquire reference to desc 0, got 1 instead [ 58.217531][ T6755] binder: 6753:6755 got transaction with invalid fd, -1 [ 58.217541][ T6755] binder: 6755:6753 translate fd failed [ 58.217570][ T6755] binder: 6753:6755 transaction call to 6753:0 failed 96/29201/-9, code 0 size 104-24 line 3593 [ 58.217797][ T4817] binder: undelivered TRANSACTION_ERROR: 29201 [ 58.337688][ T6768] EXT4-fs error (device loop3): ext4_iget_extra_inode:5180: inode #15: comm syz.3.675: corrupted in-inode xattr: invalid ea_ino [ 58.337723][ T6768] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 58.337886][ T6768] EXT4-fs error (device loop3): ext4_orphan_get:1404: comm syz.3.675: couldn't read orphan inode 15 (err -117) [ 58.337902][ T6768] loop3: lost filesystem error report for type 5 error -117 [ 58.349189][ T6767] EXT4-fs (loop1): Test dummy encryption mode enabled [ 58.527221][ T6785] Soft offlining pfn 0x16399d at process virtual address 0x20fff000 [ 58.535385][ T6783] syzkaller0: entered promiscuous mode [ 58.535752][ T6783] syzkaller0: entered allmulticast mode [ 58.850718][ T6797] FAULT_INJECTION: forcing a failure. [ 58.850718][ T6797] name failslab, interval 1, probability 0, space 0, times 0 [ 58.850753][ T6797] CPU: 0 UID: 0 PID: 6797 Comm: syz.4.684 Tainted: G L syzkaller #0 PREEMPT [ 58.850768][ T6797] Tainted: [L]=SOFTLOCKUP [ 58.850772][ T6797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 58.850778][ T6797] Call trace: [ 58.850782][ T6797] show_stack+0x2c/0x3c (C) [ 58.850802][ T6797] __dump_stack+0x30/0x40 [ 58.850813][ T6797] dump_stack_lvl+0xd8/0x12c [ 58.850823][ T6797] dump_stack+0x1c/0x28 [ 58.850833][ T6797] should_fail_ex+0x41c/0x590 [ 58.850841][ T6797] should_failslab+0xc4/0x120 [ 58.850856][ T6797] __kmalloc_noprof+0x108/0x6b8 [ 58.850866][ T6797] tomoyo_encode2+0x10c/0x330 [ 58.850875][ T6797] tomoyo_encode+0x34/0x50 [ 58.850883][ T6797] tomoyo_realpath_from_path+0x488/0x4dc [ 58.850892][ T6797] tomoyo_path_number_perm+0x1f0/0x500 [ 58.850899][ T6797] tomoyo_file_ioctl+0x2c/0x3c [ 58.850908][ T6797] security_file_ioctl+0xdc/0x2b0 [ 58.850916][ T6797] __arm64_sys_ioctl+0xb0/0x1cc [ 58.850926][ T6797] invoke_syscall+0x98/0x244 [ 58.850936][ T6797] el0_svc_common+0xec/0x23c [ 58.850946][ T6797] do_el0_svc+0x4c/0x5c [ 58.850955][ T6797] el0_svc+0x64/0x260 [ 58.850964][ T6797] el0t_64_sync_handler+0x44/0x104 [ 58.850973][ T6797] el0t_64_sync+0x198/0x19c [ 58.850996][ T6797] ERROR: Out of memory at tomoyo_realpath_from_path. [ 58.881434][ T6802] binder: 6801:6802 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 58.882242][ T6802] binder: 6801:6802 got transaction to invalid handle, 1 [ 58.882253][ T6802] binder: 6801:6802 cannot find target node [ 58.882265][ T6802] binder: 6801:6802 transaction call to 0:0 failed 98/29201/-22, code 0 size 104-24 line 3252 [ 58.882547][ T4817] binder: undelivered TRANSACTION_ERROR: 29201 [ 58.897919][ T6804] FAULT_INJECTION: forcing a failure. [ 58.897919][ T6804] name fail_futex, interval 1, probability 0, space 0, times 0 [ 58.897949][ T6804] CPU: 0 UID: 0 PID: 6804 Comm: syz.0.686 Tainted: G L syzkaller #0 PREEMPT [ 58.897965][ T6804] Tainted: [L]=SOFTLOCKUP [ 58.897970][ T6804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 58.897976][ T6804] Call trace: [ 58.897979][ T6804] show_stack+0x2c/0x3c (C) [ 58.897999][ T6804] __dump_stack+0x30/0x40 [ 58.898011][ T6804] dump_stack_lvl+0xd8/0x12c [ 58.898023][ T6804] dump_stack+0x1c/0x28 [ 58.898035][ T6804] should_fail_ex+0x41c/0x590 [ 58.898043][ T6804] should_fail+0x14/0x24 [ 58.898051][ T6804] get_futex_key+0x1ec/0x12b0 [ 58.898061][ T6804] futex_wake+0x10c/0x594 [ 58.898071][ T6804] do_futex+0x2c4/0x378 [ 58.898080][ T6804] __arm64_sys_futex+0x2e4/0x418 [ 58.898090][ T6804] invoke_syscall+0x98/0x244 [ 58.898102][ T6804] el0_svc_common+0xec/0x23c [ 58.898114][ T6804] do_el0_svc+0x4c/0x5c [ 58.898126][ T6804] el0_svc+0x64/0x260 [ 58.898136][ T6804] el0t_64_sync_handler+0x44/0x104 [ 58.898146][ T6804] el0t_64_sync+0x198/0x19c [ 59.720138][ T6878] FAULT_INJECTION: forcing a failure. [ 59.720138][ T6878] name failslab, interval 1, probability 0, space 0, times 0 [ 59.720172][ T6878] CPU: 0 UID: 0 PID: 6878 Comm: syz.3.715 Tainted: G L syzkaller #0 PREEMPT [ 59.720188][ T6878] Tainted: [L]=SOFTLOCKUP [ 59.720192][ T6878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 59.720198][ T6878] Call trace: [ 59.720202][ T6878] show_stack+0x2c/0x3c (C) [ 59.720219][ T6878] __dump_stack+0x30/0x40 [ 59.720231][ T6878] dump_stack_lvl+0xd8/0x12c [ 59.720241][ T6878] dump_stack+0x1c/0x28 [ 59.720250][ T6878] should_fail_ex+0x41c/0x590 [ 59.720258][ T6878] should_failslab+0xc4/0x120 [ 59.720267][ T6878] __kmalloc_noprof+0x108/0x6b8 [ 59.720275][ T6878] tomoyo_encode2+0x10c/0x330 [ 59.720284][ T6878] tomoyo_encode+0x34/0x50 [ 59.720292][ T6878] tomoyo_realpath_from_path+0x488/0x4dc [ 59.720300][ T6878] tomoyo_path_number_perm+0x1f0/0x500 [ 59.720308][ T6878] tomoyo_file_ioctl+0x2c/0x3c [ 59.720316][ T6878] security_file_ioctl+0xdc/0x2b0 [ 59.720324][ T6878] __arm64_sys_ioctl+0xb0/0x1cc [ 59.720335][ T6878] invoke_syscall+0x98/0x244 [ 59.720344][ T6878] el0_svc_common+0xec/0x23c [ 59.720357][ T6878] do_el0_svc+0x4c/0x5c [ 59.720368][ T6878] el0_svc+0x64/0x260 [ 59.720378][ T6878] el0t_64_sync_handler+0x44/0x104 [ 59.720386][ T6878] el0t_64_sync+0x198/0x19c [ 59.722577][ T6878] ERROR: Out of memory at tomoyo_realpath_from_path. [ 59.794167][ T6886] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 59.914223][ T6892] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.009803][ T6915] tap0: tun_chr_ioctl cmd 1074025677 [ 60.015150][ T6915] tap0: linktype set to 769 [ 60.142352][ T6918] FAULT_INJECTION: forcing a failure. [ 60.142352][ T6918] name failslab, interval 1, probability 0, space 0, times 0 [ 60.142395][ T6918] CPU: 0 UID: 0 PID: 6918 Comm: syz.3.728 Tainted: G L syzkaller #0 PREEMPT [ 60.142417][ T6918] Tainted: [L]=SOFTLOCKUP [ 60.142422][ T6918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 60.142428][ T6918] Call trace: [ 60.142432][ T6918] show_stack+0x2c/0x3c (C) [ 60.142452][ T6918] __dump_stack+0x30/0x40 [ 60.142465][ T6918] dump_stack_lvl+0xd8/0x12c [ 60.142477][ T6918] dump_stack+0x1c/0x28 [ 60.142488][ T6918] should_fail_ex+0x41c/0x590 [ 60.142497][ T6918] should_failslab+0xc4/0x120 [ 60.142507][ T6918] __kmalloc_node_track_caller_noprof+0x108/0x6d4 [ 60.142519][ T6918] kmemdup_noprof+0x44/0x8c [ 60.142529][ T6918] key_alloc+0x2b4/0xd30 [ 60.142541][ T6918] keyring_alloc+0x68/0xe0 [ 60.142552][ T6918] install_session_keyring_to_cred+0xfc/0x1e4 [ 60.142562][ T6918] join_session_keyring+0xac/0x2d0 [ 60.142571][ T6918] lookup_user_key+0x338/0xd4c [ 60.142580][ T6918] __arm64_sys_add_key+0x34c/0x43c [ 60.142588][ T6918] invoke_syscall+0x98/0x244 [ 60.142600][ T6918] el0_svc_common+0xec/0x23c [ 60.142612][ T6918] do_el0_svc+0x4c/0x5c [ 60.142623][ T6918] el0_svc+0x64/0x260 [ 60.142634][ T6918] el0t_64_sync_handler+0x44/0x104 [ 60.142644][ T6918] el0t_64_sync+0x198/0x19c [ 60.317510][ T6938] netlink: zone id is out of range [ 60.317535][ T6938] netlink: zone id is out of range [ 60.318837][ T6938] netlink: zone id is out of range [ 60.318866][ T6938] netlink: zone id is out of range [ 60.318886][ T6938] netlink: zone id is out of range [ 60.318893][ T6938] netlink: zone id is out of range [ 60.318898][ T6938] netlink: zone id is out of range [ 60.318903][ T6938] netlink: zone id is out of range [ 60.318909][ T6938] netlink: zone id is out of range [ 60.318914][ T6938] netlink: zone id is out of range [ 60.322874][ T6939] set_capacity_and_notify: 8 callbacks suppressed [ 60.322883][ T6939] loop3: detected capacity change from 0 to 512 [ 60.323168][ T6939] EXT4-fs: Ignoring removed nomblk_io_submit option [ 60.323193][ T6939] ext4: Unknown parameter 'lazytime2' [ 60.346805][ T6942] loop3: detected capacity change from 0 to 512 [ 60.353149][ T6942] EXT4-fs error (device loop3): ext4_expand_extra_isize_ea:2810: inode #11: comm syz.3.738: corrupted xattr block 95: invalid header [ 60.353188][ T6942] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 60.353667][ T6942] EXT4-fs (loop3): Remounting filesystem read-only [ 60.353678][ T6942] EXT4-fs warning (device loop3): ext4_evict_inode:270: couldn't mark inode dirty (err -30) [ 60.353715][ T6942] EXT4-fs (loop3): 1 orphan inode deleted [ 60.724968][ T6947] geneve2: entered promiscuous mode [ 60.780591][ T6965] syzkaller0: entered promiscuous mode [ 60.781802][ T6965] syzkaller0: entered allmulticast mode [ 60.848551][ T6967] binder: 6963:6967 ioctl 4018620d 0 returned -22 [ 60.848844][ T6967] binder: 6963:6967 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 60.857458][ T6967] binder: 6963:6967 got transaction to invalid handle, 1 [ 60.857486][ T6967] binder: 6963:6967 cannot find target node [ 61.201481][ T6981] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 61.319830][ T6991] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 61.327377][ T6989] loop4: detected capacity change from 0 to 4096 [ 61.333511][ T6989] EXT4-fs: inline encryption not supported [ 61.343531][ T6989] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 61.343559][ T6989] EXT4-fs (loop4): Test dummy encryption mode enabled [ 61.352156][ T6989] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a80ec128, mo2=0003] [ 61.352228][ T6989] System zones: 0-5 [ 61.382178][ T6996] capability: warning: `syz.3.752' uses 32-bit capabilities (legacy support in use) [ 61.535022][ T7021] loop2: detected capacity change from 0 to 512 [ 61.555395][ T7021] EXT4-fs error (device loop2): ext4_orphan_get:1399: inode #15: comm syz.2.760: iget: bad i_size value: -1099511627766 [ 61.555424][ T7021] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 61.558029][ T7021] EXT4-fs error (device loop2): ext4_orphan_get:1404: comm syz.2.760: couldn't read orphan inode 15 (err -117) [ 61.558065][ T7021] loop2: lost filesystem error report for type 5 error -117 [ 61.562574][ C0] EXT4-fs (loop2): error count since last fsck: 2 [ 61.562589][ C0] EXT4-fs (loop2): initial error at time 61: ext4_orphan_get:1399: inode 15 [ 61.562604][ C0] EXT4-fs (loop2): last error at time 61: ext4_orphan_get:1404 [ 61.952081][ T7039] FAULT_INJECTION: forcing a failure. [ 61.952081][ T7039] name failslab, interval 1, probability 0, space 0, times 0 [ 61.954700][ T7039] CPU: 1 UID: 0 PID: 7039 Comm: syz.2.763 Tainted: G L syzkaller #0 PREEMPT [ 61.954724][ T7039] Tainted: [L]=SOFTLOCKUP [ 61.954728][ T7039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 61.954734][ T7039] Call trace: [ 61.954738][ T7039] show_stack+0x2c/0x3c (C) [ 61.954763][ T7039] __dump_stack+0x30/0x40 [ 61.954777][ T7039] dump_stack_lvl+0xd8/0x12c [ 61.954789][ T7039] dump_stack+0x1c/0x28 [ 61.954801][ T7039] should_fail_ex+0x41c/0x590 [ 61.954810][ T7039] should_failslab+0xc4/0x120 [ 61.954819][ T7039] __kmalloc_cache_noprof+0x94/0x5ec [ 61.954830][ T7039] file_f_owner_allocate+0x80/0x144 [ 61.954843][ T7039] f_setown+0x8c/0x26c [ 61.954854][ T7039] do_fcntl+0x27c/0x1568 [ 61.954870][ T7039] __arm64_sys_fcntl+0x118/0x1ac [ 61.954882][ T7039] invoke_syscall+0x98/0x244 [ 61.954895][ T7039] el0_svc_common+0xec/0x23c [ 61.954906][ T7039] do_el0_svc+0x4c/0x5c [ 61.954918][ T7039] el0_svc+0x64/0x260 [ 61.954929][ T7039] el0t_64_sync_handler+0x44/0x104 [ 61.954939][ T7039] el0t_64_sync+0x198/0x19c [ 62.033653][ T50] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 62.060487][ T7053] IPVS: set_ctl: invalid protocol: 46 100.1.1.1:20002 [ 62.138567][ T6988] cgroup: fork rejected by pids controller in /syz1 [ 62.366137][ T7071] syzkaller0: entered promiscuous mode [ 62.367349][ T7071] syzkaller0: entered allmulticast mode [ 62.492657][ T7079] loop3: detected capacity change from 0 to 512 [ 62.495967][ T7079] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 62.504425][ T7079] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 62.504486][ T7079] System zones: 1-12 [ 62.507436][ T7079] EXT4-fs (loop3): 1 truncate cleaned up [ 62.516757][ T7082] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(3276804.0.0), cmd(9) [ 62.542642][ T7085] __nla_validate_parse: 10 callbacks suppressed [ 62.543970][ T7085] netlink: 24 bytes leftover after parsing attributes in process `syz.1.779'. [ 62.546936][ T7085] device-mapper: ioctl: only supply one of name or uuid, cmd(9) [ 62.717322][ T7092] loop0: detected capacity change from 0 to 512 [ 62.769588][ T7096] binder: BINDER_SET_CONTEXT_MGR already set [ 62.770284][ T7096] binder: 7095:7096 ioctl 4018620d 20000040 returned -16 [ 62.821266][ T7103] syzkaller0: entered promiscuous mode [ 62.822503][ T7103] syzkaller0: entered allmulticast mode [ 63.043967][ T7109] process 'syz.2.787' launched '' with NULL argv: empty string added [ 63.049913][ T7109] loop2: detected capacity change from 0 to 512 [ 63.050269][ T7109] EXT4-fs: Ignoring removed oldalloc option [ 63.051325][ T7109] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 63.057776][ T7109] EXT4-fs (loop2): 1 orphan inode deleted [ 63.057803][ T7109] EXT4-fs (loop2): 1 truncate cleaned up [ 63.203480][ T7118] netlink: 8 bytes leftover after parsing attributes in process `syz.1.791'. [ 63.241564][ T7122] binder: BINDER_SET_CONTEXT_MGR already set [ 63.241587][ T7122] binder: 7121:7122 ioctl 4018620d 20000040 returned -16 [ 63.314057][ T7126] loop1: detected capacity change from 0 to 128 [ 63.345012][ T7128] netlink: 8 bytes leftover after parsing attributes in process `syz.3.796'. [ 63.379409][ T7133] loop3: detected capacity change from 0 to 512 [ 63.379753][ T7133] EXT4-fs: Ignoring removed i_version option [ 63.379778][ T7133] EXT4-fs: Ignoring removed bh option [ 63.381326][ T7133] EXT4-fs error (device loop3): ext4_orphan_get:1399: comm syz.3.798: inode #13: comm syz.3.798: iget: illegal inode # [ 63.381342][ T7133] loop3: lost filesystem error report for type 5 error -117 [ 63.381589][ T7133] EXT4-fs (loop3): Remounting filesystem read-only [ 63.393894][ T7133] EXT4-fs (loop3): shut down requested (2) [ 63.397601][ T7132] syzkaller0: entered promiscuous mode [ 63.398827][ T7132] syzkaller0: entered allmulticast mode [ 63.435251][ T7136] device-mapper: ioctl: only supply one of name or uuid, cmd(9) [ 63.601133][ T7155] binder: BINDER_SET_CONTEXT_MGR already set [ 63.601164][ T7155] binder: 7154:7155 ioctl 4018620d 20000040 returned -16 [ 63.641331][ T30] audit: type=1326 audit(63.632:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7158 comm="syz.1.807" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=9 arch=c00000b7 syscall=98 compat=0 ip=0xffff94d792a8 code=0x0 [ 63.809045][ T7172] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 63.848374][ T7174] loop2: detected capacity change from 0 to 2048 [ 63.874881][ T7174] loop2: p1 p3 [ 63.874881][ T7174] p1: [ 63.876514][ T7174] loop2: p1 size 16777216 extends beyond EOD, truncated [ 63.878733][ T7174] loop2: p3 start 3036741376 is beyond EOD, truncated [ 63.888335][ T7179] syzkaller0: entered promiscuous mode [ 63.888370][ T7179] syzkaller0: entered allmulticast mode [ 63.906003][ T4703] udevd[4703]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 64.400631][ T7200] binder: 7199:7200 ioctl c0306201 0 returned -14 [ 64.401682][ T7200] binder: 7199:7200 got transaction to invalid handle, 1 [ 64.401693][ T7200] binder_debug: 2 callbacks suppressed [ 64.401699][ T7200] binder: 7199:7200 cannot find target node [ 64.401711][ T7200] binder: 7199:7200 transaction call to 0:0 failed 108/29201/-22, code 0 size 104-24 line 3252 [ 64.401929][ T4795] binder: undelivered TRANSACTION_ERROR: 29201 [ 64.440192][ T7203] EXT4-fs error (device loop2): ext4_xattr_inode_iget:441: inode #11: comm syz.2.821: iget: bad extra_isize 90 (inode size 256) [ 64.440230][ T7203] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 64.441193][ T7203] EXT4-fs (loop2): Remounting filesystem read-only [ 64.441251][ T7203] EXT4-fs warning (device loop2): ext4_evict_inode:270: couldn't mark inode dirty (err -30) [ 64.441278][ T7203] EXT4-fs (loop2): 1 orphan inode deleted [ 64.463321][ T7207] netlink: 27 bytes leftover after parsing attributes in process `syz.3.822'. [ 64.466500][ T1594] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.466537][ T1594] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.467145][ T9] cfg80211: failed to load regulatory.db [ 64.613998][ T7225] EXT4-fs: Ignoring removed bh option [ 64.616023][ T7225] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 64.616042][ T7225] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 64.620342][ T7225] EXT4-fs (loop2): warning: mounting unchecked fs, running e2fsck is recommended [ 64.860416][ T7225] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 65.076292][ T7252] binder: 7250:7252 ioctl c0306201 0 returned -14 [ 65.080948][ T7252] binder: 7250:7252 got transaction to invalid handle, 1 [ 65.080975][ T7252] binder: 7250:7252 cannot find target node [ 65.081001][ T7252] binder: 7250:7252 transaction call to 0:0 failed 112/29201/-22, code 0 size 104-24 line 3252 [ 65.081999][ T9] binder: undelivered TRANSACTION_ERROR: 29201 [ 65.132574][ T7255] FAT-fs (loop4): error, corrupted file size (i_pos 196, 2097152) [ 65.132620][ T7255] FAT-fs (loop4): Filesystem has been set read-only [ 65.132659][ T7255] FAT-fs (loop4): error, corrupted file size (i_pos 196, 2097152) [ 65.155087][ T50] Bluetooth: hci2: unexpected cc 0x042d length: 63 > 7 [ 65.155568][ T50] Bluetooth: hci2: unexpected event for opcode 0x042d [ 65.194170][ T7269] EXT4-fs: Ignoring removed i_version option [ 65.195709][ T7269] EXT4-fs: Ignoring removed bh option [ 65.204407][ T7269] EXT4-fs error (device loop4): ext4_orphan_get:1399: comm syz.4.841: inode #13: comm syz.4.841: iget: illegal inode # [ 65.204444][ T7269] loop4: lost filesystem error report for type 5 error -117 [ 65.207230][ T7269] EXT4-fs (loop4): Remounting filesystem read-only [ 65.228360][ T7272] vfat: Unknown parameter './cgroup.net/syz1' [ 65.229972][ T7269] EXT4-fs (loop4): shut down requested (2) [ 65.276044][ T7278] netlink: 'syz.4.845': attribute type 2 has an invalid length. [ 65.324183][ T7285] set_capacity_and_notify: 6 callbacks suppressed [ 65.324730][ T7285] loop0: detected capacity change from 0 to 512 [ 65.384579][ T7292] binder: 7287:7292 tried to acquire reference to desc 0, got 1 instead [ 65.384984][ T7292] binder: 7287:7292 got transaction with invalid parent offset or type [ 65.385028][ T7292] binder: 7287:7292 transaction call to 7287:0 failed 117/29201/-22, code 0 size 112-24 line 3617 [ 65.385313][ T4311] binder: undelivered TRANSACTION_ERROR: 29201 [ 65.433278][ T50] Bluetooth: hci0: unexpected cc 0x042d length: 63 > 7 [ 65.433733][ T50] Bluetooth: hci0: unexpected event for opcode 0x042d [ 65.773273][ T7303] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 65.813294][ T7306] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.854'. [ 66.136512][ T50] Bluetooth: hci3: unexpected cc 0x042d length: 63 > 7 [ 66.139683][ T50] Bluetooth: hci3: unexpected event for opcode 0x042d [ 66.172161][ T7340] loop1: detected capacity change from 0 to 512 [ 66.176195][ T7340] EXT4-fs: Ignoring removed i_version option [ 66.176250][ T7340] EXT4-fs: Ignoring removed bh option [ 66.197634][ T7340] EXT4-fs error (device loop1): ext4_orphan_get:1399: comm syz.1.867: inode #13: comm syz.1.867: iget: illegal inode # [ 66.200548][ T7340] loop1: lost filesystem error report for type 5 error -117 [ 66.200933][ T7340] EXT4-fs (loop1): Remounting filesystem read-only [ 66.219727][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 66.219740][ C1] EXT4-fs (loop1): initial error at time 66: ext4_orphan_get:1399 [ 66.219756][ C1] EXT4-fs (loop1): last error at time 66: ext4_orphan_get:1399 [ 66.460759][ T7340] EXT4-fs (loop1): shut down requested (2) [ 66.639459][ T7360] binder: 7359:7360 got transaction to invalid handle, 1 [ 66.639487][ T7360] binder: 7359:7360 cannot find target node [ 66.639514][ T7360] binder: 7359:7360 transaction call to 0:0 failed 121/29201/-22, code 0 size 104-24 line 3252 [ 66.909739][ T7364] loop0: detected capacity change from 0 to 512 [ 66.912619][ T7364] EXT4-fs: Ignoring removed i_version option [ 66.914251][ T7364] EXT4-fs: Ignoring removed bh option [ 66.918857][ T50] Bluetooth: hci0: unexpected cc 0x042d length: 63 > 7 [ 66.918891][ T50] Bluetooth: hci0: unexpected event for opcode 0x042d [ 66.922371][ T7364] EXT4-fs error (device loop0): ext4_orphan_get:1399: comm syz.0.877: inode #13: comm syz.0.877: iget: illegal inode # [ 66.924985][ T7364] loop0: lost filesystem error report for type 5 error -117 [ 66.925178][ T7364] EXT4-fs (loop0): Remounting filesystem read-only [ 66.926673][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 66.926686][ C0] EXT4-fs (loop0): initial error at time 66: ext4_orphan_get:1399 [ 66.926701][ C0] EXT4-fs (loop0): last error at time 66: ext4_orphan_get:1399 [ 66.931983][ T7364] EXT4-fs (loop0): shut down requested (2) [ 66.932665][ T7364] FAULT_INJECTION: forcing a failure. [ 66.932665][ T7364] name failslab, interval 1, probability 0, space 0, times 0 [ 66.932680][ T7364] CPU: 1 UID: 0 PID: 7364 Comm: syz.0.877 Tainted: G L syzkaller #0 PREEMPT [ 66.932691][ T7364] Tainted: [L]=SOFTLOCKUP [ 66.932694][ T7364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 66.932698][ T7364] Call trace: [ 66.932701][ T7364] show_stack+0x2c/0x3c (C) [ 66.932720][ T7364] __dump_stack+0x30/0x40 [ 66.932731][ T7364] dump_stack_lvl+0xd8/0x12c [ 66.932741][ T7364] dump_stack+0x1c/0x28 [ 66.932750][ T7364] should_fail_ex+0x41c/0x590 [ 66.932758][ T7364] should_failslab+0xc4/0x120 [ 66.932766][ T7364] kmem_cache_alloc_noprof+0x94/0x5d8 [ 66.932775][ T7364] alloc_empty_file+0x6c/0x1cc [ 66.932783][ T7364] path_openat+0x7c/0x2a60 [ 66.932792][ T7364] do_file_open+0x1c8/0x2e8 [ 66.932800][ T7364] do_sys_openat2+0x114/0x1e8 [ 66.932810][ T7364] do_sys_open+0xb0/0xe0 [ 66.932819][ T7364] __arm64_sys_openat+0xa8/0xc4 [ 66.932829][ T7364] invoke_syscall+0x98/0x244 [ 66.932839][ T7364] el0_svc_common+0xec/0x23c [ 66.932848][ T7364] do_el0_svc+0x4c/0x5c [ 66.932857][ T7364] el0_svc+0x64/0x260 [ 66.932873][ T7364] el0t_64_sync_handler+0x44/0x104 [ 66.932882][ T7364] el0t_64_sync+0x198/0x19c [ 67.136451][ T7380] loop0: detected capacity change from 0 to 512 [ 67.137033][ T7380] EXT4-fs: Ignoring removed bh option [ 67.148628][ T7380] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 67.148649][ T7380] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem [ 67.467051][ T7380] EXT4-fs (loop0): warning: mounting unchecked fs, running e2fsck is recommended [ 67.470216][ T7380] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 67.476290][ T7380] overlayfs: missing 'lowerdir' [ 67.526971][ T7391] netlink: 20 bytes leftover after parsing attributes in process `syz.0.884'. [ 67.586377][ T7396] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.886'. [ 67.586537][ T7393] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.886'. [ 67.606385][ T7398] binder: 7397:7398 got transaction to invalid handle, 1 [ 67.636358][ T7402] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.890'. [ 67.658181][ T50] Bluetooth: hci2: unexpected cc 0x042d length: 63 > 7 [ 67.658216][ T50] Bluetooth: hci2: unexpected event for opcode 0x042d [ 67.679541][ T7406] loop1: detected capacity change from 0 to 2048 [ 67.682112][ T7410] overlayfs: missing 'lowerdir' [ 67.719845][ T7406] [ 67.720383][ T7406] ====================================================== [ 67.721780][ T7406] WARNING: possible circular locking dependency detected [ 67.723085][ T7406] syzkaller #0 Tainted: G L [ 67.724215][ T7406] ------------------------------------------------------ [ 67.725518][ T7406] syz.1.892/7406 is trying to acquire lock: [ 67.726605][ T7406] ffff0000f224a640 (&ei->xattr_sem){++++}-{4:4}, at: ext4_destroy_inline_data+0x30/0x114 [ 67.728394][ T7406] [ 67.728394][ T7406] but task is already holding lock: [ 67.729689][ T7406] ffff0000fbd62c18 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x170/0x2dc [ 67.731490][ T7406] [ 67.731490][ T7406] which lock already depends on the new lock. [ 67.731490][ T7406] [ 67.733401][ T7406] [ 67.733401][ T7406] the existing dependency chain (in reverse order) is: [ 67.735001][ T7406] [ 67.735001][ T7406] -> #1 (&sbi->s_writepages_rwsem){++++}-{0:0}: [ 67.736542][ T7406] percpu_down_read_internal+0x5c/0x294 [ 67.737615][ T7406] ext4_writepages+0x170/0x2dc [ 67.738529][ T7406] do_writepages+0x284/0x47c [ 67.739395][ T7406] __writeback_single_inode+0x140/0x1880 [ 67.740488][ T7406] writeback_single_inode+0x400/0xb20 [ 67.741561][ T7406] write_inode_now+0x170/0x208 [ 67.742475][ T7406] iput+0x7cc/0xc2c [ 67.743246][ T7406] ext4_xattr_block_set+0x1460/0x21e8 [ 67.744272][ T7406] ext4_expand_extra_isize_ea+0xaf4/0x1384 [ 67.745409][ T7406] __ext4_expand_extra_isize+0x2a4/0x378 [ 67.746563][ T7406] __ext4_mark_inode_dirty+0x394/0x828 [ 67.747619][ T7406] ext4_evict_inode+0x798/0xfb8 [ 67.748575][ T7406] evict+0x4c0/0x74c [ 67.749367][ T7406] iput+0x8f0/0xc2c [ 67.750161][ T7406] ext4_process_orphan+0x24c/0x2c0 [ 67.751215][ T7406] ext4_orphan_cleanup+0x7d4/0xd20 [ 67.752238][ T7406] ext4_fill_super+0x4628/0x4e14 [ 67.753239][ T7406] get_tree_bdev_flags+0x388/0x43c [ 67.754263][ T7406] get_tree_bdev+0x2c/0x3c [ 67.755169][ T7406] ext4_get_tree+0x28/0x38 [ 67.756066][ T7406] vfs_get_tree+0x90/0x28c [ 67.756981][ T7406] fc_mount+0x24/0xac [ 67.757815][ T7406] do_new_mount+0x2a4/0x538 [ 67.758702][ T7406] path_mount+0x5f0/0xa88 [ 67.759715][ T7406] do_mount+0xe8/0x148 [ 67.760564][ T7406] __arm64_sys_mount+0x33c/0x388 [ 67.761572][ T7406] invoke_syscall+0x98/0x244 [ 67.762554][ T7406] el0_svc_common+0xec/0x23c [ 67.763515][ T7406] do_el0_svc+0x4c/0x5c [ 67.764362][ T7406] el0_svc+0x64/0x260 [ 67.765208][ T7406] el0t_64_sync_handler+0x44/0x104 [ 67.766231][ T7406] el0t_64_sync+0x198/0x19c [ 67.767183][ T7406] [ 67.767183][ T7406] -> #0 (&ei->xattr_sem){++++}-{4:4}: [ 67.768791][ T7406] __lock_acquire+0x17c0/0x2ebc [ 67.769936][ T7406] lock_acquire+0x140/0x364 [ 67.770932][ T7406] down_write+0x50/0xc0 [ 67.771843][ T7406] ext4_destroy_inline_data+0x30/0x114 [ 67.772941][ T7406] ext4_do_writepages+0x3e4/0x3bc0 [ 67.773988][ T7406] ext4_writepages+0x198/0x2dc [ 67.774950][ T7406] do_writepages+0x284/0x47c [ 67.775888][ T7406] filemap_writeback+0x230/0x2bc [ 67.776878][ T7406] filemap_flush+0x30/0x40 [ 67.777789][ T7406] ext4_alloc_da_blocks+0x104/0x414 [ 67.778822][ T7406] ext4_rename2+0xbf8/0x2480 [ 67.779745][ T7406] vfs_rename+0xa94/0xd64 [ 67.780639][ T7406] filename_renameat2+0x660/0x72c [ 67.781644][ T7406] __arm64_sys_renameat2+0xf4/0x124 [ 67.782620][ T7406] invoke_syscall+0x98/0x244 [ 67.783527][ T7406] el0_svc_common+0xec/0x23c [ 67.784451][ T7406] do_el0_svc+0x4c/0x5c [ 67.785296][ T7406] el0_svc+0x64/0x260 [ 67.786132][ T7406] el0t_64_sync_handler+0x44/0x104 [ 67.787152][ T7406] el0t_64_sync+0x198/0x19c [ 67.788055][ T7406] [ 67.788055][ T7406] other info that might help us debug this: [ 67.788055][ T7406] [ 67.789827][ T7406] Possible unsafe locking scenario: [ 67.789827][ T7406] [ 67.791184][ T7406] CPU0 CPU1 [ 67.792179][ T7406] ---- ---- [ 67.793210][ T7406] rlock(&sbi->s_writepages_rwsem); [ 67.794172][ T7406] lock(&ei->xattr_sem); [ 67.795437][ T7406] lock(&sbi->s_writepages_rwsem); [ 67.796885][ T7406] lock(&ei->xattr_sem); [ 67.797694][ T7406] [ 67.797694][ T7406] *** DEADLOCK *** [ 67.797694][ T7406] [ 67.799171][ T7406] 7 locks held by syz.1.892/7406: [ 67.800049][ T7406] #0: ffff0000f49fe450 (sb_writers#3){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c [ 67.801719][ T7406] #1: ffff0000f49fe758 (&type->s_vfs_rename_key#2){+.+.}-{4:4}, at: __start_renaming+0xf0/0x344 [ 67.803643][ T7406] #2: ffff0000f224f400 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: lock_two_directories+0x1a4/0x21c [ 67.805719][ T7406] #3: ffff0000eec89fa0 (&type->i_mutex_dir_key#3/5){+.+.}-{4:4}, at: lock_two_directories+0x1cc/0x21c [ 67.807780][ T7406] #4: ffff0000eec8f400 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: lock_two_nondirectories+0xc4/0x148 [ 67.809769][ T7406] #5: ffff0000f224a900 (&sb->s_type->i_mutex_key#10/4){+.+.}-{4:4}, at: lock_two_nondirectories+0xe8/0x148 [ 67.811878][ T7406] #6: ffff0000fbd62c18 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x170/0x2dc [ 67.813805][ T7406] [ 67.813805][ T7406] stack backtrace: [ 67.814869][ T7406] CPU: 1 UID: 0 PID: 7406 Comm: syz.1.892 Tainted: G L syzkaller #0 PREEMPT [ 67.816654][ T7406] Tainted: [L]=SOFTLOCKUP [ 67.817425][ T7406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 67.819203][ T7406] Call trace: [ 67.819781][ T7406] show_stack+0x2c/0x3c (C) [ 67.820571][ T7406] __dump_stack+0x30/0x40 [ 67.821313][ T7406] dump_stack_lvl+0xd8/0x12c [ 67.822096][ T7406] dump_stack+0x1c/0x28 [ 67.822797][ T7406] print_circular_bug+0x328/0x330 [ 67.823627][ T7406] check_noncircular+0x158/0x174 [ 67.824506][ T7406] __lock_acquire+0x17c0/0x2ebc [ 67.825340][ T7406] lock_acquire+0x140/0x364 [ 67.826117][ T7406] down_write+0x50/0xc0 [ 67.826816][ T7406] ext4_destroy_inline_data+0x30/0x114 [ 67.827795][ T7406] ext4_do_writepages+0x3e4/0x3bc0 [ 67.828719][ T7406] ext4_writepages+0x198/0x2dc [ 67.829539][ T7406] do_writepages+0x284/0x47c [ 67.830317][ T7406] filemap_writeback+0x230/0x2bc [ 67.831172][ T7406] filemap_flush+0x30/0x40 [ 67.831942][ T7406] ext4_alloc_da_blocks+0x104/0x414 [ 67.832870][ T7406] ext4_rename2+0xbf8/0x2480 [ 67.833676][ T7406] vfs_rename+0xa94/0xd64 [ 67.834454][ T7406] filename_renameat2+0x660/0x72c [ 67.835337][ T7406] __arm64_sys_renameat2+0xf4/0x124 [ 67.836301][ T7406] invoke_syscall+0x98/0x244 [ 67.837094][ T7406] el0_svc_common+0xec/0x23c [ 67.837920][ T7406] do_el0_svc+0x4c/0x5c [ 67.838656][ T7406] el0_svc+0x64/0x260 [ 67.839353][ T7406] el0t_64_sync_handler+0x44/0x104 [ 67.840228][ T7406] el0t_64_sync+0x198/0x19c [ 67.843800][ T7406] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 67.855409][ T7406] EXT4-fs (loop1): Remounting filesystem read-only [ 67.870935][ T7426] loop4: detected capacity change from 0 to 8192 [ 67.898910][ T7427] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.900'. [ 67.899663][ T7425] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.900'. [ 69.125843][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 69.370167][ T50] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 69.370197][ T50] Bluetooth: hci2: Injecting HCI hardware error event [ 69.370243][ T4712] Bluetooth: hci2: hardware error 0x00 [ 69.625539][ T50] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 69.625564][ T50] Bluetooth: hci0: Injecting HCI hardware error event [ 69.625615][ T4723] Bluetooth: hci0: hardware error 0x00 [ 70.392273][ T50] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 70.392304][ T50] Bluetooth: hci3: Injecting HCI hardware error event [ 70.392465][ T4720] Bluetooth: hci3: hardware error 0x00 [ 71.590104][ T4712] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 71.858237][ T4723] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 72.630849][ T4720] Bluetooth: hci3: Opcode 0x0c03 failed: -110