last executing test programs: 1.60027986s ago: executing program 2 (id=181): syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1ff}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000400)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff8}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x3, &(0x7f0000000d40)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000005fdb2971dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359ca9daf3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae682acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da30000bce645451b851111dd98ac4d8da9317c2c082020e0b2d6340809000000000000008e053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456521cffdef93e29f10f4a11f0cfbfc0ff976b20fe"], &(0x7f0000000080)='GPL\x00', 0x0, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @fallback, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/13], 0x22) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x2e}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 1.456834092s ago: executing program 2 (id=186): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000000)={&(0x7f0000000000), 0x1000, 0x800}, 0x20) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001000)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000001200)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000001300)=0x10, 0x4) bind$xdp(r0, &(0x7f0000001400)={0x2c, 0x0, 0x1, 0x0, 0x0}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x11, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000001500)={r1, &(0x7f0000001600), &(0x7f0000001700)=@udp=r0}, 0x20) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x6, &(0x7f0000002000)=@raw=[@map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xb7, 0x2}, @generic={0xb7, 0x3}, @generic={0x85, 0x0, 0x0, 0x0, 0x33}, @generic={0x95}], &(0x7f0000003000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000004000)={r2, 0x0, 0xd50, 0x0, &(0x7f0000005000)="00112233445566778899aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.4073917s ago: executing program 2 (id=188): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a32000000001400048008000140000000000800024000000000140000"], 0x88}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) io_setup(0x20fe, 0x0) syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x1000003, &(0x7f0000000380)={[{@noblock_validity}, {@dioread_nolock}, {@errors_remount}, {@delalloc}, {@jqfmt_vfsv0}, {@usrjquota, 0x2e}], [], 0x22}, 0x84, 0x466, &(0x7f0000000ac0)="$eJzs3MtvG8UfAPDvbpr210d+CaU8+gACBRHxSJq0QA9cQCD1goQEh3IMaVqVpg1qgkSriKYIlSPqXwAckfgLOMEFAScQV7gjpArlQuCAFq29mxrHDnYS1wn+fKSNZ/bhma93x56dsRNAzxrO/yQR+yLip4gYjIi++h2Gqw/LSwtTfywtTCWRZa/9luSHxe9LC1PlrknxuLfIjKQR6QdJHG5Q7tyVqxcmZ2amLxf5sfmLb4/NXbn69PmLk+emz01fmjh58sTx8eeenXhmU+IcyOt66L3ZIwdPvXHzlanTN9/89vO8vvuK7bVxVA1tuMzhGF55Teo9tuFn31oGatLJji5WhLakEZGfrv5K+x+Mvrh98gbj5fe7Wjmgo7Isy3atWrvSA1jMgP+wJLpdA6A7yg/6/P63XO5g96Prbr1QvQHK414uluqWHZV7oyjujQY6VP5wRJxe/PPjfImG4xAAAJvry7z/81Sj/l8a99bs9/9ibmgoIu6KiP0RcXdEHIiIeyIq+94XEfe3Wf5wXX51/+eH3esKrEV5/+/5Ym7rn/2/svcXQ31FbqASf39y9vzM9LHiNRmJ/l15fnyNMr566cePmm2r7f/ly3J/TJV9waIev+6oG6A7Mzk/uZGYa926XhkDvLY6/mRlJiCJiIMRcWgdz59fL+ef+OxIs+2r4l9aqIt/DZswz5R9GvF49fwvRl38pWTt+cmx/8XM9LGx8qpY7bvvb7zarPwNxb8J8vO/p+H1vxL/UFI7XzvXfhk3fv6w6T3Nv8ff+PrfmbxeSe8s1r07OT9/eTxiZ7K4ev3E7WPLfLl/Hv/I0cbtf3/EX58Uxx2OiPwifiAiHoyIh4q6PxwRj0TE0TXi/+bFR99af/ydlcd/pq3z336i78LXXzQrv7Xzf6KSGinWtPL+12oFN/LaAQAAwHaRVr4Dn6SjK+k0HR2tfof/QOxJZ2bn5p88O/vOpTPV78oPRX9ajnQN1oyHjhdjfWV+oi5/vDJunGVZtruSH52anenUnDrQmr1N2n/ul75u1w7ouLbm0Zr9og3YlvxeE3qX9g+9S/uH3qX9Q+9q1P6vRSyvedD1jlUHuIN8/kPv0v6hd2n/0Lu0f+hJG/ld/1qJ/ada27n8B4QdqsY2SPRtjWq0nYh0S1RjfYl0a1SjmtgVEa3ufO2OtZQuvzEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABskr8DAAD//7yV6PA=") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="17090010000000000000010000000500070000000000080009000000000008000a0000080000060002000000000014001f00000000000000000000000000000000001400200000000000000000000000ffffac1414bb06001b00"], 0x6c}}, 0x0) 1.313086621s ago: executing program 4 (id=191): socket(0x840000000002, 0x3, 0x100) socket$nl_generic(0x10, 0x3, 0x10) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r1, 0x0, 0x1, 0x0) r4 = syz_io_uring_setup(0xf04, &(0x7f0000000400)={0x0, 0x595f, 0x80, 0x0, 0x10000051}, &(0x7f0000000200)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x5}) io_uring_enter(r4, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000600)='4', 0x1}], 0x1, 0x0) write$binfmt_script(r3, &(0x7f00000001c0)={'#! ', './file0'}, 0xb) 1.172791215s ago: executing program 0 (id=194): unshare(0x20000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./newroot\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./newroot\x00', &(0x7f00000000c0)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./newroot\x00') pivot_root(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='.\x00') chroot(&(0x7f00000001c0)='.\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x48}}, 0x0) r1 = syz_clone(0x50000000, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000a00)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}, @IFLA_NET_NS_PID={0x8, 0x13, r1}]}, 0x3c}}, 0x0) 1.172449111s ago: executing program 2 (id=195): prctl$PR_SET_SECUREBITS(0x1c, 0x1d) setuid(0xee01) r0 = syz_clone(0x2008400, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) fchdir(r1) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) syz_open_procfs(r0, &(0x7f00000003c0)='fdinfo\x00') 1.104041802s ago: executing program 0 (id=196): socket(0x80000000000000a, 0x2, 0x0) r0 = syz_io_uring_setup(0x34b5, &(0x7f00000024c0)={0x0, 0xe3b1, 0x0, 0x5, 0x82}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000200)=0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updsa={0xf0, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private1={0xfc, 0x2}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in=@empty, 0x0, 0x3c}, @in=@loopback, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @private=0xa010100}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={r5, 0x3}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r0}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 1.103929013s ago: executing program 4 (id=198): r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x5, 0x0) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0xffff, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000000c0)={0xa0028000}) r3 = epoll_create1(0x80000) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/wakeup_count', 0x0, 0x10) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f00000000c0)={0xe000001a}) read$char_usb(r4, &(0x7f0000000340)=""/170, 0xaa) 1.046421661s ago: executing program 0 (id=200): syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x0) r0 = landlock_create_ruleset(&(0x7f0000000040)={0x2080}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file3\x00', 0x20000, 0x10) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) 999.488037ms ago: executing program 0 (id=202): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='bic', 0x3) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 962.310855ms ago: executing program 1 (id=203): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) syz_io_uring_setup(0x867, 0x0, 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) setxattr$smack_xattr_label(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.SMACK64\x00', &(0x7f0000000140)={'lowerdir'}, 0x9, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) flock(r1, 0x2) 919.189153ms ago: executing program 1 (id=204): syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000003440), 0x800) syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x3a) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000340)={'raw\x00', 0x4, "340c79dc"}, &(0x7f0000000400)=0x28) 453.219344ms ago: executing program 1 (id=206): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b1, 0x800, 0x1, 0x82, 0x0, 0x0}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x42}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={r5, 0x3}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r0}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 344.601113ms ago: executing program 1 (id=209): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, @any, 0x1}, 0xa) listen(r0, 0x5) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="02c82010000c0001000b0108000200000000000000"], 0x15) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="02c8200c00080001000202040003004000"], 0x11) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="02c8200c00080001000403040040000000"], 0x11) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c8200e000a00010005010600400000000000"], 0x13) syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="02c820080004004000033f011c"], 0xd) syz_emit_vhci(&(0x7f0000000600)=ANY=[@ANYBLOB="02c82012000e00400003ef158311020007007f00000770"], 0x17) 320.194298ms ago: executing program 3 (id=210): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000180)=0x7, 0x4) write$tun(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001400000060ec97000fc83c00fe8000000000000000000000000000aa"], 0xffe) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="240000005800410f9c00f4f90085b3a85c91fddf080001000501009f0800028001000000", 0x24) recvmmsg(r0, &(0x7f00000000c0), 0x1, 0x40002142, 0x0) 301.169727ms ago: executing program 2 (id=211): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x10000}}, 0x0, 0xa, 0x0, 0x0, 0x41100, 0x73, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x3e, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 299.061876ms ago: executing program 3 (id=212): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x439, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r2, 0x21801, 0x1103}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}, @IFLA_IPTUN_FWMARK={0x8, 0x14, 0xdba7}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x8080}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x4000000}, 0x0) 253.173608ms ago: executing program 3 (id=213): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newqdisc={0x68, 0x24, 0xe0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x38, 0x2, {{0x1, 0x6, 0xa00, 0x3, 0x6, 0x200ff}, [@TCA_NETEM_LATENCY64={0xc}, @TCA_NETEM_RATE64={0xc, 0x8, 0xe62077891e54f027}, @TCA_NETEM_LOSS={0x4}]}}}]}, 0x68}}, 0x4000080) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 202.512752ms ago: executing program 4 (id=214): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x12, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000010000000000000000000000711812000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x12, 0x4, &(0x7f00000005c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = fsopen(&(0x7f0000000040)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x4) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000200)={r0, r2, 0x1e, 0x0, @void}, 0x10) r3 = socket(0xa, 0x3, 0xff) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e24, 0x6, @ipv4={'\x00', '\xff\xff', @loopback}, 0x9}, 0x1c) getpeername$packet(r3, 0x0, &(0x7f0000004640)) 201.976324ms ago: executing program 1 (id=224): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x439, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r2, 0x21801, 0x1103}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}, @IFLA_IPTUN_FWMARK={0x8, 0x14, 0xdba7}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x8080}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x4000000}, 0x0) 180.32513ms ago: executing program 4 (id=215): syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x0) r0 = landlock_create_ruleset(&(0x7f0000000040)={0x2080}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file3\x00', 0x20000, 0x10) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) 168.363278ms ago: executing program 1 (id=216): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x12b5c2, 0x0) fcntl$setlease(r1, 0x400, 0x1) truncate(&(0x7f0000000100)='./file1\x00', 0x7) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) 119.17883ms ago: executing program 2 (id=217): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000003, 0x31, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000080)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aSpA\xd4\x98\x85D\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97\xe7\xe6\x97\xf9\xb3\xf6\xb9\v\xb5$\xee\x84\x1cn,B\xd5?\xe5E:+Pm\x1d\xb4\xb8', 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) splice(r2, 0x0, r1, &(0x7f0000000140), 0x4, 0x0) 118.604334ms ago: executing program 3 (id=228): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb40000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000700000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000440005002001000000000000000000000000000000000002320000000a000000fc0100000000000000000000000000000000000004"], 0xfc}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000540)=ANY=[@ANYBLOB="4800000010000305000000000000000000cf0000", @ANYRES32=0x0, @ANYBLOB="03000000000000002000128008000100677265001400028008000600ac14142e08000700e0"], 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000800) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) 80.693665ms ago: executing program 0 (id=218): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080)={0x45, 0x2004, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f00000000c0)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x4080) socket$tipc(0x1e, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r3, 0x1, 0x70bd2c, 0x0, {{}, {}, {0x8, 0x11, 0x2007ff}}}, 0x24}, 0x1, 0x0, 0x0, 0x20044001}, 0x0) 80.556843ms ago: executing program 4 (id=219): socket$nl_xfrm(0x10, 0x3, 0x6) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) ioctl$F2FS_IOC_START_VOLATILE_WRITE(0xffffffffffffffff, 0xf503, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x1, @broadcast, 'tunl0\x00'}}, 0x1e) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000040)={0x18, 0x0, {0x1, @broadcast, 'ip6gre0\x00'}}, 0x1e) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="6000000010000108fdfffffffddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="000000042104020008001b00"], 0x60}, 0x1, 0x0, 0x0, 0x4040080}, 0x0) 59.391939ms ago: executing program 3 (id=220): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b1, 0x800, 0x1, 0x82, 0x0, 0x0}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x42}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={r5, 0x3}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r0}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 31.273779ms ago: executing program 4 (id=221): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0xa, 0x5, 0x2, 0x4}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0200000004000000080000000d"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x12, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000001000000850000000500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0xfffffffffffffe83, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 6.247086ms ago: executing program 3 (id=222): socket(0x840000000002, 0x3, 0x100) socket$nl_generic(0x10, 0x3, 0x10) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r1, 0x0, 0x1, 0x0) r4 = syz_io_uring_setup(0xf04, &(0x7f0000000400)={0x0, 0x595f, 0x80, 0x0, 0x10000051}, &(0x7f0000000200)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x5}) io_uring_enter(r4, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000600)='4', 0x1}], 0x1, 0x0) write$binfmt_script(r3, &(0x7f00000001c0)={'#! ', './file0'}, 0xb) 0s ago: executing program 0 (id=223): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, @any, 0x1}, 0xa) listen(r0, 0x5) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="02c82010000c0001000b0108000200000000000000"], 0x15) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="02c8200c00080001000202040003004000"], 0x11) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="02c8200c00080001000403040040000000"], 0x11) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c8200e000a00010005010600400000000000"], 0x13) syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="02c820080004004000033f011c"], 0xd) syz_emit_vhci(&(0x7f0000000600)=ANY=[@ANYBLOB="02c82012000e00400003ef158311020007007f00000770"], 0x17) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.152' (ED25519) to the list of known hosts. [ 29.275878][ T4692] cgroup: Unknown subsys name 'net' [ 29.405759][ T4692] cgroup: Unknown subsys name 'cpuset' [ 29.407974][ T4692] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 29.577278][ T4692] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 30.358879][ T4712] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.368152][ T4717] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 30.368500][ T4717] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 30.369308][ T4717] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 30.369488][ T4717] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 30.370234][ T4719] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 30.370435][ T4719] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.370799][ T4719] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 30.370969][ T4719] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.371242][ T4719] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 30.372979][ T4717] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 30.373100][ T4717] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 30.374546][ T4719] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 30.374726][ T4718] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.374918][ T4718] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 30.375804][ T4717] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 30.376027][ T4717] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 30.376098][ T4717] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 30.378452][ T4717] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 30.378608][ T4717] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 30.379052][ T4717] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 30.380068][ T4717] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 30.381989][ T4717] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 30.382237][ T4717] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 30.394442][ T4719] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 30.785703][ T4704] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.787587][ T4704] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.789012][ T4704] bridge_slave_0: entered allmulticast mode [ 30.790715][ T4704] bridge_slave_0: entered promiscuous mode [ 30.796963][ T4703] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.797009][ T4703] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.797094][ T4703] bridge_slave_0: entered allmulticast mode [ 30.797552][ T4703] bridge_slave_0: entered promiscuous mode [ 30.803587][ T4703] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.804954][ T4703] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.805033][ T4703] bridge_slave_1: entered allmulticast mode [ 30.805488][ T4703] bridge_slave_1: entered promiscuous mode [ 30.810059][ T4704] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.810102][ T4704] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.810195][ T4704] bridge_slave_1: entered allmulticast mode [ 30.810626][ T4704] bridge_slave_1: entered promiscuous mode [ 30.832179][ T4704] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.857270][ T4704] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.862042][ T4703] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.864203][ T4714] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.864336][ T4714] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.864397][ T4714] bridge_slave_0: entered allmulticast mode [ 30.864848][ T4714] bridge_slave_0: entered promiscuous mode [ 30.865698][ T4714] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.865719][ T4714] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.865774][ T4714] bridge_slave_1: entered allmulticast mode [ 30.866231][ T4714] bridge_slave_1: entered promiscuous mode [ 30.869698][ T4710] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.869719][ T4710] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.869778][ T4710] bridge_slave_0: entered allmulticast mode [ 30.870261][ T4710] bridge_slave_0: entered promiscuous mode [ 30.892291][ T4710] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.892354][ T4710] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.892415][ T4710] bridge_slave_1: entered allmulticast mode [ 30.892817][ T4710] bridge_slave_1: entered promiscuous mode [ 30.897164][ T4704] team0: Port device team_slave_0 added [ 30.898006][ T4704] team0: Port device team_slave_1 added [ 30.902114][ T4703] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.920548][ T4704] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.921895][ T4704] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.921933][ T4704] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.925402][ T4709] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.925494][ T4709] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.925546][ T4709] bridge_slave_0: entered allmulticast mode [ 30.925971][ T4709] bridge_slave_0: entered promiscuous mode [ 30.928460][ T4714] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.929548][ T4714] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.931255][ T4710] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.932283][ T4710] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.933102][ T4703] team0: Port device team_slave_0 added [ 30.933901][ T4703] team0: Port device team_slave_1 added [ 30.940136][ T4703] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.940145][ T4703] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.940158][ T4703] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.940721][ T4703] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.940728][ T4703] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.940750][ T4703] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.953897][ T4703] hsr_slave_0: entered promiscuous mode [ 30.954211][ T4703] hsr_slave_1: entered promiscuous mode [ 30.966209][ T4704] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.967530][ T4704] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.972738][ T4704] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.976797][ T4709] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.976870][ T4709] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.976927][ T4709] bridge_slave_1: entered allmulticast mode [ 30.977865][ T4709] bridge_slave_1: entered promiscuous mode [ 30.997701][ T4709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 31.002172][ T4714] team0: Port device team_slave_0 added [ 31.003281][ T4714] team0: Port device team_slave_1 added [ 31.009417][ T4709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 31.013175][ T4710] team0: Port device team_slave_0 added [ 31.013990][ T4710] team0: Port device team_slave_1 added [ 31.031443][ T4709] team0: Port device team_slave_0 added [ 31.035525][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.035547][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.035560][ T4710] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.037124][ T4704] hsr_slave_0: entered promiscuous mode [ 31.037395][ T4704] hsr_slave_1: entered promiscuous mode [ 31.037593][ T4704] debugfs: 'hsr0' already exists in 'hsr' [ 31.037629][ T4704] Cannot create hsr debugfs directory [ 31.038184][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.038190][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.038204][ T4710] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.047581][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.047591][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.047604][ T4714] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.048184][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.048191][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.048206][ T4714] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.064140][ T4709] team0: Port device team_slave_1 added [ 31.070660][ T4710] hsr_slave_0: entered promiscuous mode [ 31.070970][ T4710] hsr_slave_1: entered promiscuous mode [ 31.071160][ T4710] debugfs: 'hsr0' already exists in 'hsr' [ 31.071170][ T4710] Cannot create hsr debugfs directory [ 31.076213][ T4714] hsr_slave_0: entered promiscuous mode [ 31.076508][ T4714] hsr_slave_1: entered promiscuous mode [ 31.076703][ T4714] debugfs: 'hsr0' already exists in 'hsr' [ 31.076712][ T4714] Cannot create hsr debugfs directory [ 31.104452][ T4709] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.105799][ T4709] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.111170][ T4709] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.113300][ T4709] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.113314][ T4709] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.113334][ T4709] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.182875][ T4709] hsr_slave_0: entered promiscuous mode [ 31.184679][ T4709] hsr_slave_1: entered promiscuous mode [ 31.186140][ T4709] debugfs: 'hsr0' already exists in 'hsr' [ 31.187260][ T4709] Cannot create hsr debugfs directory [ 31.211874][ T4703] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 31.215111][ T4703] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.224001][ T4703] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 31.226675][ T4703] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.227031][ T4703] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 31.229175][ T4703] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.236459][ T4703] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 31.237548][ T4703] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.264782][ T4704] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 31.268619][ T4704] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.270377][ T4704] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 31.272727][ T4704] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.279268][ T4703] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.279317][ T4703] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.279508][ T4703] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.279546][ T4703] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.281331][ T4704] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 31.283158][ T4704] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.283454][ T4704] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 31.286109][ T4704] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.307425][ T4710] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 31.309829][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.310146][ T4710] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 31.312015][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.312657][ T4704] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.312688][ T4704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.312782][ T4704] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.312812][ T4704] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.321865][ T4710] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 31.324525][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.331974][ T4710] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 31.334182][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.354736][ T4714] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 31.357317][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.359099][ T4714] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 31.361635][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.372746][ T4704] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.375664][ T4714] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 31.377935][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.378224][ T4714] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 31.380076][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.386431][ T4710] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.386474][ T4710] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.386561][ T4710] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.386603][ T4710] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.399520][ T4709] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 31.401877][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.403759][ T4709] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 31.406352][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.410440][ T4709] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.411597][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.413397][ T1178] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.415084][ T1178] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.416710][ T1178] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.418471][ T1178] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.421719][ T1178] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.423351][ T1178] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.432112][ T4704] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.438423][ T4703] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.441612][ T4709] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.443721][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.447398][ T1178] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.447452][ T1178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.447864][ T1178] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.447883][ T1178] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.450136][ T4703] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.468526][ T1178] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.468565][ T1178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.468895][ T1178] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.468913][ T1178] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.479858][ T4704] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.481809][ T4704] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.493614][ T4703] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.508433][ T4710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.532039][ T4714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.540507][ T4710] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.557583][ T1083] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.557632][ T1083] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.557992][ T1083] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.558018][ T1083] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.577865][ T4710] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.577900][ T4710] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.592224][ T4709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.592846][ T4714] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.600477][ T4709] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.608597][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.608643][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.611416][ T1083] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.611441][ T1083] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.625118][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.625164][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.625506][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.625527][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.737166][ T4704] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.759843][ T4703] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.768908][ T4704] veth0_vlan: entered promiscuous mode [ 31.772055][ T4704] veth1_vlan: entered promiscuous mode [ 31.787371][ T4704] veth0_macvtap: entered promiscuous mode [ 31.790028][ T4704] veth1_macvtap: entered promiscuous mode [ 31.810235][ T4703] veth0_vlan: entered promiscuous mode [ 31.816148][ T4704] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.818689][ T4704] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.822951][ T1178] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.823103][ T1178] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.823129][ T1178] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.823153][ T1178] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.833901][ T4703] veth1_vlan: entered promiscuous mode [ 31.885965][ T4710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.890904][ T4703] veth0_macvtap: entered promiscuous mode [ 31.892872][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.892903][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.895400][ T4709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.898945][ T4714] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.903613][ T4703] veth1_macvtap: entered promiscuous mode [ 31.919297][ T1083] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.919325][ T1083] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.926505][ T4703] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.927834][ T4703] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.944652][ T63] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.946717][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.946776][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.946808][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.969585][ T4704] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.972499][ T4709] veth0_vlan: entered promiscuous mode [ 31.983573][ T4714] veth0_vlan: entered promiscuous mode [ 32.003392][ T4714] veth1_vlan: entered promiscuous mode [ 32.004721][ T4709] veth1_vlan: entered promiscuous mode [ 32.019040][ T4714] veth0_macvtap: entered promiscuous mode [ 32.021393][ T4714] veth1_macvtap: entered promiscuous mode [ 32.029349][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.031940][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.041727][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.041764][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.053213][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.053241][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.065401][ T1083] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.066853][ T1083] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.066995][ T1083] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.067121][ T1083] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.079309][ T4709] veth0_macvtap: entered promiscuous mode [ 32.080596][ T4709] veth1_macvtap: entered promiscuous mode [ 32.095391][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.095420][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.114051][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.115896][ T4710] veth0_vlan: entered promiscuous mode [ 32.123666][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.139746][ T1083] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.139777][ T1083] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.142469][ T4710] veth1_vlan: entered promiscuous mode [ 32.166588][ T63] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.169778][ T4710] veth0_macvtap: entered promiscuous mode [ 32.176284][ T4710] veth1_macvtap: entered promiscuous mode [ 32.197891][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.199565][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.309736][ T1083] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.309771][ T1083] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.312204][ T4897] Illegal XDP return value 4052779188 on prog (id 2) dev syz_tun, expect packet loss! [ 32.343067][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.343097][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.346295][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.347176][ T63] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.347345][ T63] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.347362][ T63] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.347376][ T63] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.347390][ T63] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.347404][ T63] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.369665][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.369693][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.389578][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.389608][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.404852][ T4720] Bluetooth: hci2: command tx timeout [ 32.405152][ T4719] Bluetooth: hci1: command tx timeout [ 32.405248][ T4719] Bluetooth: hci4: command tx timeout [ 32.405308][ T4719] Bluetooth: hci0: command tx timeout [ 32.473764][ T4907] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.474082][ T4907] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.484753][ T4720] Bluetooth: hci3: command tx timeout [ 32.505419][ T4907] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 32.508579][ T4907] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 32.715250][ T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.715410][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.715537][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.715662][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.885964][ T4922] netlink: 'syz.2.15': attribute type 11 has an invalid length. [ 32.946686][ T4925] sctp: [Deprecated]: syz.0.17 (pid 4925) Use of struct sctp_assoc_value in delayed_ack socket option. [ 32.946686][ T4925] Use struct sctp_sack_info instead [ 33.042371][ T4934] netlink: 'syz.0.30': attribute type 11 has an invalid length. [ 33.076915][ T4938] netlink: 4 bytes leftover after parsing attributes in process `syz.2.22'. [ 33.145475][ T4939] netlink: 14 bytes leftover after parsing attributes in process `syz.4.21'. [ 33.145682][ T4938] netlink: 4 bytes leftover after parsing attributes in process `syz.2.22'. [ 33.188533][ T4938] team0 (unregistering): Port device team_slave_0 removed [ 33.192377][ T4938] team0 (unregistering): Port device team_slave_1 removed [ 33.261756][ T4945] netlink: 4 bytes leftover after parsing attributes in process `syz.0.24'. [ 33.275551][ T4945] team0: Port device team_slave_0 removed [ 33.346080][ T4947] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.346297][ T4947] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.376420][ T4947] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 33.378814][ T4947] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 33.574473][ T4957] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.574526][ T4957] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.574567][ T4957] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.574598][ T4957] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.484701][ T4720] Bluetooth: hci2: command tx timeout [ 34.484745][ T4720] Bluetooth: hci0: command tx timeout [ 34.484759][ T4713] Bluetooth: hci4: command tx timeout [ 34.485103][ T4719] Bluetooth: hci1: command tx timeout [ 34.564371][ T4713] Bluetooth: hci3: command tx timeout [ 35.200660][ T4986] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.200850][ T4986] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.255435][ T4986] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 35.259019][ T4986] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 35.374317][ T12] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.374361][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.374393][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.374413][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.869834][ T5030] netlink: 16 bytes leftover after parsing attributes in process `syz.4.57'. [ 35.873107][ T30] audit: type=1326 audit(1700000003.240:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5029 comm="syz.4.57" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffaa5792a8 code=0x0 [ 36.565573][ T50] Bluetooth: hci0: command tx timeout [ 36.565614][ T50] Bluetooth: hci1: command tx timeout [ 36.565643][ T50] Bluetooth: hci2: command tx timeout [ 36.565727][ T4713] Bluetooth: hci4: command tx timeout [ 36.644699][ T4720] Bluetooth: hci3: command tx timeout [ 36.733151][ T5048] netlink: 16 bytes leftover after parsing attributes in process `syz.1.71'. [ 36.739018][ T30] audit: type=1326 audit(1700000004.110:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5047 comm="syz.1.71" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffa21792a8 code=0x0 [ 36.765837][ T5045] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.766009][ T5045] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.824021][ T5045] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 36.828127][ T5045] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 36.917779][ T5063] netlink: 14 bytes leftover after parsing attributes in process `syz.0.63'. [ 37.024346][ T1178] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.034325][ T1178] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.034371][ T1178] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.034393][ T1178] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.577912][ T30] audit: type=1326 audit(1700000004.950:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5077 comm="syz.3.73" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f5792a8 code=0x7ffc0000 [ 37.582932][ T30] audit: type=1326 audit(1700000004.950:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5077 comm="syz.3.73" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f5792a8 code=0x7ffc0000 [ 37.588565][ T30] audit: type=1326 audit(1700000004.960:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5077 comm="syz.3.73" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f5792a8 code=0x7ffc0000 [ 37.593819][ T30] audit: type=1326 audit(1700000004.960:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5077 comm="syz.3.73" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f5792a8 code=0x7ffc0000 [ 37.603533][ T30] audit: type=1326 audit(1700000004.970:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5077 comm="syz.3.73" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f5792a8 code=0x7ffc0000 [ 37.609955][ T30] audit: type=1326 audit(1700000004.980:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5077 comm="syz.3.73" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=147 compat=0 ip=0xffff7f5792a8 code=0x7ffc0000 [ 37.609986][ T30] audit: type=1326 audit(1700000004.980:10): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=_ pid=5077 comm="syz.3.73" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f5792a8 code=0x7ffc0000 [ 37.610024][ T30] audit: type=1326 audit(1700000004.980:11): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=_ pid=5077 comm="syz.3.73" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f5792a8 code=0x7ffc0000 [ 37.933627][ T5118] netlink: 14 bytes leftover after parsing attributes in process `syz.3.86'. [ 38.046707][ T5112] Injecting memory failure for pfn 0x11e801 at process virtual address 0x20001000 [ 38.052534][ T5112] Memory failure: 0x11e801: Sending SIGBUS to syz.0.85:5112 due to hardware memory corruption [ 38.052631][ T5112] Memory failure: 0x11e801: recovery action for unsplit thp: Failed [ 38.140332][ T5134] loop2: detected capacity change from 0 to 1024 [ 38.141144][ T5134] EXT4-fs: Ignoring removed nomblk_io_submit option [ 38.142451][ T5134] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 38.144049][ T5134] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e054c018, mo2=0002] [ 38.144092][ T5134] System zones: 0-1, 3-36 [ 38.157432][ T5134] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.203179][ T4714] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.375616][ C0] Unknown status report in ack skb [ 38.573722][ T5171] loop3: detected capacity change from 0 to 1024 [ 38.577368][ T5171] EXT4-fs: Ignoring removed nomblk_io_submit option [ 38.579614][ T5171] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 38.594830][ T5171] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e054c018, mo2=0002] [ 38.594922][ T5171] System zones: 0-1, 3-36 [ 38.600734][ T5171] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.640382][ T4704] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.644660][ T4720] Bluetooth: hci4: command tx timeout [ 38.644967][ T4720] Bluetooth: hci2: command tx timeout [ 38.645234][ T50] Bluetooth: hci0: command tx timeout [ 38.645283][ T4713] Bluetooth: hci1: command tx timeout [ 38.653994][ T5163] Injecting memory failure for pfn 0x120001 at process virtual address 0x20001000 [ 38.654960][ T5163] Memory failure: 0x120001: Sending SIGBUS to syz.4.104:5163 due to hardware memory corruption [ 38.654986][ T5163] Memory failure: 0x120001: recovery action for unsplit thp: Failed [ 38.726579][ T4720] Bluetooth: hci3: command tx timeout [ 38.962621][ T5197] loop4: detected capacity change from 0 to 512 [ 38.978988][ T5197] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 38.979532][ T5197] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #13: comm syz.4.122: invalid indirect mapped block 2683928664 (level 1) [ 38.979579][ T5197] loop4: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 38.982879][ T5197] EXT4-fs (loop4): Remounting filesystem read-only [ 38.983159][ T5197] EXT4-fs (loop4): 1 truncate cleaned up [ 38.983623][ T5197] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.020067][ T5203] netlink: 14 bytes leftover after parsing attributes in process `syz.1.119'. [ 39.032049][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.379517][ T5211] Injecting memory failure for pfn 0x11f601 at process virtual address 0x20001000 [ 39.380659][ T5211] Memory failure: 0x11f601: Sending SIGBUS to syz.2.125:5211 due to hardware memory corruption [ 39.380687][ T5211] Memory failure: 0x11f601: recovery action for unsplit thp: Failed [ 39.536994][ T5221] netlink: 168 bytes leftover after parsing attributes in process `syz.0.139'. [ 39.543687][ T5223] sctp: [Deprecated]: syz.2.129 (pid 5223) Use of struct sctp_assoc_value in delayed_ack socket option. [ 39.543687][ T5223] Use struct sctp_sack_info instead [ 39.612027][ T5225] syz.0.130 uses obsolete (PF_INET,SOCK_PACKET) [ 39.641353][ T5230] loop1: detected capacity change from 0 to 512 [ 39.643942][ T5230] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 39.643975][ T5230] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 not in group (block 2)! [ 39.644160][ T5230] EXT4-fs (loop1): group descriptors corrupted! [ 39.655561][ T5230] netlink: 8 bytes leftover after parsing attributes in process `syz.1.132'. [ 39.677421][ T5234] evm: overlay not supported [ 39.879439][ T5238] netlink: 3568 bytes leftover after parsing attributes in process `syz.2.135'. [ 39.913915][ T5246] netlink: 4 bytes leftover after parsing attributes in process `syz.2.136'. [ 40.266866][ T1178] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.364155][ T1178] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.415230][ T4719] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 40.417021][ T4719] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 40.418630][ T4719] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 40.420551][ T4719] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 40.422643][ T4719] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 40.445908][ T1178] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.540379][ T1178] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.719440][ T1178] bridge_slave_1: left allmulticast mode [ 40.719482][ T1178] bridge_slave_1: left promiscuous mode [ 40.719906][ T1178] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.726385][ T1178] bridge_slave_0: left allmulticast mode [ 40.727473][ T1178] bridge_slave_0: left promiscuous mode [ 40.727568][ T1178] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.871651][ T1178] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 40.900845][ T5294] loop3: detected capacity change from 0 to 512 [ 40.903568][ T5294] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 40.904071][ T5294] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #13: comm syz.3.153: invalid indirect mapped block 2683928664 (level 1) [ 40.904088][ T5294] loop3: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 40.904253][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 40.904264][ C0] EXT4-fs (loop3): initial error at time 1700000008: ext4_free_branches:1023: inode 13 [ 40.904281][ C0] EXT4-fs (loop3): last error at time 1700000008: ext4_free_branches:1023: inode 13 [ 40.908521][ T5294] EXT4-fs (loop3): Remounting filesystem read-only [ 40.908695][ T5294] EXT4-fs (loop3): 1 truncate cleaned up [ 40.909142][ T5294] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.931932][ T1178] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 40.940031][ T4704] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.946129][ T1178] bond0 (unregistering): Released all slaves [ 41.035539][ T5278] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.035627][ T5278] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.035685][ T5278] bridge_slave_0: entered allmulticast mode [ 41.037173][ T5278] bridge_slave_0: entered promiscuous mode [ 41.038582][ T5278] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.038633][ T5278] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.038691][ T5278] bridge_slave_1: entered allmulticast mode [ 41.039133][ T5278] bridge_slave_1: entered promiscuous mode [ 41.047483][ T5278] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 41.048394][ T5278] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 41.056886][ T5278] team0: Port device team_slave_0 added [ 41.057790][ T5278] team0: Port device team_slave_1 added [ 41.071603][ T5307] sctp: [Deprecated]: syz.3.156 (pid 5307) Use of struct sctp_assoc_value in delayed_ack socket option. [ 41.071603][ T5307] Use struct sctp_sack_info instead [ 41.078512][ T5278] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 41.078542][ T5278] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 41.078559][ T5278] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 41.079177][ T5278] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 41.079192][ T5278] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 41.079212][ T5278] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 41.186561][ T5278] hsr_slave_0: entered promiscuous mode [ 41.188701][ T5278] hsr_slave_1: entered promiscuous mode [ 41.189871][ T5278] debugfs: 'hsr0' already exists in 'hsr' [ 41.189882][ T5278] Cannot create hsr debugfs directory [ 41.248185][ T4395] 8021q: adding VLAN 0 to HW filter on device eth0 [ 41.263273][ T1178] hsr_slave_0: left promiscuous mode [ 41.264581][ T1178] hsr_slave_1: left promiscuous mode [ 41.265619][ T1178] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 41.265639][ T1178] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 41.267548][ T1178] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 41.267561][ T1178] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 41.271363][ T1178] veth1_macvtap: left promiscuous mode [ 41.271412][ T1178] veth0_macvtap: left promiscuous mode [ 41.271461][ T1178] veth1_vlan: left promiscuous mode [ 41.271501][ T1178] veth0_vlan: left promiscuous mode [ 41.383134][ T1178] team0 (unregistering): Port device team_slave_1 removed [ 41.760533][ T5345] loop3: detected capacity change from 0 to 512 [ 41.772538][ T5345] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 41.772575][ T5345] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 not in group (block 2)! [ 41.772602][ T5345] EXT4-fs (loop3): group descriptors corrupted! [ 41.798399][ T5345] netlink: 8 bytes leftover after parsing attributes in process `syz.3.159'. [ 41.926054][ T5278] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 41.929572][ T5278] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 41.931431][ T5278] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 41.942357][ T5278] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 41.942673][ T5278] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 41.949022][ T5278] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 41.950910][ T5278] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 41.971256][ T5278] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 42.035791][ T5278] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.041660][ T5278] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.049937][ T1083] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.049981][ T1083] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.056102][ T1178] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.056141][ T1178] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.068845][ T5278] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 42.081663][ T5278] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 42.136764][ T5380] sctp: [Deprecated]: syz.4.169 (pid 5380) Use of struct sctp_assoc_value in delayed_ack socket option. [ 42.136764][ T5380] Use struct sctp_sack_info instead [ 42.271073][ T5394] tipc: Started in network mode [ 42.271111][ T5394] tipc: Node identity 2007ff, cluster identity 4711 [ 42.271121][ T5394] tipc: Node number set to 2099199 [ 42.380635][ T5408] loop4: detected capacity change from 0 to 512 [ 42.397636][ T5408] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 42.397679][ T5408] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 not in group (block 2)! [ 42.397702][ T5408] EXT4-fs (loop4): group descriptors corrupted! [ 42.410189][ T5278] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.424438][ T5408] netlink: 8 bytes leftover after parsing attributes in process `syz.4.175'. [ 42.465587][ T5278] veth0_vlan: entered promiscuous mode [ 42.475831][ T5278] veth1_vlan: entered promiscuous mode [ 42.484335][ T4720] Bluetooth: hci2: command tx timeout [ 42.487261][ T5413] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 42.498835][ T5278] veth0_macvtap: entered promiscuous mode [ 42.502385][ T5278] veth1_macvtap: entered promiscuous mode [ 42.522507][ T5278] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.523523][ T5278] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.583962][ T4957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.583994][ T4957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.602720][ T1178] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.602755][ T1178] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.616329][ T4957] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.616384][ T4957] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.616406][ T4957] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.616422][ T4957] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.780478][ T5441] netlink: 8 bytes leftover after parsing attributes in process `syz.4.197'. [ 42.798122][ T5441] Zero length message leads to an empty skb [ 42.838810][ T5451] tipc: Started in network mode [ 42.840374][ T5451] tipc: Node identity 2007ff, cluster identity 4711 [ 42.841709][ T5451] tipc: Node number set to 2099199 [ 42.868029][ T5449] loop2: detected capacity change from 0 to 512 [ 42.877955][ T5449] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 42.877989][ T5449] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 0 not in group (block 2)! [ 42.878016][ T5449] EXT4-fs (loop2): group descriptors corrupted! [ 42.901866][ T5449] netlink: 8 bytes leftover after parsing attributes in process `syz.2.188'. [ 43.270075][ T30] kauditd_printk_skb: 65 callbacks suppressed [ 43.270109][ T30] audit: type=1400 audit(1700000010.640:77): lsm=SMACK fn=smack_file_lock action=denied subject="_" object="lowerdir" requested=l pid=5482 comm="syz.1.203" path="/39/file0" dev="tmpfs" ino=219 [ 43.853336][ T5497] netlink: 56 bytes leftover after parsing attributes in process `syz.3.207'. [ 44.115925][ T5519] netlink: 8 bytes leftover after parsing attributes in process `syz.3.228'. [ 44.152819][ T5524] netlink: 56 bytes leftover after parsing attributes in process `syz.4.219'. [ 44.173258][ T5526] tipc: Started in network mode [ 44.173292][ T5526] tipc: Node identity 2007ff, cluster identity 4711 [ 44.173301][ T5526] tipc: Node number set to 2099199 [ 44.239208][ T5532] [ 44.239701][ T5532] ====================================================== [ 44.240949][ T5532] WARNING: possible circular locking dependency detected [ 44.242225][ T5532] syzkaller #0 Not tainted [ 44.243035][ T5532] ------------------------------------------------------ [ 44.244409][ T5532] syz.0.223/5532 is trying to acquire lock: [ 44.245536][ T5532] ffff80008a06cbe0 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_close+0x44/0x1cc [ 44.247265][ T5532] [ 44.247265][ T5532] but task is already holding lock: [ 44.248659][ T5532] ffff0000f3119260 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: __rfcomm_sock_close+0xe0/0x330 [ 44.250885][ T5532] [ 44.250885][ T5532] which lock already depends on the new lock. [ 44.250885][ T5532] [ 44.252775][ T5532] [ 44.252775][ T5532] the existing dependency chain (in reverse order) is: [ 44.254396][ T5532] [ 44.254396][ T5532] -> #1 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}: [ 44.256110][ T5532] lock_sock_nested+0x58/0x110 [ 44.257053][ T5532] rfcomm_connect_ind+0x498/0x920 [ 44.258069][ T5532] rfcomm_run+0x1f08/0x4bac [ 44.258984][ T5532] kthread+0x304/0x3d4 [ 44.259832][ T5532] ret_from_fork+0x10/0x20 [ 44.260735][ T5532] [ 44.260735][ T5532] -> #0 (rfcomm_mutex){+.+.}-{4:4}: [ 44.262073][ T5532] __lock_acquire+0x1600/0x2a6c [ 44.263038][ T5532] lock_acquire+0x150/0x370 [ 44.263935][ T5532] __mutex_lock+0x164/0xf14 [ 44.264842][ T5532] mutex_lock_nested+0x24/0x30 [ 44.265792][ T5532] rfcomm_dlc_close+0x44/0x1cc [ 44.266761][ T5532] __rfcomm_sock_close+0x1c0/0x330 [ 44.267794][ T5532] __rfcomm_sock_close+0xe8/0x330 [ 44.268809][ T5532] rfcomm_sock_shutdown+0xa8/0x23c [ 44.269841][ T5532] rfcomm_sock_release+0x58/0x160 [ 44.270855][ T5532] __sock_release+0xa0/0x1d4 [ 44.271798][ T5532] sock_close+0x24/0x38 [ 44.272676][ T5532] __fput+0x338/0x74c [ 44.273495][ T5532] ____fput+0x20/0x30 [ 44.274325][ T5532] task_work_run+0x1cc/0x25c [ 44.275280][ T5532] exit_to_user_mode_loop+0x10c/0x17c [ 44.276389][ T5532] el0_svc+0x18c/0x260 [ 44.277252][ T5532] el0t_64_sync_handler+0x44/0x104 [ 44.278293][ T5532] el0t_64_sync+0x198/0x19c [ 44.279220][ T5532] [ 44.279220][ T5532] other info that might help us debug this: [ 44.279220][ T5532] [ 44.281112][ T5532] Possible unsafe locking scenario: [ 44.281112][ T5532] [ 44.282446][ T5532] CPU0 CPU1 [ 44.283440][ T5532] ---- ---- [ 44.284393][ T5532] lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM); [ 44.285508][ T5532] lock(rfcomm_mutex); [ 44.286726][ T5532] lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM); [ 44.288267][ T5532] lock(rfcomm_mutex); [ 44.289023][ T5532] [ 44.289023][ T5532] *** DEADLOCK *** [ 44.289023][ T5532] [ 44.290549][ T5532] locks held by syz.0.223/5532: 2, last CPU#1: [ 44.291670][ T5532] #0: ffff0000dd6f1f00 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: __sock_release+0x7c/0x1d4 [ 44.293624][ T5532] #1: ffff0000f3119260 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: __rfcomm_sock_close+0xe0/0x330 [ 44.295884][ T5532] [ 44.295884][ T5532] stack backtrace: [ 44.296937][ T5532] CPU: 1 UID: 0 PID: 5532 Comm: syz.0.223 Not tainted syzkaller #0 PREEMPT [ 44.298549][ T5532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 44.300466][ T5532] Call trace: [ 44.301081][ T5532] show_stack+0x2c/0x3c (C) [ 44.301936][ T5532] __dump_stack+0x30/0x40 [ 44.302749][ T5532] dump_stack_lvl+0xd8/0x12c [ 44.303608][ T5532] dump_stack+0x1c/0x28 [ 44.304402][ T5532] print_circular_bug+0x328/0x330 [ 44.305352][ T5532] check_noncircular+0x158/0x174 [ 44.306255][ T5532] __lock_acquire+0x1600/0x2a6c [ 44.307307][ T5532] lock_acquire+0x150/0x370 [ 44.308220][ T5532] __mutex_lock+0x164/0xf14 [ 44.309149][ T5532] mutex_lock_nested+0x24/0x30 [ 44.310122][ T5532] rfcomm_dlc_close+0x44/0x1cc [ 44.311075][ T5532] __rfcomm_sock_close+0x1c0/0x330 [ 44.312103][ T5532] __rfcomm_sock_close+0xe8/0x330 [ 44.313109][ T5532] rfcomm_sock_shutdown+0xa8/0x23c [ 44.314147][ T5532] rfcomm_sock_release+0x58/0x160 [ 44.315160][ T5532] __sock_release+0xa0/0x1d4 [ 44.316118][ T5532] sock_close+0x24/0x38 [ 44.316956][ T5532] __fput+0x338/0x74c [ 44.317750][ T5532] ____fput+0x20/0x30 [ 44.318524][ T5532] task_work_run+0x1cc/0x25c [ 44.319427][ T5532] exit_to_user_mode_loop+0x10c/0x17c [ 44.320496][ T5532] el0_svc+0x18c/0x260 [ 44.321275][ T5532] el0t_64_sync_handler+0x44/0x104 [ 44.322242][ T5532] el0t_64_sync+0x198/0x19c SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 44.574269][ T4720] Bluetooth: hci2: command tx timeout [ 44.915926][ T12] bridge_slave_1: left allmulticast mode [ 44.915959][ T12] bridge_slave_1: left promiscuous mode [ 44.916037][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.919803][ T12] bridge_slave_0: left allmulticast mode [ 44.919827][ T12] bridge_slave_0: left promiscuous mode [ 44.919891][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.950082][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 44.984812][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 44.995786][ T12] bond0 (unregistering): Released all slaves [ 45.030161][ T12] tipc: Left network mode [ 45.126479][ T4395] 8021q: adding VLAN 0 to HW filter on device eth0 [ 45.131031][ T12] hsr_slave_0: left promiscuous mode [ 45.132174][ T12] hsr_slave_1: left promiscuous mode [ 45.132488][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 45.134959][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 45.171687][ T12] team0 (unregistering): Port device team_slave_1 removed [ 45.175321][ T12] team0 (unregistering): Port device team_slave_0 removed [ 45.290378][ T4395] 8021q: adding VLAN 0 to HW filter on device eth1 [ 45.383234][ T4395] 8021q: adding VLAN 0 to HW filter on device eth2 [ 45.485876][ T4395] 8021q: adding VLAN 0 to HW filter on device eth3 [ 45.777884][ T4395] 8021q: adding VLAN 0 to HW filter on device eth4 [ 45.879506][ T4395] 8021q: adding VLAN 0 to HW filter on device eth7 [ 45.947978][ T12] bridge_slave_1: left allmulticast mode [ 45.948009][ T12] bridge_slave_1: left promiscuous mode [ 45.948101][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.948916][ T12] bridge_slave_0: left allmulticast mode [ 45.948934][ T12] bridge_slave_0: left promiscuous mode [ 45.949000][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.957272][ T12] bridge_slave_1: left allmulticast mode [ 45.957298][ T12] bridge_slave_1: left promiscuous mode [ 45.957371][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.961298][ T12] bridge_slave_0: left allmulticast mode [ 45.961322][ T12] bridge_slave_0: left promiscuous mode [ 45.961388][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.989292][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 45.997284][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 45.999852][ T12] bond0 (unregistering): Released all slaves [ 46.027456][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 46.054878][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 46.065202][ T12] bond0 (unregistering): Released all slaves [ 46.067132][ T4395] 8021q: adding VLAN 0 to HW filter on device eth5 [ 46.081576][ T12] tipc: Left network mode [ 46.174188][ T4395] 8021q: adding VLAN 0 to HW filter on device eth6 [ 46.271320][ T4395] 8021q: adding VLAN 0 to HW filter on device eth8 [ 46.349847][ T12] hsr_slave_0: left promiscuous mode [ 46.351023][ T12] hsr_slave_1: left promiscuous mode [ 46.351421][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 46.352241][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 46.357632][ T12] hsr_slave_0: left promiscuous mode [ 46.358865][ T12] hsr_slave_1: left promiscuous mode [ 46.359098][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 46.360254][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 46.467978][ T12] team0 (unregistering): Port device team_slave_1 removed [ 46.470261][ T12] team0 (unregistering): Port device team_slave_0 removed [ 46.499807][ T4395] 8021q: adding VLAN 0 to HW filter on device eth9 [ 46.607105][ T4395] 8021q: adding VLAN 0 to HW filter on device eth11 [ 46.644491][ T4720] Bluetooth: hci2: command tx timeout [ 46.700976][ T4395] 8021q: adding VLAN 0 to HW filter on device eth10 [ 48.734254][ T4720] Bluetooth: hci2: command tx timeout