last executing test programs: 2m31.115932463s ago: executing program 3 (id=167): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x800714, &(0x7f00000000c0)={[{@test_dummy_encryption}]}, 0x1, 0x4c0, &(0x7f00000006c0)="$eJzs3M1rXFUfAODfnXz0K23y9u3b923fVqNVLH4kTfphFy5UFAQVBF3UZUzSWjttpInQlqBRpK4L7sWl4NKVOzeiLsQ/QMGlFIoGoakgRO5XOklm0nx22szzwGTOuffce86595zJmXvm3gBaVm/6J4noioifI6I7j85P0Ju/zUxPDt+anhxOYnb29d+TLN3N6cnhMmm53Y4icrgSUfk4iWeTxfmOX75ybqhaHb1YxPsnzr/bP375ylNnzw+dGT0zemHw5MljRweePjF4fN52dXa1yLY6y9J63dz//tiBfS+9ee3V4VPX3vr+y3Rfew/m62vrcUe3FpXi5XrJetOj9sdsZuG6R5ed2f1hZ004aW9iQViRtohIT1dH1v+7oy1un7zuePGjphYO2FDp/6YtjVdPzQKbWBLNLgHQHOU/+vT7b/mKv+/S4OMecOO5iM4iPDM9OTwzdx2gPSrF8o4NzL83Ik5N/fVZ+oqVXocAAFiFbGzz5ILxX6YSe7P3fK5jVzGH0hMR/4qI3RHx74jYExH/icjS/jci/pdvPNu9zPx7F8QXj38q1+uWeZ2k479nasZ+MzX1L9562orYzqz+Hcnps9XRI8UxORwdW9L4wBJ5fPNCZ8N1teO/9JXmX44FiwJcb88v0M3tZGRoYmi9DsKNDyP2t9erfzI3E5C2gH0RsX9lu95VBs4+/sWBRonuXP8lrMM80+znEY/l538qFtS/lDSYn0zb+InB4/1bozp6pL9sFYv98NPV1xrlv6b6r4P0/G+f3/4XpOj+M8nnazuiWh29OL7yPK7+8knD7zQraP9z0vbfmbyRzVn/+Ha+7NLQxMTFgYjO5JUsXnSWrZEuH7y97aUiXqZP63/4UP3+v7vYJq3//yMibcQHI3Y9EBEPFmV/KCIejohDS9T/u+cfeWeJ+ieRRFPP/0jdz7+59t+T1M7XryLQdu7brxvN2y/v/B+LqeyzNpd9/t3Bcgu4xsMHAAAA94VKRHRFUunLw71dUan09eW/4d8T2yvVsfGJJ06PvXdhJL9HoCc6KuWVru6a66EDyVSxxzw+WFwrLtcfLa4bf9q2LYv3DY9VR5pcd2h1O+b3/yj7f+q3tmaXDthwjefRlrg1ANgUFvb/SpPKAdx9y/kdje8CsDnV6f/1nqEBbEKe1wKtq17//2BBfNH43wgBNoXF/f/XOo+sAzYj439oXfo/tC79H1rSWu7rX32gvFlgycRlEeum2brsO/xbJVA+HmYj89oWt5dEJQt0xT1Q99UEupeTOCK+WnNebetQ5rTH3N3jU/PAIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgPvYPwEAAP//O47fqw==") syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000280)='./bus\x00', 0x0, 0x0, 0x1, 0x0, &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = syz_io_uring_setup(0x2d39, &(0x7f00000004c0)={0x0, 0x8f8d, 0x0, 0x3, 0x8b}, &(0x7f0000000540), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, r3, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, 0x0, 0x1c2) mount$overlay(0x0, &(0x7f0000000400)='./bus\x00', &(0x7f0000000b80), 0x200008, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r5 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MEMWRITEOOB64(r5, 0xc0184d15, &(0x7f0000000140)={0x19, 0x0, 0x0, 0x0}) 2m28.410801094s ago: executing program 3 (id=178): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg(r0, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f00000007c0)={0x1, {&(0x7f0000000080)=""/158, 0x9e, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg(r0, 0x0, 0x0) write$vhost_msg(r0, &(0x7f0000000980)={0x1, {&(0x7f00000005c0)=""/253, 0xfd, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000006c0)={0x2, 0x0, {&(0x7f0000000340)=""/72, 0x48, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f0000000840)={0x1, {&(0x7f0000000440)=""/123, 0x7a, 0x0, 0x3, 0x2}}, 0xffffff0a) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000280)=""/184, 0x2562bac182d8b35a, 0x0, 0x2, 0x3}}, 0x48) 2m27.358462554s ago: executing program 3 (id=182): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)={0x44, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}]}]}]}, 0x44}}, 0x0) 2m27.140900115s ago: executing program 3 (id=183): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000280)='./control\x00', 0x210000, &(0x7f0000000bc0)={[{@nodelalloc}, {@nodioread_nolock}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x7}}, {@nolazytime}, {@bh}, {@min_batch_time={'min_batch_time', 0x3d, 0x8}}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x32040a7, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000680)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x9c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x74, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x3c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x4}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, 'n'}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x110}}, 0x0) getdents64(r0, 0x0, 0x22) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/vmallocinfo\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f8efde300a06082a8648ce3d040302306b3180303606035504030c2f436572746966696361746520766572696669636174696f6e4d7f469653412073656c662d74657374696e67206b65793020170d3634303431333232313632365a180f32313234303332303232314632365a303a3138303606035504030c2f4365727469666963618b6520766572696669636174696f6e2045434453412073656c662d74657374696e672aa648ce3d020106082a8648ce3d0301070342000407e56b51af71039ee2fe6e6a714ec7299fd85b1e69adfa1690e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8478efdfdd2b2300c0603551d130101ff04023000300b0603551d0f04040b020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b", 0x19d, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) sendfile(r2, r3, 0x0, 0x20000023896) 2m26.333272644s ago: executing program 2 (id=184): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x1, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f00000008c0)={0x15, 0x1, 0x2, "0e6a60beefe240583e08fd65b728aec1b2e81ba8de67a818a1c85f5a22f39ca6", 0x3132564e}) 2m25.142073281s ago: executing program 2 (id=188): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f00000006c0)={0x2020}, 0x2020) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f00000004c0), 0xc0800) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0xa, &(0x7f0000000400)=0x2, 0x4) ioctl$sock_inet6_tcp_SIOCINQ(r4, 0x541b, 0x0) syz_open_procfs(0x0, 0x0) fanotify_init(0x0, 0x0) r5 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) r6 = fsmount(r5, 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000"], 0x0}, 0x94) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000040)='GPL\x00'}, 0x94) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="4be88fa3027b0180c200000186dd60122d9200083a0100080000000000000000000000000001000000000000000000"], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r7, r6, 0x15, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0}}, 0x30) 2m24.197405787s ago: executing program 3 (id=190): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg(r0, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f00000007c0)={0x1, {&(0x7f0000000080)=""/158, 0x9e, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg(r0, 0x0, 0x0) write$vhost_msg(r0, &(0x7f0000000980)={0x1, {&(0x7f00000005c0)=""/253, 0xfd, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000006c0)={0x2, 0x0, {&(0x7f0000000340)=""/72, 0x48, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f0000000840)={0x1, {&(0x7f0000000440)=""/123, 0x7a, 0x0, 0x3, 0x2}}, 0xffffff0a) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000280)=""/184, 0x2562bac182d8b35a, 0x0, 0x2, 0x3}}, 0x48) 2m24.058682043s ago: executing program 2 (id=191): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x40900) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(r0, 0xc00464be, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000240)={0x12}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x4}, 0x28) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8101, 0x0) 2m21.360916694s ago: executing program 3 (id=194): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) socket(0x10, 0x803, 0x0) r0 = socket(0x10, 0x803, 0x0) socket(0x1a, 0x803, 0x8001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r1, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99", 0x60, 0x840, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x9, 0x12, r1, 0x9a903000) bpf$ENABLE_STATS(0x20, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$vim2m(0x0, 0x7, 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000380)='net/tcp6\x00') preadv(r5, &(0x7f00000001c0)=[{&(0x7f00000010c0)=""/225, 0xe1}, {0x0}], 0x2, 0x7, 0x20000000) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@ipv6_newaddr={0x20, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbfc, {0xa, 0x40}, [@IFA_FLAGS={0x8, 0x8, 0x309}]}, 0x20}}, 0x0) bind$802154_dgram(0xffffffffffffffff, 0x0, 0x0) 2m20.430801768s ago: executing program 32 (id=194): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) socket(0x10, 0x803, 0x0) r0 = socket(0x10, 0x803, 0x0) socket(0x1a, 0x803, 0x8001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r1, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99", 0x60, 0x840, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x9, 0x12, r1, 0x9a903000) bpf$ENABLE_STATS(0x20, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$vim2m(0x0, 0x7, 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000380)='net/tcp6\x00') preadv(r5, &(0x7f00000001c0)=[{&(0x7f00000010c0)=""/225, 0xe1}, {0x0}], 0x2, 0x7, 0x20000000) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@ipv6_newaddr={0x20, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbfc, {0xa, 0x40}, [@IFA_FLAGS={0x8, 0x8, 0x309}]}, 0x20}}, 0x0) bind$802154_dgram(0xffffffffffffffff, 0x0, 0x0) 2m20.412883449s ago: executing program 2 (id=199): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000400)={[{@nobarrier}, {@dioread_lock}, {@barrier_val}, {@nolazytime}, {@dax_inode}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x4}}, {@bh}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') symlinkat(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x300, 0x51) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x83) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40086602, &(0x7f0000000000)) 2m19.328948041s ago: executing program 2 (id=205): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8000000000100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) 2m17.150364107s ago: executing program 2 (id=208): r0 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f00000000c0), 0x0, 0x0) 2m16.445208221s ago: executing program 33 (id=208): r0 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f00000000c0), 0x0, 0x0) 1m51.232256107s ago: executing program 1 (id=268): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002a40)=@delchain={0x618, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xa, 0x2}, {0x0, 0x1}, {0x5}}, [@filter_kind_options=@f_bpf={{0x8}, {0x5ec, 0x2, [@TCA_BPF_ACT={0x5e8, 0x1, [@m_bpf={0xfc, 0x11, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_NAME={0x5, 0x6, '\x00'}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0xffffffff, 0x3, 0xffffffffffffffff, 0x10001, 0x6}}]}, {0x9d, 0x6, "a41f25d22b1bae1b6bfb4a42ad5ba9db462fca41280c331f630e2c9f0be1093117392575082305ebc27660464ef802792ce06133244235023f0f4882fc0a47f4d5e499a8857cd81b0e6fda422cbc53ad098872214190756df6bbd0e760248aa97e200702fd569bd27d4a70df1d4a123ffc42d2592c81751e15e260622f14aeaaca5dc8acab93651fdd1d5614d98f28fc76d402e1028d910282"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_xt={0x110, 0x5, 0x0, 0x0, {{0x7}, {0x4}, {0xe5, 0x6, "a5fd64840366fd7ad44f3f053221ded9ced495590e2bc8690a2765e56ded8425cb3eb0e04bbcfec50e639bf373167e617b24eccd260f28bb850873b1e2154b158987d6e585e10ffeaba32641bae47de041e1169d8e4a65b8ce3633a4469c93c5228320c572237d92a9ae6bbc2d2bd3a2d1e27de283017ecf9fca6b2cd8a119dee59702830717b694625f60f5c81f688775c5e292f76a0ffa39e1d2cabd639d1c111c01e0d2f9faa220154db33399242bca9f4fac65c74cb6264c28ac7a50037564c7b417fb61d617d212ab3243c30e0e82d9a12651b74553d539b991a302489af9"}, {0xc, 0x7, {0x0, 0xeb0757422c733451}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_bpf={0xb8, 0x8, 0x0, 0x0, {{0x8}, {0x14, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}, @TCA_ACT_BPF_FD={0x8}]}, {0x80, 0x6, "5d3aee85a6264cff4a2163adaec321e008985cfa435b8922eeb16f1932265618158a3fe72c442a68b182e8f673f9251a03dc831c5947be17ca906c3dcb99adb55bc5f0ad8886f235f45d7e29bb727715f2e7a3200ac63eb79f7a023835874514b60b0177c40370157c0c21b37875e7e4a2e75b3cc54be7d719fa6954"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_tunnel_key={0xb4, 0x8, 0x0, 0x0, {{0xf}, {0x4}, {0x81, 0x6, "51719d53a2b05eda58a80a40d29b01394b8749d7d9ef9f47cce75187b6f333f4bfe797fa4227bf38cf0b71e1b4888d8d1ed410a788c182ba498076ca9ab3d63a8f29175d44a2e8364296c34ac0cdb8972288ecf6515bec4861a53e1e18e54679f5666b0536d0a008aa9b3be1f5e00c4c72460249c372de16eb2cfc1571"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0xddc47d017e85c037}}}}, @m_xt={0x26c, 0x13, 0x0, 0x0, {{0x7}, {0x130, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x2a, 0x6, {0x9, 'nat\x00', 0xef, 0x7}}, @TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}, @TCA_IPT_TARG={0x2a, 0x6, {0x4800, 'security\x00', 0x1, 0xa}}, @TCA_IPT_TARG={0x89, 0x6, {0x8, 'filter\x00', 0xd, 0x6ccd, "51100666dd78f1337c421065ba00caa97aaa8e1aa207a78c6d7e2a3e620334de1a64a8d40af7536c5a07a1997c6fd28e7ed1f866f9454e1014a5129fbeaf1a76cb7b54d80907f7d86c39ff782b12b0422666997d539a25e55b0591b44929ef"}}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}]}, {0x115, 0x6, "3f664d65ad79178dad4d7815e4c50308bf9a3f35e2b90387936ecd06a67777e4d51dfa578f9f5021013f0c9a057b8f82000000000000000000000000007f81188b2cda51230f1a7c6035500fcba2a0c1e8df61c1a24ebdf1b89f29be8825795496195eb50cd86bf94eb7c2f2f3cd2a74145b5e23908868d084fa1aeb5cf35b1d008b539cc91d0cb1e1304dc65d40df4446cb4725e42a047c2fc7ba3b1e387f5628b3c86a55e4972d016f00000378526b1797e51bbca47fa852a731a6d7b7678b453e7c5c4642b54dcee1032681e6853f7c2f7f8aa5667dceac0f2e9f55d94a322ff7f926c35a7b8745989c4b1c88fbc02fb1d34f0dc8917bc6a1b7ffa0d4bbddada56c96a3f61363e90cdb6db84cab4aff"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}]}]}}]}, 0x618}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}}], 0x1, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}], 0x7, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) 1m50.090078962s ago: executing program 1 (id=270): r0 = syz_open_dev$video(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000000c0)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000001000)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x2, {&(0x7f00000002c0)}, 0x400000}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f00000001c0)=0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001f80)=ANY=[@ANYBLOB="b702000009000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2e6405000000000065060400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002c3f2cc2b7956244cef7baf48e6d2885a09a87507ebfc75b5b0f4e4309ebcdac5f7a860c008cbdd3b4c3b7f28754860c9c781f6410457253e89ad528d985636a86ec0f68f59cd1159a2c2e85d726859a919cc9548a349980d1ccdce27f94bc074c27f81078545c146a0857153b7b8f00034debae58a4ab415b0d7ff0575cc272cd3d7e8d974927676468ff2d86e0ffac94792ed9cf6b40b3cf252a47c05ae8a70d57cc3e067d1867b54d24e20000000000000020009ebf84d3b042d6e432cd080e3b57239f0127473e6ba922aff649609d40b47ec331ccba3cf96f9483ff19a6471bf5abc742d9cbcfb964b11b31034694a6aad86cf08a6c7b2235dc99de9aa3e6b77c7a2877261ed32da90864987f30926c9013eec3b86836ae50447aa5a79f40c235000000453302712c3d8fc4e2b61adb0695e800000000d4f4e91f0000002c33df424d1bafe5725c8a40"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000200)=0x1) 1m46.582976121s ago: executing program 1 (id=278): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000007c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x4}, 0xe) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, 0x0, 0x0) listen(r0, 0xb) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) syz_emit_vhci(&(0x7f0000000340)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_ecred_conn_req={{0x17, 0x42, 0x8}, {0x80, 0x8200, 0x200, 0xa}}}}, 0x15) 1m46.079464185s ago: executing program 1 (id=279): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000400)={[{@nobarrier}, {@dioread_lock}, {@barrier_val}, {@nolazytime}, {@dax_inode}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x4}}, {@bh}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) symlinkat(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x300, 0x51) 1m44.284101882s ago: executing program 1 (id=284): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000400)={[{@nobarrier}, {@dioread_lock}, {@barrier_val}, {@nolazytime}, {@dax_inode}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x4}}, {@bh}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') symlinkat(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x300, 0x51) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40086602, &(0x7f0000000000)) 1m43.573395396s ago: executing program 1 (id=288): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x7ffffffe) syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', 0x0, 0x0, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x4}) ioctl(r1, 0x8b32, &(0x7f0000000040)) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl(0xffffffffffffffff, 0xc013fd03, &(0x7f0000001000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000070") ioctl(0xffffffffffffffff, 0xc013fd04, 0x0) open_tree(0xffffffffffffffff, &(0x7f0000000180)='./dev/mapper/control\x00', 0x800) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1, 0x0, 0xff, 0x6, 0x6, 0xffff}, 0x19) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r2, 0x8b32, &(0x7f0000000040)) 1m42.897548478s ago: executing program 34 (id=288): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x7ffffffe) syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', 0x0, 0x0, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x4}) ioctl(r1, 0x8b32, &(0x7f0000000040)) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl(0xffffffffffffffff, 0xc013fd03, &(0x7f0000001000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000070") ioctl(0xffffffffffffffff, 0xc013fd04, 0x0) open_tree(0xffffffffffffffff, &(0x7f0000000180)='./dev/mapper/control\x00', 0x800) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1, 0x0, 0xff, 0x6, 0x6, 0xffff}, 0x19) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r2, 0x8b32, &(0x7f0000000040)) 1m35.140146122s ago: executing program 5 (id=302): socket$netlink(0x10, 0x3, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b6, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) pipe2(&(0x7f0000000040), 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f00000000c0)={0x1, 0x1, &(0x7f0000000140)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x1}) 1m34.745531372s ago: executing program 5 (id=304): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) openat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget/ep1in-bulk\x00', 0x2, 0x0) 1m33.805702447s ago: executing program 5 (id=307): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x800714, &(0x7f00000000c0)={[{@test_dummy_encryption}]}, 0x1, 0x4c0, &(0x7f00000006c0)="$eJzs3M1rXFUfAODfnXz0K23y9u3b923fVqNVLH4kTfphFy5UFAQVBF3UZUzSWjttpInQlqBRpK4L7sWl4NKVOzeiLsQ/QMGlFIoGoakgRO5XOklm0nx22szzwGTOuffce86595zJmXvm3gBaVm/6J4noioifI6I7j85P0Ju/zUxPDt+anhxOYnb29d+TLN3N6cnhMmm53Y4icrgSUfk4iWeTxfmOX75ybqhaHb1YxPsnzr/bP375ylNnzw+dGT0zemHw5MljRweePjF4fN52dXa1yLY6y9J63dz//tiBfS+9ee3V4VPX3vr+y3Rfew/m62vrcUe3FpXi5XrJetOj9sdsZuG6R5ed2f1hZ004aW9iQViRtohIT1dH1v+7oy1un7zuePGjphYO2FDp/6YtjVdPzQKbWBLNLgHQHOU/+vT7b/mKv+/S4OMecOO5iM4iPDM9OTwzdx2gPSrF8o4NzL83Ik5N/fVZ+oqVXocAAFiFbGzz5ILxX6YSe7P3fK5jVzGH0hMR/4qI3RHx74jYExH/icjS/jci/pdvPNu9zPx7F8QXj38q1+uWeZ2k479nasZ+MzX1L9562orYzqz+Hcnps9XRI8UxORwdW9L4wBJ5fPNCZ8N1teO/9JXmX44FiwJcb88v0M3tZGRoYmi9DsKNDyP2t9erfzI3E5C2gH0RsX9lu95VBs4+/sWBRonuXP8lrMM80+znEY/l538qFtS/lDSYn0zb+InB4/1bozp6pL9sFYv98NPV1xrlv6b6r4P0/G+f3/4XpOj+M8nnazuiWh29OL7yPK7+8knD7zQraP9z0vbfmbyRzVn/+Ha+7NLQxMTFgYjO5JUsXnSWrZEuH7y97aUiXqZP63/4UP3+v7vYJq3//yMibcQHI3Y9EBEPFmV/KCIejohDS9T/u+cfeWeJ+ieRRFPP/0jdz7+59t+T1M7XryLQdu7brxvN2y/v/B+LqeyzNpd9/t3Bcgu4xsMHAAAA94VKRHRFUunLw71dUan09eW/4d8T2yvVsfGJJ06PvXdhJL9HoCc6KuWVru6a66EDyVSxxzw+WFwrLtcfLa4bf9q2LYv3DY9VR5pcd2h1O+b3/yj7f+q3tmaXDthwjefRlrg1ANgUFvb/SpPKAdx9y/kdje8CsDnV6f/1nqEBbEKe1wKtq17//2BBfNH43wgBNoXF/f/XOo+sAzYj439oXfo/tC79H1rSWu7rX32gvFlgycRlEeum2brsO/xbJVA+HmYj89oWt5dEJQt0xT1Q99UEupeTOCK+WnNebetQ5rTH3N3jU/PAIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgPvYPwEAAP//O47fqw==") syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000280)='./bus\x00', 0x0, 0x0, 0x1, 0x0, &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$EXT4_IOC_GET_ES_CACHE(r3, 0xc020662a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, 0x0, 0x1c2) mount$overlay(0x0, &(0x7f0000000400)='./bus\x00', &(0x7f0000000b80), 0x200008, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r4 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MEMWRITEOOB64(r4, 0xc0184d15, &(0x7f0000000140)={0x19, 0x0, 0x0, 0x0}) 1m30.055608368s ago: executing program 5 (id=314): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000400)={[{@nobarrier}, {@dioread_lock}, {@barrier_val}, {@nolazytime}, {@dax_inode}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x4}}, {@bh}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x300, 0x51) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x83) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40086602, &(0x7f0000000000)) 1m28.693494163s ago: executing program 5 (id=316): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_read_part_table(0x104b, &(0x7f0000000000)="$eJzsz82pAjEUBeDzMrPIAxH7sQW3s7IZ67EX67AKiSQjAxYgInzf4v6EQ+CGr/pLUv63tSR1DFMv9T2736aaXEYicy+30cp4OD568pCc+3ZqrdX1s5f7svZdpjnL9VN3AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAveQYAAP//xSsI5Q==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1d3942, 0x4) io_setup(0x2, &(0x7f0000000140)=0x0) io_submit(r1, 0x1, &(0x7f0000002680)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x4000, 0x600}]) 1m27.93350845s ago: executing program 5 (id=319): socket$netlink(0x10, 0x3, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b6, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) pipe2(&(0x7f0000000040), 0x0) fsopen(&(0x7f0000000180)='ext2\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f00000000c0)={0x1, 0x1, &(0x7f0000000140)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x1}) 1m26.666305511s ago: executing program 35 (id=319): socket$netlink(0x10, 0x3, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b6, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) pipe2(&(0x7f0000000040), 0x0) fsopen(&(0x7f0000000180)='ext2\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f00000000c0)={0x1, 0x1, &(0x7f0000000140)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x1}) 9.833415536s ago: executing program 0 (id=605): syz_mount_image$vfat(&(0x7f0000000580), &(0x7f0000000180)='./file1\x00', 0x1000802, &(0x7f0000000b80)=ANY=[@ANYBLOB="6e6f6e756d7461696c3d302c6e6f6e756d7461696c003130dbbb3121258e322c262b537f5d0000006e695f7804590000000000003d312c696f63686172538c6c90392bc69373686f72746e616d65653ff959f53d6d697865642c636f6465706167653d3821332c696f6368617273650000000031323831e54f1bb0a3d72c007e3db5a829498e2a721ae5804ff8ccb41e27af3a3a924308cb010100003ceeeac934b3165b4a0ea182cdd0666ab32f2d041a99ac9fc865ba946f1bb7759d02742dfcc68937ff86d7a54d6de8823119c767d45d6047209f4436383ee21373a9c3f450cb6d7c37b59a34407d4a0e6a382108ddd52580281f1d8ad71c4ceafb49960f1429b090d1429f519f9c2b0cb88ffa6fc04fa61c275bf560b9eeeb2d0c8b3ddeb56783f9908c21cf9b2ba0b76b9b60c991bb17c7d0accad1cdaf3259b7dc405d72e2bc3abe0cf37bda3dbfc05e2e55f8aa272b5ea736019c3c0a9b34115a445e0c5da1bd7352ec9529f5caa71f1ae71b36b500c79fffb487ed081232b5d93d3162c7f71f4d572ed87cf12b9ce4e527266a0c15dac9171edda86b148d17a48d4d90470e79620eeab5acf6f78f807298315e2b80fe1874098d75ab47837a96699e2a7db456f2a4368bece813135ed970951c7471ac16703820a799421cb24f327b3669c159abfa125ee992a5f49ab45bec637c38bcbdae4da3a05f96b2162c47d0b1277e1b1bcc981cce8f6f7f3dd8d06352eb387997b498a732d8442115755ff14d508891abd401b3cafcba75a6901fbe08002674d8663b8c40e9cf13fa4c4a092cb8004a1d2a6fe18cd5d702493d52a7110b17e64b9fa22fb3ace98b9ca35cb98c65f0902dd430373f6ae43c4a60c423b6f65b5ecc2093698072abc857ab2d36a261a7fc5776d39c3d5d5fad291c88ff9726d5ee32c6bcac1799ade9459eb39b56d985d29b988c72c9ad7e82b589f454a58d7cd5ace9436cf69acc217737c863d8938cc95767a0c9b14cb79f5b450c894a3e95d26e14259fdb65aa49761847cc1c13f18742072e80cbed0d5622618817583d0365f807882e539ff07c9205d3ee72efb8dd6853a02f49abd1b38d4571666a4d7d98c4f34f082eea5a5ac7b9e9fd030791df5d98a03ed76cdbb3241f96f22b6dd0da2bd8105c3408eeb8543ebc5de0849c1f31bd94033655fd11430fd18e55f5361750c7a2a7"], 0xc, 0x27e, &(0x7f00000005c0)="$eJzs3U9rY1UUAPDz0tTUQklBobQIPuk+tBX3LdJCMSBYstCNFpuiNLXQQkEXNq5cu3KjGz+AbgS3ggtx6xcQQerAbNpZdTGQIU0madKX6Z8hzTD9/TY5vHtO7r3vPd5NFrn55I3dna29g+3T0+PITSTj+eX4de4sienIxVi01AMAeJmcNRpx0mgZ9VgAgLth/QeA+6e7/ieX1v+k3v5M8NpP87OjGBwAMBS+/wPA/bPx4UfvrZTLqx+cpBMRu98eVg4rrddW+8p2fB61qMZCFONxRKOjFX+/Xl5dSJv+n47K7lG7/uiwMtZbvxjFmL5cv7ZeXl1MW3rrx2OyXf/PZFRjKYrxenb9Ulb9eETMX+i/FMX4+9PYi1psRbO2W//xYpq++365r//CeR4AAAAAAAAAAAAAAAAAAAAAAAxDKXe+dU6jkKaZ+/eUSulTfe2t+ov7A72asT/QWmd/oP79ffIxlx/t3AEAAAAAAAAAAAAAAAAAAOBFcfDlVzubtVp1/1nBF3/9/MdVOdcMkna/mTmFiHj+Lq4ZTL313w+Dc765yfm5RbDcDqbiUtPvbw597r1B87TftOrP489m3z6YeadzJN+bE/mhjTl3xUXJZ03nYXHArdW+Ieu3H88vnWv66Mrk7zbu6g4f6z8y8+Py5m9f//vguu+T/bwo3MlTCQAAAAAAAAAAAAAAAAAA7qfuj35HPRIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGJ3u//8PCJJoBvmIGJxTq+4nkUTEK5HRVB/1HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4EkAAAD//zZqmhk=") fspick(0xffffffffffffffff, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000540)={[{@upperdir={'upperdir', 0x3d, './file0'}}]}) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0xcf0be2279761c16b) sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x1, 0x13, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000600)={r3, r3, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x120, 0x5, 0x5, 0x2, 0xfffffffe, 'syz0\x00'}) r5 = semget$private(0x0, 0x6, 0x1a8) semtimedop(r5, &(0x7f00000003c0)=[{0x4, 0x4, 0x1800}], 0x1, 0x0) semop(0x0, &(0x7f00000000c0)=[{0x1, 0x402, 0x1800}], 0x1) 8.580229117s ago: executing program 0 (id=607): pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$FUSE_INIT(r0, &(0x7f0000000400)={0x6f, 0x0, 0x0, {0x7, 0x28, 0x80000001, 0x0, 0x0, 0x0, 0x2, 0x1}}, 0xfffffede) fcntl$setpipe(r0, 0x407, 0x2000000) 6.85030746s ago: executing program 4 (id=610): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r0, 0x0, 0x0) ppoll(&(0x7f0000000140)=[{r0, 0x82d2}, {r0, 0xc122}], 0x2, 0x0, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001c00)={{r3, 0xffffffffffffffff}, &(0x7f0000001b80), &(0x7f0000001bc0)}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000440)={{r2, 0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)='%+9llu \x00'}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000800)={{r6, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f00000007c0)}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r4, &(0x7f00000000c0)}, 0x20) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@btf_id={0x18, 0x0, 0x3, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r7}}, @map_idx={0x18, 0x7, 0x5, 0x0, 0xe}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000180)='syzkaller\x00', 0x6, 0xfffffffffffffffe, &(0x7f0000000300)=""/84, 0x40f00, 0x2, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x8, &(0x7f00000003c0)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000400)={0x2, 0x6, 0x6}, 0x10, 0xd00f, 0xffffffffffffffff, 0x2, &(0x7f0000000440)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0x1, 0xffffffffffffffff], &(0x7f00000004c0)=[{0x1, 0x3, 0x6, 0x4}, {0x0, 0x3, 0xe, 0x1}], 0x10, 0x400}, 0x94) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x13, 0xffffffffffffffff, 0x974d3000) bind$inet(r8, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r8, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) recvfrom(r8, &(0x7f0000000200)=""/106, 0x6a, 0x40000716, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'pim6reg\x00', 0x0}) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x8, 0x30, r3, 0xea7b7000) bind$can_raw(0xffffffffffffffff, &(0x7f0000000600)={0x1d, r9}, 0x10) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000640)) 6.785781653s ago: executing program 7 (id=611): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/devices/system/memory/auto_online_blocks\x00', 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000400)=""/68, 0x44}], 0x1, 0x5c, 0x65a) 6.213472671s ago: executing program 7 (id=613): bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[], 0xf0}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$team(&(0x7f0000000200), r1) 5.907928355s ago: executing program 0 (id=614): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) faccessat2(0xffffffffffffffff, 0x0, 0x0, 0x1100) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x80580, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) 5.231831728s ago: executing program 4 (id=615): syz_mount_image$vfat(&(0x7f0000000580), &(0x7f0000000180)='./file1\x00', 0x1000802, &(0x7f0000000b80)=ANY=[@ANYBLOB="6e6f6e756d7461696c3d302c6e6f6e756d7461696c003130dbbb3121258e322c262b537f5d0000006e695f7804590000000000003d312c696f63686172538c6c90392bc69373686f72746e616d65653ff959f53d6d697865642c636f6465706167653d3821332c696f6368617273650000000031323831e54f1bb0a3d72c007e3db5a829498e2a721ae5804ff8ccb41e27af3a3a924308cb010100003ceeeac934b3165b4a0ea182cdd0666ab32f2d041a99ac9fc865ba946f1bb7759d02742dfcc68937ff86d7a54d6de8823119c767d45d6047209f4436383ee21373a9c3f450cb6d7c37b59a34407d4a0e6a382108ddd52580281f1d8ad71c4ceafb49960f1429b090d1429f519f9c2b0cb88ffa6fc04fa61c275bf560b9eeeb2d0c8b3ddeb56783f9908c21cf9b2ba0b76b9b60c991bb17c7d0accad1cdaf3259b7dc405d72e2bc3abe0cf37bda3dbfc05e2e55f8aa272b5ea736019c3c0a9b34115a445e0c5da1bd7352ec9529f5caa71f1ae71b36b500c79fffb487ed081232b5d93d3162c7f71f4d572ed87cf12b9ce4e527266a0c15dac9171edda86b148d17a48d4d90470e79620eeab5acf6f78f807298315e2b80fe1874098d75ab47837a96699e2a7db456f2a4368bece813135ed970951c7471ac16703820a799421cb24f327b3669c159abfa125ee992a5f49ab45bec637c38bcbdae4da3a05f96b2162c47d0b1277e1b1bcc981cce8f6f7f3dd8d06352eb387997b498a732d8442115755ff14d508891abd401b3cafcba75a6901fbe08002674d8663b8c40e9cf13fa4c4a092cb8004a1d2a6fe18cd5d702493d52a7110b17e64b9fa22fb3ace98b9ca35cb98c65f0902dd430373f6ae43c4a60c423b6f65b5ecc2093698072abc857ab2d36a261a7fc5776d39c3d5d5fad291c88ff9726d5ee32c6bcac1799ade9459eb39b56d985d29b988c72c9ad7e82b589f454a58d7cd5ace9436cf69acc217737c863d8938cc95767a0c9b14cb79f5b450c894a3e95d26e14259fdb65aa49761847cc1c13f18742072e80cbed0d5622618817583d0365f807882e539ff07c9205d3ee72efb8dd6853a02f49abd1b38d4571666a4d7d98c4f34f082eea5a5ac7b9e9fd030791df5d98a03ed76cdbb3241f96f22b6dd0da2bd8105c3408eeb8543ebc5de0849c1f31bd94033655fd11430fd18e55f5361750c7a2a7"], 0xc, 0x27e, &(0x7f00000005c0)="$eJzs3U9rY1UUAPDz0tTUQklBobQIPuk+tBX3LdJCMSBYstCNFpuiNLXQQkEXNq5cu3KjGz+AbgS3ggtx6xcQQerAbNpZdTGQIU0madKX6Z8hzTD9/TY5vHtO7r3vPd5NFrn55I3dna29g+3T0+PITSTj+eX4de4sienIxVi01AMAeJmcNRpx0mgZ9VgAgLth/QeA+6e7/ieX1v+k3v5M8NpP87OjGBwAMBS+/wPA/bPx4UfvrZTLqx+cpBMRu98eVg4rrddW+8p2fB61qMZCFONxRKOjFX+/Xl5dSJv+n47K7lG7/uiwMtZbvxjFmL5cv7ZeXl1MW3rrx2OyXf/PZFRjKYrxenb9Ulb9eETMX+i/FMX4+9PYi1psRbO2W//xYpq++365r//CeR4AAAAAAAAAAAAAAAAAAAAAAAxDKXe+dU6jkKaZ+/eUSulTfe2t+ov7A72asT/QWmd/oP79ffIxlx/t3AEAAAAAAAAAAAAAAAAAAOBFcfDlVzubtVp1/1nBF3/9/MdVOdcMkna/mTmFiHj+Lq4ZTL313w+Dc765yfm5RbDcDqbiUtPvbw597r1B87TftOrP489m3z6YeadzJN+bE/mhjTl3xUXJZ03nYXHArdW+Ieu3H88vnWv66Mrk7zbu6g4f6z8y8+Py5m9f//vguu+T/bwo3MlTCQAAAAAAAAAAAAAAAAAA7qfuj35HPRIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGJ3u//8PCJJoBvmIGJxTq+4nkUTEK5HRVB/1HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4EkAAAD//zZqmhk=") fspick(0xffffffffffffffff, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000540)={[{@upperdir={'upperdir', 0x3d, './file0'}}]}) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0xcf0be2279761c16b) sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x1, 0x13, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000600)={r3, r3, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x120, 0x5, 0x5, 0x2, 0xfffffffe, 'syz0\x00'}) ioctl$sock_bt_hidp_HIDPGETCONNINFO(0xffffffffffffffff, 0x800448d3, &(0x7f0000000180)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x5, 0x1, 0xfffc, 0x7f, 0xfff8, "5812ea7e24acbbdf9434acb8d4313f3239e0b8d559c63bcd82e0670fdc0ec3bf1f96e8c581780505317771fbc15d046ec6b9a1678de56cf61d856ae9e80488205c22e2276c3c6971fe4b335d2d85857ef55d3d6758642669a944694056b4f0ac3a9670c2cbac735e9081815330289538795fb0a14cc9aac526d78ac1d062e82e"}) r4 = semget$private(0x0, 0x6, 0x1a8) semtimedop(r4, &(0x7f00000003c0)=[{0x4, 0x4, 0x1800}], 0x1, 0x0) semop(0x0, &(0x7f00000000c0)=[{0x1, 0x402, 0x1800}], 0x1) 5.19486388s ago: executing program 6 (id=616): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x10, 0x11, &(0x7f00000003c0)=@raw=[@generic={0x77, 0xe, 0x3, 0xff, 0x201e9016}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7ff}}, @call={0x85, 0x0, 0x0, 0xc1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffe}, @exit, @map_val={0x18, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x4}], &(0x7f0000000000)='GPL\x00'}, 0x94) r3 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2) write(0xffffffffffffffff, &(0x7f0000001000)="4f4f4f4fffffffff0000", 0xa) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000000c0)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000001000)}, 0x400000}) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f00000001c0)=0x2) 5.092154574s ago: executing program 0 (id=617): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x800714, &(0x7f00000000c0)={[{@test_dummy_encryption}]}, 0x1, 0x4c0, &(0x7f00000006c0)="$eJzs3M1rXFUfAODfnXz0K23y9u3b923fVqNVLH4kTfphFy5UFAQVBF3UZUzSWjttpInQlqBRpK4L7sWl4NKVOzeiLsQ/QMGlFIoGoakgRO5XOklm0nx22szzwGTOuffce86595zJmXvm3gBaVm/6J4noioifI6I7j85P0Ju/zUxPDt+anhxOYnb29d+TLN3N6cnhMmm53Y4icrgSUfk4iWeTxfmOX75ybqhaHb1YxPsnzr/bP375ylNnzw+dGT0zemHw5MljRweePjF4fN52dXa1yLY6y9J63dz//tiBfS+9ee3V4VPX3vr+y3Rfew/m62vrcUe3FpXi5XrJetOj9sdsZuG6R5ed2f1hZ004aW9iQViRtohIT1dH1v+7oy1un7zuePGjphYO2FDp/6YtjVdPzQKbWBLNLgHQHOU/+vT7b/mKv+/S4OMecOO5iM4iPDM9OTwzdx2gPSrF8o4NzL83Ik5N/fVZ+oqVXocAAFiFbGzz5ILxX6YSe7P3fK5jVzGH0hMR/4qI3RHx74jYExH/icjS/jci/pdvPNu9zPx7F8QXj38q1+uWeZ2k479nasZ+MzX1L9562orYzqz+Hcnps9XRI8UxORwdW9L4wBJ5fPNCZ8N1teO/9JXmX44FiwJcb88v0M3tZGRoYmi9DsKNDyP2t9erfzI3E5C2gH0RsX9lu95VBs4+/sWBRonuXP8lrMM80+znEY/l538qFtS/lDSYn0zb+InB4/1bozp6pL9sFYv98NPV1xrlv6b6r4P0/G+f3/4XpOj+M8nnazuiWh29OL7yPK7+8knD7zQraP9z0vbfmbyRzVn/+Ha+7NLQxMTFgYjO5JUsXnSWrZEuH7y97aUiXqZP63/4UP3+v7vYJq3//yMibcQHI3Y9EBEPFmV/KCIejohDS9T/u+cfeWeJ+ieRRFPP/0jdz7+59t+T1M7XryLQdu7brxvN2y/v/B+LqeyzNpd9/t3Bcgu4xsMHAAAA94VKRHRFUunLw71dUan09eW/4d8T2yvVsfGJJ06PvXdhJL9HoCc6KuWVru6a66EDyVSxxzw+WFwrLtcfLa4bf9q2LYv3DY9VR5pcd2h1O+b3/yj7f+q3tmaXDthwjefRlrg1ANgUFvb/SpPKAdx9y/kdje8CsDnV6f/1nqEBbEKe1wKtq17//2BBfNH43wgBNoXF/f/XOo+sAzYj439oXfo/tC79H1rSWu7rX32gvFlgycRlEeum2brsO/xbJVA+HmYj89oWt5dEJQt0xT1Q99UEupeTOCK+WnNebetQ5rTH3N3jU/PAIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgPvYPwEAAP//O47fqw==") syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000280)='./bus\x00', 0x0, 0x0, 0x1, 0x0, &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = syz_io_uring_setup(0x2d39, &(0x7f00000004c0)={0x0, 0x8f8d, 0x0, 0x3, 0x8b}, &(0x7f0000000540), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, r3, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, 0x0, 0x1c2) mount$overlay(0x0, &(0x7f0000000400)='./bus\x00', &(0x7f0000000b80), 0x200008, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r5 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MEMWRITEOOB64(r5, 0xc0184d15, &(0x7f0000000140)={0x19, 0x0, 0x0, 0x0}) 4.898224864s ago: executing program 7 (id=618): userfaultfd(0x801) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x78}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 3.978842388s ago: executing program 6 (id=619): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xa, 0xffea}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0xfffffff7, 0xb47e, 0xb, 0x20000003, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xffe0}, {0x2, 0xb}, {0xfff1, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x9, 0x7, 0xa, 0x40000003, 0xfffffffc, 0xfffffffa}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000030}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(0x0, r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 3.869436384s ago: executing program 7 (id=620): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000040), 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r1 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r2], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x1}) 3.817705316s ago: executing program 4 (id=621): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/devices/system/memory/auto_online_blocks\x00', 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000400)=""/68, 0x44}], 0x1, 0x5c, 0x65a) 3.545535499s ago: executing program 7 (id=622): ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000001680)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$FUSE_INIT(r0, &(0x7f0000000400)={0x6f, 0x0, 0x0, {0x7, 0x28, 0x80000001, 0x0, 0x0, 0x0, 0x2, 0x1}}, 0xfffffede) fcntl$setpipe(r0, 0x407, 0x2000000) 3.442498354s ago: executing program 4 (id=623): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r0, 0x0, 0x0) ppoll(&(0x7f0000000140)=[{r0, 0x82d2}, {r0, 0xc122}], 0x2, 0x0, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001c00)={{r3, 0xffffffffffffffff}, &(0x7f0000001b80), &(0x7f0000001bc0)}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000440)={{r2, 0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)='%+9llu \x00'}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000800)={{r6, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f00000007c0)}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r4, &(0x7f00000000c0)}, 0x20) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@btf_id={0x18, 0x0, 0x3, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r7}}, @map_idx={0x18, 0x7, 0x5, 0x0, 0xe}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000180)='syzkaller\x00', 0x6, 0xfffffffffffffffe, &(0x7f0000000300)=""/84, 0x40f00, 0x2, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x8, &(0x7f00000003c0)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000400)={0x2, 0x6, 0x6}, 0x10, 0xd00f, 0xffffffffffffffff, 0x2, &(0x7f0000000440)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0x1, 0xffffffffffffffff], &(0x7f00000004c0)=[{0x1, 0x3, 0x6, 0x4}, {0x0, 0x3, 0xe, 0x1}], 0x10, 0x400}, 0x94) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x13, 0xffffffffffffffff, 0x974d3000) bind$inet(r8, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r8, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) recvfrom(r8, &(0x7f0000000200)=""/106, 0x6a, 0x40000716, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'pim6reg\x00', 0x0}) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x8, 0x30, r3, 0xea7b7000) bind$can_raw(0xffffffffffffffff, &(0x7f0000000600)={0x1d, r9}, 0x10) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000640)) 3.441769604s ago: executing program 6 (id=624): r0 = socket$packet(0x11, 0x2, 0x300) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x10008, &(0x7f0000000380)={[{@noload}, {@test_dummy_encryption}, {@prjquota}, {@min_batch_time={'min_batch_time', 0x3d, 0x8}}, {@usrjquota}, {@nodiscard}]}, 0x1, 0x4eb, &(0x7f0000000600)="$eJzs3M9vFGUfAPDvbLu0wAv05eUlAVELaGxMbKGgcPCCiYkHTYx4kGPTFlJZwNAehDSyJAbPJN6NR+NNE696NJ78A/DgwcSQEOUCeFozuzPb7f7s0tKm7eeTLDzPzPPM8zw788w+M09nAti2RtN/koj/RMS9iNhXiy5PMFr77/HDxeknDxeno1ypnP8rqaZ7lMYzeb7dWWSsEFH4PGnaYM38jZuXp0ql2etRrsYnFq58MjF/4+Zrc1emLs1emr06efbs6VMnz7wx+Xpz1uGejWpTXtquR4c/u3bk0DsX7r43Pdi8scZ2dJTn+rvcM2nk320HLzdubwvY0xBOWtt1a10rw4oNZ4dhMe3/i6VjFza6QsC6qVQqlaHOq8uVZrdblgCbVhIbXQNgY+Q/9On1b/6pLSmux/Bjwz04V7sAevRwsXIrYvpxvf2DUcjSFJuub1Ndxkx9GY2Ij8r/fJV+ott9iN/XqEAAYNv76Vw2DEyiafxXiIOxdDN/bzaHMhIR/42I/RHxv4g4EBH/j6ilbSeJqHQp/0Dzgnr532ezCIX7q2pgD+n4781sbiv/ZOXmSUYGstieiHzAPHsi+07Gojh0ca40e7LD9nf0KL9x/Jd+0vLzsWBWj/uDTYPNmamFqadrbasHtyMODza3P93pSX16KomIQxFxuI/tjjSE51795kg90nRZ0bv9VZU2U3prMn9W+Trildr+L8ey/b9UYtI4P1lomZ+cGI7S7ImJ9Cg40baMX369836n8nu2/4c/mrO8febH86ttdl26/3c1HP+Rz98utX8kiUjq87XzEZWB/sq489sX1e2OHm9d97TH/47kw2o471+fTi0sXD8ZsSN5t3X55FLePJ6nT9s/drx9/9+f5Um/ieciIj2In4+IFyIG8rofjYhjEdGmaXU/v/XSx53WrfD4f2bS9s+0Pf8t2/9L8/UrDOSZ0yUDl4/ee9Lh5JG1f1/3/X+6GhrLlrQ//yXLThErrenqvj0AAADYHApR/dv/wng9XCiMj9fuAR2IXYXStfmFFyPi6kztGYGRKBYuzpVm8xtyI1FM8vufIw3xyab4qey+8ZcDO6vx8elrpZmNbjxsc7urfT5p6f+pP/u8zwtsQlvoOTSgT736/8G761QRYN35/Yftq6H/d3qzRdlfysDW5Pcftq92/f9WfNv12QXnDNj8KvoybGvd+3/v920Cm9dgfFAPVx97bvu0LbAVGf/DttTvc/39BSpD7VcNR5s3Bgw/m2rsbFPWhgTSkdUabrAYEStLvLN7mr1tV+VDwM5veCj0V+ehaF01EN1yJe3f4xAR5Y650m+lZ30uHVzzgz9/J8paHzbfLfXT4gp392oDrvcBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAt5d8AAAD//2pKzZ4=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000500)='cgroup.procs\x00', 0x2, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f0000000240)={0x18, 0x1, 0x0, 0x0, 0x0, 0x6}) getrusage(0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180)=[{0x0}], 0x1) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 2.140398277s ago: executing program 6 (id=625): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) faccessat2(0xffffffffffffffff, 0x0, 0x0, 0x1100) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x80580, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) 1.755287336s ago: executing program 6 (id=626): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x500, 0x0, 0xd0, 0x1a0, 0x270, 0x340, 0x0, 0xd0, 0x1a0, 0x270, 0x430, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@empty, @ipv6=@empty, 0x40, 0x40}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) sendto$inet6(r0, 0x0, 0x0, 0x4000, &(0x7f0000000580)={0xa, 0x1234, 0x0, @local, 0x9}, 0x1c) 1.744114846s ago: executing program 4 (id=627): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x10, 0x11, &(0x7f00000003c0)=@raw=[@generic={0x77, 0xe, 0x3, 0xff, 0x201e9016}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7ff}}, @call={0x85, 0x0, 0x0, 0xc1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffe}, @exit, @map_val={0x18, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x4}], &(0x7f0000000000)='GPL\x00'}, 0x94) r3 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2) write(0xffffffffffffffff, &(0x7f0000001000)="4f4f4f4fffffffff0000", 0xa) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000000c0)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000001000)}, 0x400000}) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f00000001c0)=0x2) 1.2507023s ago: executing program 0 (id=628): sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, 0x0, 0x10) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x40040, 0x0) read$FUSE(r1, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xe51de000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, 0x0) r5 = socket$inet(0x2, 0x2, 0x0) ioctl(r5, 0x8b26, &(0x7f0000000400)='wlan0') 1.097596397s ago: executing program 6 (id=629): syz_mount_image$vfat(&(0x7f0000000580), &(0x7f0000000180)='./file1\x00', 0x1000802, &(0x7f0000000b80)=ANY=[@ANYBLOB="6e6f6e756d7461696c3d302c6e6f6e756d7461696c003130dbbb3121258e322c262b537f5d0000006e695f7804590000000000003d312c696f63686172538c6c90392bc69373686f72746e616d65653ff959f53d6d697865642c636f6465706167653d3821332c696f6368617273650000000031323831e54f1bb0a3d72c007e3db5a829498e2a721ae5804ff8ccb41e27af3a3a924308cb010100003ceeeac934b3165b4a0ea182cdd0666ab32f2d041a99ac9fc865ba946f1bb7759d02742dfcc68937ff86d7a54d6de8823119c767d45d6047209f4436383ee21373a9c3f450cb6d7c37b59a34407d4a0e6a382108ddd52580281f1d8ad71c4ceafb49960f1429b090d1429f519f9c2b0cb88ffa6fc04fa61c275bf560b9eeeb2d0c8b3ddeb56783f9908c21cf9b2ba0b76b9b60c991bb17c7d0accad1cdaf3259b7dc405d72e2bc3abe0cf37bda3dbfc05e2e55f8aa272b5ea736019c3c0a9b34115a445e0c5da1bd7352ec9529f5caa71f1ae71b36b500c79fffb487ed081232b5d93d3162c7f71f4d572ed87cf12b9ce4e527266a0c15dac9171edda86b148d17a48d4d90470e79620eeab5acf6f78f807298315e2b80fe1874098d75ab47837a96699e2a7db456f2a4368bece813135ed970951c7471ac16703820a799421cb24f327b3669c159abfa125ee992a5f49ab45bec637c38bcbdae4da3a05f96b2162c47d0b1277e1b1bcc981cce8f6f7f3dd8d06352eb387997b498a732d8442115755ff14d508891abd401b3cafcba75a6901fbe08002674d8663b8c40e9cf13fa4c4a092cb8004a1d2a6fe18cd5d702493d52a7110b17e64b9fa22fb3ace98b9ca35cb98c65f0902dd430373f6ae43c4a60c423b6f65b5ecc2093698072abc857ab2d36a261a7fc5776d39c3d5d5fad291c88ff9726d5ee32c6bcac1799ade9459eb39b56d985d29b988c72c9ad7e82b589f454a58d7cd5ace9436cf69acc217737c863d8938cc95767a0c9b14cb79f5b450c894a3e95d26e14259fdb65aa49761847cc1c13f18742072e80cbed0d5622618817583d0365f807882e539ff07c9205d3ee72efb8dd6853a02f49abd1b38d4571666a4d7d98c4f34f082eea5a5ac7b9e9fd030791df5d98a03ed76cdbb3241f96f22b6dd0da2bd8105c3408eeb8543ebc5de0849c1f31bd94033655fd11430fd18e55f5361750c7a2a7"], 0xc, 0x27e, &(0x7f00000005c0)="$eJzs3U9rY1UUAPDz0tTUQklBobQIPuk+tBX3LdJCMSBYstCNFpuiNLXQQkEXNq5cu3KjGz+AbgS3ggtx6xcQQerAbNpZdTGQIU0madKX6Z8hzTD9/TY5vHtO7r3vPd5NFrn55I3dna29g+3T0+PITSTj+eX4de4sienIxVi01AMAeJmcNRpx0mgZ9VgAgLth/QeA+6e7/ieX1v+k3v5M8NpP87OjGBwAMBS+/wPA/bPx4UfvrZTLqx+cpBMRu98eVg4rrddW+8p2fB61qMZCFONxRKOjFX+/Xl5dSJv+n47K7lG7/uiwMtZbvxjFmL5cv7ZeXl1MW3rrx2OyXf/PZFRjKYrxenb9Ulb9eETMX+i/FMX4+9PYi1psRbO2W//xYpq++365r//CeR4AAAAAAAAAAAAAAAAAAAAAAAxDKXe+dU6jkKaZ+/eUSulTfe2t+ov7A72asT/QWmd/oP79ffIxlx/t3AEAAAAAAAAAAAAAAAAAAOBFcfDlVzubtVp1/1nBF3/9/MdVOdcMkna/mTmFiHj+Lq4ZTL313w+Dc765yfm5RbDcDqbiUtPvbw597r1B87TftOrP489m3z6YeadzJN+bE/mhjTl3xUXJZ03nYXHArdW+Ieu3H88vnWv66Mrk7zbu6g4f6z8y8+Py5m9f//vguu+T/bwo3MlTCQAAAAAAAAAAAAAAAAAA7qfuj35HPRIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGJ3u//8PCJJoBvmIGJxTq+4nkUTEK5HRVB/1HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4EkAAAD//zZqmhk=") fspick(0xffffffffffffffff, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000540)={[{@upperdir={'upperdir', 0x3d, './file0'}}]}) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0xcf0be2279761c16b) sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x1, 0x13, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000600)={r3, r3, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x120, 0x5, 0x5, 0x2, 0xfffffffe, 'syz0\x00'}) ioctl$sock_bt_hidp_HIDPGETCONNINFO(0xffffffffffffffff, 0x800448d3, &(0x7f0000000180)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x5, 0x1, 0xfffc, 0x7f, 0xfff8, "5812ea7e24acbbdf9434acb8d4313f3239e0b8d559c63bcd82e0670fdc0ec3bf1f96e8c581780505317771fbc15d046ec6b9a1678de56cf61d856ae9e80488205c22e2276c3c6971fe4b335d2d85857ef55d3d6758642669a944694056b4f0ac3a9670c2cbac735e9081815330289538795fb0a14cc9aac526d78ac1d062e82e"}) r4 = semget$private(0x0, 0x6, 0x1a8) semtimedop(r4, &(0x7f00000003c0)=[{0x4, 0x4, 0x1800}], 0x1, 0x0) semop(0x0, &(0x7f00000000c0)=[{0x1, 0x402, 0x1800}], 0x1) 196.304201ms ago: executing program 4 (id=630): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000040), 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r1 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r2], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x1}) 43.997158ms ago: executing program 0 (id=631): prlimit64(0x0, 0xe, 0x0, 0x0) setrlimit(0x8, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) unshare(0x60040000) 0s ago: executing program 7 (id=632): r0 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_RECEIVE(r0, 0xc0386106, 0x0) kernel console output (not intermixed with test programs): 113.662797][ T6048] ip_tables: iptables: counters copy to user failed while replacing table [ 113.841862][ T6056] autofs4:pid:6056:autofs_fill_super: called with bogus options [ 113.914942][ T6059] tipc: Enabling of bearer rejected, failed to enable media [ 115.145393][ T6082] ip_tables: iptables: counters copy to user failed while replacing table [ 115.689721][ T23] IPVS: starting estimator thread 0... [ 115.884713][ T6089] IPVS: using max 16 ests per chain, 38400 per kthread [ 115.971995][ T6088] autofs4:pid:6088:autofs_fill_super: called with bogus options [ 116.423166][ T6097] tipc: Enabling of bearer rejected, failed to enable media [ 116.856027][ T6112] FAULT_INJECTION: forcing a failure. [ 116.856027][ T6112] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 116.888707][ T6112] CPU: 1 PID: 6112 Comm: syz.3.82 Not tainted syzkaller #0 [ 116.896003][ T6112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 116.906142][ T6112] Call Trace: [ 116.909462][ T6112] [ 116.912412][ T6112] dump_stack_lvl+0x18c/0x250 [ 116.917215][ T6112] ? show_regs_print_info+0x20/0x20 [ 116.922455][ T6112] ? load_image+0x420/0x420 [ 116.926991][ T6112] ? __might_fault+0xaa/0x120 [ 116.932177][ T6112] ? __lock_acquire+0x7d80/0x7d80 [ 116.937248][ T6112] should_fail_ex+0x394/0x4c0 [ 116.941989][ T6112] strncpy_from_user+0x36/0x2f0 [ 116.946919][ T6112] getname_flags+0xf6/0x500 [ 116.951643][ T6112] do_sys_openat2+0xda/0x1d0 [ 116.956298][ T6112] ? do_sys_open+0xe0/0xe0 [ 116.960753][ T6112] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 116.966817][ T6112] ? lock_chain_count+0x20/0x20 [ 116.971692][ T6112] ? lock_chain_count+0x20/0x20 [ 116.976581][ T6112] __x64_sys_openat+0x139/0x160 [ 116.981485][ T6112] do_syscall_64+0x55/0xb0 [ 116.985933][ T6112] ? clear_bhb_loop+0x40/0x90 [ 116.990639][ T6112] ? clear_bhb_loop+0x40/0x90 [ 116.995345][ T6112] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 117.001279][ T6112] RIP: 0033:0x7fa6abb5e98e [ 117.005718][ T6112] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 117.025370][ T6112] RSP: 002b:00007fa6acaceb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 117.033861][ T6112] RAX: ffffffffffffffda RBX: 00007fa6acacf6c0 RCX: 00007fa6abb5e98e [ 117.041859][ T6112] RDX: 0000000000000000 RSI: 00007fa6acacec00 RDI: ffffffffffffff9c [ 117.049862][ T6112] RBP: 00007fa6acacec00 R08: 0000000000000000 R09: 0000000000000000 [ 117.057856][ T6112] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 117.065868][ T6112] R13: 00007fa6abe26038 R14: 00007fa6abe25fa0 R15: 00007ffebb9e5d88 [ 117.073922][ T6112] [ 117.077217][ C1] vkms_vblank_simulate: vblank timer overrun [ 117.458242][ T6118] ip_tables: iptables: counters copy to user failed while replacing table [ 118.898666][ T6143] netlink: 8 bytes leftover after parsing attributes in process `syz.0.94'. [ 119.306666][ T6156] ip_tables: iptables: counters copy to user failed while replacing table [ 120.094786][ T6148] tipc: Enabling of bearer rejected, failed to enable media [ 121.968553][ T6190] FAULT_INJECTION: forcing a failure. [ 121.968553][ T6190] name failslab, interval 1, probability 0, space 0, times 0 [ 121.982586][ T6190] CPU: 1 PID: 6190 Comm: syz.0.107 Not tainted syzkaller #0 [ 121.989948][ T6190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 122.000198][ T6190] Call Trace: [ 122.003517][ T6190] [ 122.006493][ T6190] dump_stack_lvl+0x18c/0x250 [ 122.011243][ T6190] ? show_regs_print_info+0x20/0x20 [ 122.016511][ T6190] ? load_image+0x420/0x420 [ 122.021073][ T6190] ? __might_sleep+0xe0/0xe0 [ 122.025819][ T6190] ? __lock_acquire+0x7d80/0x7d80 [ 122.030921][ T6190] should_fail_ex+0x394/0x4c0 [ 122.035676][ T6190] should_failslab+0x9/0x20 [ 122.040246][ T6190] slab_pre_alloc_hook+0x59/0x300 [ 122.045353][ T6190] kmem_cache_alloc_node+0x5e/0x310 [ 122.050793][ T6190] ? __alloc_skb+0x103/0x2c0 [ 122.055452][ T6190] __alloc_skb+0x103/0x2c0 [ 122.059968][ T6190] tc_ctl_action+0x79f/0xbc0 [ 122.064630][ T6190] ? tca_get_fill+0x550/0x550 [ 122.069376][ T6190] ? trace_raw_output_contention_end+0xd0/0xd0 [ 122.075636][ T6190] ? tca_get_fill+0x550/0x550 [ 122.080413][ T6190] rtnetlink_rcv_msg+0x843/0xf90 [ 122.085430][ T6190] ? rtnetlink_rcv_msg+0x220/0xf90 [ 122.090735][ T6190] ? rtnetlink_bind+0x80/0x80 [ 122.095485][ T6190] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 122.101639][ T6190] ? lock_chain_count+0x20/0x20 [ 122.106721][ T6190] ? __local_bh_enable_ip+0x13a/0x1c0 [ 122.112142][ T6190] ? lockdep_hardirqs_on+0x98/0x150 [ 122.117402][ T6190] ? __local_bh_enable_ip+0x13a/0x1c0 [ 122.122813][ T6190] ? _local_bh_enable+0xa0/0xa0 [ 122.127869][ T6190] ? __dev_queue_xmit+0x272/0x37e0 [ 122.133026][ T6190] ? __dev_queue_xmit+0x1329/0x37e0 [ 122.138288][ T6190] ? __dev_queue_xmit+0x272/0x37e0 [ 122.143461][ T6190] ? ref_tracker_free+0x686/0x830 [ 122.148549][ T6190] netlink_rcv_skb+0x235/0x4c0 [ 122.153369][ T6190] ? rtnetlink_bind+0x80/0x80 [ 122.158091][ T6190] ? netlink_ack+0x1160/0x1160 [ 122.162902][ T6190] ? __lock_acquire+0x7d80/0x7d80 [ 122.167970][ T6190] ? netlink_deliver_tap+0x2e/0x1b0 [ 122.173212][ T6190] netlink_unicast+0x7b1/0x930 [ 122.178014][ T6190] netlink_sendmsg+0x8d0/0xbf0 [ 122.182854][ T6190] ? netlink_getsockopt+0x590/0x590 [ 122.188121][ T6190] ? apparmor_socket_sendmsg+0x8e/0x330 [ 122.193794][ T6190] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 122.199121][ T6190] ? security_socket_sendmsg+0x80/0xa0 [ 122.204605][ T6190] ? netlink_getsockopt+0x590/0x590 [ 122.209836][ T6190] ____sys_sendmsg+0x61b/0x980 [ 122.214663][ T6190] ? __asan_memset+0x22/0x40 [ 122.219294][ T6190] ? __sys_sendmsg_sock+0x30/0x30 [ 122.224360][ T6190] ? __import_iovec+0x5f2/0x850 [ 122.229256][ T6190] ? import_iovec+0x73/0xa0 [ 122.233801][ T6190] ___sys_sendmsg+0x2a6/0x360 [ 122.238606][ T6190] ? __sys_sendmsg+0x2b0/0x2b0 [ 122.243444][ T6190] __se_sys_sendmsg+0x1d0/0x2c0 [ 122.248328][ T6190] ? __x64_sys_sendmsg+0x80/0x80 [ 122.253397][ T6190] ? lockdep_hardirqs_on+0x98/0x150 [ 122.259084][ T6190] do_syscall_64+0x55/0xb0 [ 122.263530][ T6190] ? clear_bhb_loop+0x40/0x90 [ 122.268246][ T6190] ? clear_bhb_loop+0x40/0x90 [ 122.272954][ T6190] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 122.278881][ T6190] RIP: 0033:0x7f92bb39e159 [ 122.283335][ T6190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.302988][ T6190] RSP: 002b:00007f92bc321028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 122.311436][ T6190] RAX: ffffffffffffffda RBX: 00007f92bb625fa0 RCX: 00007f92bb39e159 [ 122.319444][ T6190] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000007 [ 122.327443][ T6190] RBP: 00007f92bb43503b R08: 0000000000000000 R09: 0000000000000000 [ 122.335444][ T6190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 122.343483][ T6190] R13: 00007f92bb626038 R14: 00007f92bb625fa0 R15: 00007ffd7083e128 [ 122.351514][ T6190] [ 122.688685][ T6208] loop3: detected capacity change from 0 to 512 [ 122.849473][ T6216] loop1: detected capacity change from 0 to 256 [ 122.920105][ T6214] tipc: Enabling of bearer rejected, failed to enable media [ 123.177242][ T6208] EXT4-fs (loop3): Test dummy encryption mode enabled [ 123.270461][ T6208] EXT4-fs error (device loop3): ext4_orphan_get:1408: inode #15: comm syz.3.113: inode has both inline data and extents flags [ 123.334947][ T6208] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.113: couldn't read orphan inode 15 (err -117) [ 123.357949][ T6208] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 123.389012][ T6226] loop0: detected capacity change from 0 to 512 [ 123.397393][ T6226] EXT4-fs: inline encryption not supported [ 123.414718][ T6226] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 123.550599][ T6226] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 123.607054][ T6226] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.116: invalid indirect mapped block 2683928664 (level 1) [ 124.293538][ T6226] EXT4-fs (loop0): 1 truncate cleaned up [ 124.360644][ T6226] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 124.686179][ T6208] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 125.095600][ T6246] overlayfs: failed to resolve './file1': -2 [ 125.380656][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 125.409199][ T5784] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 125.820205][ T6254] Zero length message leads to an empty skb [ 126.593828][ T6270] tipc: Enabling of bearer rejected, failed to enable media [ 128.285296][ T6303] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 1000000 out of range (51000000..2150000000) [ 129.744780][ T6333] autofs4:pid:6333:autofs_fill_super: called with bogus options [ 129.948416][ T6337] loop2: detected capacity change from 0 to 512 [ 130.017294][ T6337] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 130.219764][ T6337] EXT4-fs (loop2): 1 orphan inode deleted [ 130.256468][ T6337] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 130.326271][ T6337] ext4 filesystem being mounted at /39/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 130.855510][ T6352] ======================================================= [ 130.855510][ T6352] WARNING: The mand mount option has been deprecated and [ 130.855510][ T6352] and is ignored by this kernel. Remove the mand [ 130.855510][ T6352] option from the mount to silence this warning. [ 130.855510][ T6352] ======================================================= [ 131.799210][ T5779] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 131.818323][ T6359] loop0: detected capacity change from 0 to 512 [ 131.957888][ T6359] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 132.029672][ T6359] ext4 filesystem being mounted at /38/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 132.167614][ T6367] netlink: 'syz.1.159': attribute type 4 has an invalid length. [ 132.433405][ T6369] loop1: detected capacity change from 0 to 512 [ 132.614114][ T6369] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 132.683615][ T6369] EXT4-fs (loop1): 1 truncate cleaned up [ 132.699526][ T6369] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 132.866924][ T6370] overlayfs: missing 'lowerdir' [ 133.151064][ T6376] autofs4:pid:6376:autofs_fill_super: called with bogus options [ 133.177198][ T5783] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.216984][ T5784] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.409659][ T6385] loop3: detected capacity change from 0 to 512 [ 133.445240][ T6385] EXT4-fs (loop3): Test dummy encryption mode enabled [ 133.529572][ T6390] loop2: detected capacity change from 0 to 512 [ 133.545871][ T6385] EXT4-fs error (device loop3): ext4_orphan_get:1408: inode #15: comm syz.3.167: inode has both inline data and extents flags [ 133.611868][ T6385] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.167: couldn't read orphan inode 15 (err -117) [ 133.640836][ T6385] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 133.655995][ T6390] EXT4-fs (loop2): 1 orphan inode deleted [ 133.663210][ T6390] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 133.684961][ T6390] ext4 filesystem being mounted at /42/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 134.774001][ T5779] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.984494][ C1] sched: RT throttling activated [ 135.435962][ T6409] autofs4:pid:6409:autofs_fill_super: called with bogus options [ 135.491707][ T6411] FAULT_INJECTION: forcing a failure. [ 135.491707][ T6411] name failslab, interval 1, probability 0, space 0, times 0 [ 135.561834][ T6411] CPU: 0 PID: 6411 Comm: syz.1.175 Not tainted syzkaller #0 [ 135.569296][ T6411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 135.579420][ T6411] Call Trace: [ 135.582750][ T6411] [ 135.585740][ T6411] dump_stack_lvl+0x18c/0x250 [ 135.590506][ T6411] ? show_regs_print_info+0x20/0x20 [ 135.595770][ T6411] ? load_image+0x420/0x420 [ 135.600333][ T6411] ? __might_sleep+0xe0/0xe0 [ 135.604987][ T6411] ? __lock_acquire+0x7d80/0x7d80 [ 135.610067][ T6411] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 135.616110][ T6411] should_fail_ex+0x394/0x4c0 [ 135.620878][ T6411] should_failslab+0x9/0x20 [ 135.625450][ T6411] slab_pre_alloc_hook+0x59/0x300 [ 135.630568][ T6411] ? ktime_get_coarse_real_ts64+0x2f/0x120 [ 135.636443][ T6411] kmem_cache_alloc_lru+0x4d/0x2b0 [ 135.641710][ T6411] ? __d_alloc+0x31/0x710 [ 135.646106][ T6411] __d_alloc+0x31/0x710 [ 135.650328][ T6411] d_alloc_pseudo+0x1d/0x70 [ 135.654889][ T6411] alloc_file_pseudo+0xe4/0x210 [ 135.659791][ T6411] ? fput+0x1a0/0x1a0 [ 135.663825][ T6411] ? inode_update_timestamps+0x600/0x600 [ 135.669868][ T6411] ? debug_mutex_init+0x38/0x70 [ 135.674778][ T6411] ? create_pipe_files+0x2c7/0x700 [ 135.679958][ T6411] create_pipe_files+0x3ac/0x700 [ 135.684965][ T6411] __do_pipe_flags+0x4c/0x2c0 [ 135.689739][ T6411] do_pipe2+0xab/0x190 [ 135.693880][ T6411] ? _compound_head+0x120/0x120 [ 135.698791][ T6411] ? lock_chain_count+0x20/0x20 [ 135.703750][ T6411] ? syscall_enter_from_user_mode+0x25/0x80 [ 135.709712][ T6411] __x64_sys_pipe2+0x5a/0x70 [ 135.714375][ T6411] do_syscall_64+0x55/0xb0 [ 135.718843][ T6411] ? clear_bhb_loop+0x40/0x90 [ 135.723582][ T6411] ? clear_bhb_loop+0x40/0x90 [ 135.728493][ T6411] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 135.734446][ T6411] RIP: 0033:0x7f85ddd9e159 [ 135.738917][ T6411] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.758670][ T6411] RSP: 002b:00007f85ded50028 EFLAGS: 00000246 ORIG_RAX: 0000000000000125 [ 135.767155][ T6411] RAX: ffffffffffffffda RBX: 00007f85de025fa0 RCX: 00007f85ddd9e159 [ 135.775293][ T6411] RDX: 0000000000000000 RSI: 0000000000080000 RDI: 0000000000000000 [ 135.775312][ T6411] RBP: 00007f85dde3503b R08: 0000000000000000 R09: 0000000000000000 [ 135.791432][ T6411] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.795542][ T6385] overlayfs: failed to resolve './file1': -2 [ 135.799646][ T6411] R13: 00007f85de026038 R14: 00007f85de025fa0 R15: 00007ffe7b33cd78 [ 135.813698][ T6411] [ 136.095820][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.719608][ T6417] Can't find ip_set type bitmap:ip [ 137.904196][ T6436] loop3: detected capacity change from 0 to 1024 [ 137.928731][ T6436] EXT4-fs: Ignoring removed bh option [ 137.977466][ T6436] EXT4-fs: Ignoring removed bh option [ 138.030272][ T6436] EXT4-fs (loop3): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 138.138623][ T6436] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 138.383670][ T6444] autofs4:pid:6444:autofs_fill_super: called with bogus options [ 138.439537][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.451269][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 139.233501][ T6448] loop0: detected capacity change from 0 to 512 [ 139.278164][ T6448] EXT4-fs (loop0): Test dummy encryption mode enabled [ 139.321047][ T6448] EXT4-fs error (device loop0): ext4_orphan_get:1408: inode #15: comm syz.0.186: inode has both inline data and extents flags [ 139.343202][ T6448] EXT4-fs error (device loop0): ext4_orphan_get:1413: comm syz.0.186: couldn't read orphan inode 15 (err -117) [ 139.358084][ T6448] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 140.535881][ T5775] EXT4-fs error (device loop3): ext4_read_inline_dir:1591: inode #12: block 7: comm syz-executor: path /48/control/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 140.628087][ T6462] FAULT_INJECTION: forcing a failure. [ 140.628087][ T6462] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 140.648138][ T5775] EXT4-fs (loop3): Remounting filesystem read-only [ 140.701993][ T6462] CPU: 0 PID: 6462 Comm: syz.2.191 Not tainted syzkaller #0 [ 140.709376][ T6462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 140.719482][ T6462] Call Trace: [ 140.722801][ T6462] [ 140.725778][ T6462] dump_stack_lvl+0x18c/0x250 [ 140.730542][ T6462] ? show_regs_print_info+0x20/0x20 [ 140.735793][ T6462] ? load_image+0x420/0x420 [ 140.740357][ T6462] ? __lock_acquire+0x7d80/0x7d80 [ 140.745461][ T6462] should_fail_ex+0x394/0x4c0 [ 140.750208][ T6462] prepare_alloc_pages+0x1e1/0x5b0 [ 140.755396][ T6462] __alloc_pages+0x134/0x460 [ 140.760047][ T6462] ? zone_statistics+0x170/0x170 [ 140.765057][ T6462] ? alloc_pages+0x4e1/0x740 [ 140.769711][ T6462] __get_free_pages+0xc/0x30 [ 140.774355][ T6462] kasan_populate_vmalloc_pte+0x35/0x100 [ 140.780054][ T6462] __apply_to_page_range+0x860/0xdd0 [ 140.785501][ T6462] ? kasan_populate_vmalloc+0x70/0x70 [ 140.790938][ T6462] ? apply_to_page_range+0x50/0x50 [ 140.796104][ T6462] ? do_raw_spin_unlock+0x121/0x230 [ 140.801366][ T6462] alloc_vmap_area+0x1d26/0x1e50 [ 140.806400][ T6462] ? vm_map_ram+0xcf0/0xcf0 [ 140.810966][ T6462] ? rcu_is_watching+0x15/0xb0 [ 140.815787][ T6462] __get_vm_area_node+0x162/0x370 [ 140.820882][ T6462] __vmalloc_node_range+0x36f/0x1320 [ 140.826237][ T6462] ? n_tty_open+0x1d/0x150 [ 140.830719][ T6462] ? lockdep_hardirqs_on+0x98/0x150 [ 140.836003][ T6462] ? free_vm_area+0x50/0x50 [ 140.840565][ T6462] ? __might_sleep+0xe0/0xe0 [ 140.845226][ T6462] ? n_tty_open+0x1d/0x150 [ 140.849703][ T6462] vzalloc+0x79/0x90 [ 140.853666][ T6462] ? n_tty_open+0x1d/0x150 [ 140.858140][ T6462] n_tty_open+0x1d/0x150 [ 140.862619][ T6462] tty_ldisc_setup+0xbd/0x240 [ 140.867352][ T6462] tty_init_dev+0x275/0x4c0 [ 140.871912][ T6462] ptmx_open+0xdf/0x2c0 [ 140.876118][ T6462] ? pty_start+0x140/0x140 [ 140.880596][ T6462] chrdev_open+0x58c/0x600 [ 140.885069][ T6462] ? cd_forget+0x160/0x160 [ 140.889546][ T6462] ? fsnotify_perm+0x3ed/0x5e0 [ 140.894392][ T6462] do_dentry_open+0x880/0x14b0 [ 140.899212][ T6462] ? cd_forget+0x160/0x160 [ 140.903711][ T6462] path_openat+0x284f/0x3270 [ 140.908381][ T6462] ? do_sys_openat2+0xda/0x1d0 [ 140.913200][ T6462] ? __x64_sys_openat+0x139/0x160 [ 140.918282][ T6462] ? verify_lock_unused+0x140/0x140 [ 140.923535][ T6462] ? do_filp_open+0x430/0x430 [ 140.928312][ T6462] do_filp_open+0x1f2/0x430 [ 140.932962][ T6462] ? vfs_tmpfile+0x620/0x620 [ 140.937631][ T6462] ? _raw_spin_unlock+0x28/0x40 [ 140.942528][ T6462] ? alloc_fd+0x590/0x640 [ 140.946939][ T6462] do_sys_openat2+0x134/0x1d0 [ 140.951708][ T6462] ? do_sys_open+0xe0/0xe0 [ 140.956198][ T6462] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 140.962242][ T6462] ? lock_chain_count+0x20/0x20 [ 140.967156][ T6462] __x64_sys_openat+0x139/0x160 [ 140.972087][ T6462] do_syscall_64+0x55/0xb0 [ 140.976589][ T6462] ? clear_bhb_loop+0x40/0x90 [ 140.981418][ T6462] ? clear_bhb_loop+0x40/0x90 [ 140.986164][ T6462] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 140.992124][ T6462] RIP: 0033:0x7f92f779e159 [ 140.996685][ T6462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.016348][ T6462] RSP: 002b:00007f92f8731028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 141.024830][ T6462] RAX: ffffffffffffffda RBX: 00007f92f7a25fa0 RCX: 00007f92f779e159 [ 141.032946][ T6462] RDX: 0000000000008101 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 141.040968][ T6462] RBP: 00007f92f783503b R08: 0000000000000000 R09: 0000000000000000 [ 141.049055][ T6462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.057098][ T6462] R13: 00007f92f7a26038 R14: 00007f92f7a25fa0 R15: 00007ffc3f08da48 [ 141.065158][ T6462] [ 141.091925][ T6462] syz.2.191: vmalloc error: size 9128, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 141.112381][ T6462] CPU: 0 PID: 6462 Comm: syz.2.191 Not tainted syzkaller #0 [ 141.119752][ T6462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 141.129871][ T6462] Call Trace: [ 141.133194][ T6462] [ 141.136173][ T6462] dump_stack_lvl+0x18c/0x250 [ 141.140914][ T6462] ? show_regs_print_info+0x20/0x20 [ 141.146171][ T6462] ? load_image+0x420/0x420 [ 141.150730][ T6462] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 141.157201][ T6462] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 141.163766][ T6462] warn_alloc+0x246/0x340 [ 141.168152][ T6462] ? slab_free_freelist_hook+0x130/0x1a0 [ 141.173848][ T6462] ? zone_watermark_ok_safe+0x230/0x230 [ 141.179486][ T6462] ? __get_vm_area_node+0x17b/0x370 [ 141.184755][ T6462] ? __get_vm_area_node+0x17b/0x370 [ 141.190187][ T6462] __vmalloc_node_range+0x394/0x1320 [ 141.195546][ T6462] ? lockdep_hardirqs_on+0x98/0x150 [ 141.200835][ T6462] ? free_vm_area+0x50/0x50 [ 141.205392][ T6462] ? __might_sleep+0xe0/0xe0 [ 141.210055][ T6462] ? n_tty_open+0x1d/0x150 [ 141.214531][ T6462] vzalloc+0x79/0x90 [ 141.218488][ T6462] ? n_tty_open+0x1d/0x150 [ 141.222973][ T6462] n_tty_open+0x1d/0x150 [ 141.227298][ T6462] tty_ldisc_setup+0xbd/0x240 [ 141.232041][ T6462] tty_init_dev+0x275/0x4c0 [ 141.236619][ T6462] ptmx_open+0xdf/0x2c0 [ 141.240860][ T6462] ? pty_start+0x140/0x140 [ 141.245335][ T6462] chrdev_open+0x58c/0x600 [ 141.249809][ T6462] ? cd_forget+0x160/0x160 [ 141.254294][ T6462] ? fsnotify_perm+0x3ed/0x5e0 [ 141.259115][ T6462] do_dentry_open+0x880/0x14b0 [ 141.263935][ T6462] ? cd_forget+0x160/0x160 [ 141.268438][ T6462] path_openat+0x284f/0x3270 [ 141.273113][ T6462] ? do_sys_openat2+0xda/0x1d0 [ 141.277926][ T6462] ? __x64_sys_openat+0x139/0x160 [ 141.283027][ T6462] ? verify_lock_unused+0x140/0x140 [ 141.288289][ T6462] ? do_filp_open+0x430/0x430 [ 141.293040][ T6462] do_filp_open+0x1f2/0x430 [ 141.297596][ T6462] ? vfs_tmpfile+0x620/0x620 [ 141.302272][ T6462] ? _raw_spin_unlock+0x28/0x40 [ 141.307184][ T6462] ? alloc_fd+0x590/0x640 [ 141.311613][ T6462] do_sys_openat2+0x134/0x1d0 [ 141.316375][ T6462] ? do_sys_open+0xe0/0xe0 [ 141.320875][ T6462] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 141.326925][ T6462] ? lock_chain_count+0x20/0x20 [ 141.331863][ T6462] __x64_sys_openat+0x139/0x160 [ 141.336776][ T6462] do_syscall_64+0x55/0xb0 [ 141.341246][ T6462] ? clear_bhb_loop+0x40/0x90 [ 141.346493][ T6462] ? clear_bhb_loop+0x40/0x90 [ 141.351227][ T6462] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 141.357168][ T6462] RIP: 0033:0x7f92f779e159 [ 141.361632][ T6462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.381380][ T6462] RSP: 002b:00007f92f8731028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 141.389893][ T6462] RAX: ffffffffffffffda RBX: 00007f92f7a25fa0 RCX: 00007f92f779e159 [ 141.397940][ T6462] RDX: 0000000000008101 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 141.405967][ T6462] RBP: 00007f92f783503b R08: 0000000000000000 R09: 0000000000000000 [ 141.414043][ T6462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.422072][ T6462] R13: 00007f92f7a26038 R14: 00007f92f7a25fa0 R15: 00007ffc3f08da48 [ 141.430109][ T6462] [ 142.086508][ T6468] overlayfs: failed to resolve './file1': -2 [ 142.107277][ T6462] Mem-Info: [ 142.202159][ T6462] active_anon:12756 inactive_anon:0 isolated_anon:0 [ 142.202159][ T6462] active_file:1160 inactive_file:40008 isolated_file:0 [ 142.202159][ T6462] unevictable:768 dirty:156 writeback:0 [ 142.202159][ T6462] slab_reclaimable:9970 slab_unreclaimable:92151 [ 142.202159][ T6462] mapped:31192 shmem:7273 pagetables:535 [ 142.202159][ T6462] sec_pagetables:0 bounce:0 [ 142.202159][ T6462] kernel_misc_reclaimable:0 [ 142.202159][ T6462] free:1359001 free_pcp:8220 free_cma:0 [ 142.474966][ T6462] Node 0 active_anon:44332kB inactive_anon:0kB active_file:4640kB inactive_file:159828kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:109352kB dirty:644kB writeback:0kB shmem:21056kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10512kB pagetables:2100kB sec_pagetables:0kB all_unreclaimable? no [ 142.513106][ T6462] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 142.565987][ T6462] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 142.593763][ T6462] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 142.603937][ T6462] Node 0 DMA32 free:1527600kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:39428kB inactive_anon:0kB active_file:4640kB inactive_file:159008kB unevictable:1536kB writepending:644kB present:3129332kB managed:2586820kB mlocked:0kB bounce:0kB free_pcp:26572kB local_pcp:17628kB free_cma:0kB [ 142.670841][ T6462] lowmem_reserve[]: 0 0 0 0 0 [ 142.675848][ T6462] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:820kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 142.708749][ T6462] lowmem_reserve[]: 0 0 0 0 0 [ 142.713594][ T6462] Node 1 Normal free:3893044kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:18208kB local_pcp:11520kB free_cma:0kB [ 142.748361][ T6462] lowmem_reserve[]: 0 0 0 0 0 [ 142.753200][ T6462] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 142.773844][ T6462] Node 0 DMA32: 832*4kB (U) 956*8kB (U) 549*16kB (U) 7*32kB (UE) 7*64kB (UE) 7*128kB (UE) 2*256kB (UM) 1*512kB (M) 2*1024kB (UE) 1*2048kB (E) 366*4096kB (M) = 1525584kB [ 142.800485][ T6462] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 142.813159][ T6462] Node 1 Normal: 185*4kB (UME) 52*8kB (UME) 37*16kB (UME) 53*32kB (UME) 25*64kB (UE) 7*128kB (UME) 2*256kB (UE) 1*512kB (M) 1*1024kB (E) 1*2048kB (E) 948*4096kB (M) = 3893044kB [ 142.836575][ T6462] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 142.849122][ T6462] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 142.862292][ T6462] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 142.877072][ T6462] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 142.894116][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 142.938189][ T6462] 47468 total pagecache pages [ 142.972099][ T6462] 0 pages in swap cache [ 143.016049][ T6462] Free swap = 124996kB [ 143.030693][ T6462] Total swap = 124996kB [ 143.044641][ T6462] 2097051 pages RAM [ 143.048922][ T6462] 0 pages HighMem/MovableOnly [ 143.053743][ T6462] 416960 pages reserved [ 143.058726][ T6462] 0 pages cma reserved [ 143.063133][ T6462] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 143.071118][ T6448] tty tty1: ldisc open failed (-12), clearing slot 0 [ 143.472712][ T42] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.498262][ T5784] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 143.827359][ T6475] autofs4:pid:6475:autofs_fill_super: called with bogus options [ 143.829400][ T42] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.976977][ T42] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.080884][ T6478] loop0: detected capacity change from 0 to 256 [ 144.134362][ T42] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.170387][ T6482] loop2: detected capacity change from 0 to 1024 [ 144.196559][ T6482] EXT4-fs: Ignoring removed bh option [ 144.248355][ T6482] EXT4-fs (loop2): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 144.367444][ T6482] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 144.448556][ T6491] FAULT_INJECTION: forcing a failure. [ 144.448556][ T6491] name failslab, interval 1, probability 0, space 0, times 0 [ 144.464872][ T6491] CPU: 0 PID: 6491 Comm: syz.1.202 Not tainted syzkaller #0 [ 144.472237][ T6491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 144.482430][ T6491] Call Trace: [ 144.485746][ T6491] [ 144.488711][ T6491] dump_stack_lvl+0x18c/0x250 [ 144.493433][ T6491] ? show_regs_print_info+0x20/0x20 [ 144.498672][ T6491] ? load_image+0x420/0x420 [ 144.503225][ T6491] ? __lock_acquire+0x7d80/0x7d80 [ 144.508283][ T6491] ? __mutex_lock+0x30d/0xc80 [ 144.513004][ T6491] ? __might_sleep+0xe0/0xe0 [ 144.517653][ T6491] should_fail_ex+0x394/0x4c0 [ 144.522461][ T6491] should_failslab+0x9/0x20 [ 144.527017][ T6491] slab_pre_alloc_hook+0x59/0x300 [ 144.532092][ T6491] kmem_cache_alloc+0x5a/0x2c0 [ 144.536903][ T6491] ? __kernfs_iattrs+0x93/0x280 [ 144.541800][ T6491] __kernfs_iattrs+0x93/0x280 [ 144.546521][ T6491] kernfs_setattr+0x95/0x370 [ 144.551153][ T6491] cgroup_addrm_files+0x9a4/0xd60 [ 144.556224][ T6491] ? trace_raw_output_cgroup_event+0x1e0/0x1e0 [ 144.562417][ T6491] ? __kernfs_iattrs+0x1ec/0x280 [ 144.567402][ T6491] ? __lock_acquire+0x7d80/0x7d80 [ 144.572466][ T6491] ? ktime_get_real_ts64+0x115/0x440 [ 144.577803][ T6491] ? pvclock_gtod_unregister_notifier+0x50/0x50 [ 144.584192][ T6491] ? rcu_is_watching+0x15/0xb0 [ 144.589030][ T6491] css_populate_dir+0x195/0x380 [ 144.593922][ T6491] ? kernfs_setattr+0x274/0x370 [ 144.598814][ T6491] cgroup_mkdir+0xc65/0xe70 [ 144.603359][ T6491] ? css_task_iter_end+0x2c0/0x2c0 [ 144.608555][ T6491] ? kernfs_iop_permission+0x2c4/0x3b0 [ 144.614082][ T6491] ? css_task_iter_end+0x2c0/0x2c0 [ 144.619369][ T6491] kernfs_iop_mkdir+0x241/0x3e0 [ 144.624277][ T6491] vfs_mkdir+0x2a5/0x470 [ 144.628579][ T6491] do_mkdirat+0x1dc/0x450 [ 144.632980][ T6491] ? vfs_mkdir+0x470/0x470 [ 144.637452][ T6491] __x64_sys_mkdirat+0x89/0xa0 [ 144.642369][ T6491] do_syscall_64+0x55/0xb0 [ 144.646829][ T6491] ? clear_bhb_loop+0x40/0x90 [ 144.651542][ T6491] ? clear_bhb_loop+0x40/0x90 [ 144.656266][ T6491] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 144.662199][ T6491] RIP: 0033:0x7f85ddd9e159 [ 144.666653][ T6491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 144.686474][ T6491] RSP: 002b:00007f85ded50028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 144.694923][ T6491] RAX: ffffffffffffffda RBX: 00007f85de025fa0 RCX: 00007f85ddd9e159 [ 144.702967][ T6491] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 144.710976][ T6491] RBP: 00007f85dde3503b R08: 0000000000000000 R09: 0000000000000000 [ 144.719000][ T6491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 144.727030][ T6491] R13: 00007f85de026038 R14: 00007f85de025fa0 R15: 00007ffe7b33cd78 [ 144.735051][ T6491] [ 144.752618][ T6491] cgroup: cgroup_addrm_files: failed to add cgroup.clone_children, err=-12 [ 144.770168][ T6482] EXT4-fs error (device loop2): ext4_check_all_de:666: inode #12: block 7: comm syz.2.199: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 144.907766][ T6482] EXT4-fs (loop2): Remounting filesystem read-only [ 144.950680][ T6492] overlayfs: failed to get metacopy (-5) [ 145.061255][ T6496] loop0: detected capacity change from 0 to 512 [ 145.093580][ T6496] EXT4-fs (loop0): Test dummy encryption mode enabled [ 145.143659][ T6496] EXT4-fs error (device loop0): ext4_orphan_get:1408: inode #15: comm syz.0.203: inode has both inline data and extents flags [ 145.189721][ T6496] EXT4-fs error (device loop0): ext4_orphan_get:1413: comm syz.0.203: couldn't read orphan inode 15 (err -117) [ 145.211085][ T6496] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 145.232646][ T6499] autofs4:pid:6499:autofs_fill_super: called with bogus options [ 145.570989][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 145.580983][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 145.591211][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 145.599648][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 145.609243][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 145.616888][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 145.825803][ T6508] loop1: detected capacity change from 0 to 512 [ 145.852779][ T5779] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 145.907542][ T6508] EXT4-fs (loop1): orphan cleanup on readonly fs [ 145.960665][ T6508] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -13 [ 146.025049][ T6508] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 146.119379][ T6508] EXT4-fs error (device loop1): ext4_clear_blocks:883: inode #13: comm syz.1.206: attempt to clear invalid blocks 2 len 1 [ 146.210291][ T6508] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.206: invalid indirect mapped block 1819239214 (level 0) [ 146.280320][ T6508] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.206: invalid indirect mapped block 1819239214 (level 1) [ 146.350640][ T6508] EXT4-fs (loop1): 1 truncate cleaned up [ 146.378293][ T6508] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 146.622117][ T5783] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 147.213652][ T6496] overlayfs: failed to resolve './file1': -2 [ 147.436346][ T6503] chnl_net:caif_netlink_parms(): no params data found [ 147.465226][ T5784] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 147.714964][ T51] Bluetooth: hci0: command tx timeout [ 147.789210][ T6503] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.796592][ T6503] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.803883][ T6503] bridge_slave_0: entered allmulticast mode [ 147.812142][ T6503] bridge_slave_0: entered promiscuous mode [ 147.823061][ T6503] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.830779][ T6503] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.838459][ T6503] bridge_slave_1: entered allmulticast mode [ 147.846391][ T6503] bridge_slave_1: entered promiscuous mode [ 147.899952][ T6503] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 147.916216][ T6503] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 147.939849][ T42] hsr_slave_0: left promiscuous mode [ 147.954259][ T42] hsr_slave_1: left promiscuous mode [ 147.962441][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 147.981515][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 148.004428][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 148.012060][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 148.045483][ T42] bridge_slave_1: left allmulticast mode [ 148.051218][ T42] bridge_slave_1: left promiscuous mode [ 148.065157][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.084833][ T42] bridge_slave_0: left allmulticast mode [ 148.091559][ T42] bridge_slave_0: left promiscuous mode [ 148.106921][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.128329][ T6534] Bluetooth: ISO socket layer initialized [ 148.162287][ T42] veth1_macvtap: left promiscuous mode [ 148.168738][ T42] veth0_macvtap: left promiscuous mode [ 148.175123][ T42] veth1_vlan: left promiscuous mode [ 148.180785][ T42] veth0_vlan: left promiscuous mode [ 148.263686][ T6537] Bluetooth: MGMT ver 1.22 [ 148.528670][ T5787] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 148.544635][ T5787] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 148.552903][ T5787] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 148.562849][ T5787] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 148.570819][ T5787] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 148.578507][ T5787] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 149.047995][ T42] team0 (unregistering): Port device team_slave_1 removed [ 149.088270][ T42] team0 (unregistering): Port device team_slave_0 removed [ 149.132264][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 149.178054][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 149.481760][ T42] bond0 (unregistering): Released all slaves [ 149.604825][ T6534] netlink: 96 bytes leftover after parsing attributes in process `syz.1.212'. [ 149.675213][ T6503] team0: Port device team_slave_0 added [ 149.684216][ T6503] team0: Port device team_slave_1 added [ 149.803850][ T5787] Bluetooth: hci0: command tx timeout [ 149.840258][ T6543] autofs4:pid:6543:autofs_fill_super: called with bogus options [ 149.894021][ T6503] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 149.926057][ T6503] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 149.973157][ T6503] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 149.993148][ T6503] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 150.000581][ T6503] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 150.094609][ T6503] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 150.261745][ T6503] hsr_slave_0: entered promiscuous mode [ 150.303723][ T6503] hsr_slave_1: entered promiscuous mode [ 150.381111][ T6503] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 150.408332][ T6503] Cannot create hsr debugfs directory [ 150.676365][ T5787] Bluetooth: hci1: command tx timeout [ 150.990582][ T42] IPVS: stop unused estimator thread 0... [ 151.287794][ T6565] loop1: detected capacity change from 0 to 512 [ 151.348696][ T6565] EXT4-fs (loop1): 1 truncate cleaned up [ 151.357975][ T6565] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 151.625310][ T42] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.885060][ T5787] Bluetooth: hci0: command tx timeout [ 152.222675][ T42] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.248488][ T5783] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 152.397623][ T6538] chnl_net:caif_netlink_parms(): no params data found [ 152.500083][ T42] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.707504][ T42] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.755453][ T5787] Bluetooth: hci1: command tx timeout [ 153.481613][ T6503] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 153.614263][ T6538] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.631531][ T6590] loop1: detected capacity change from 0 to 256 [ 153.640170][ T6538] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.665683][ T6538] bridge_slave_0: entered allmulticast mode [ 153.765137][ T6538] bridge_slave_0: entered promiscuous mode [ 153.941824][ T6503] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 153.954613][ T5787] Bluetooth: hci0: command tx timeout [ 154.763798][ T6538] bridge0: port 2(bridge_slave_1) entered blocking state [ 154.804825][ T6538] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.834779][ T6538] bridge_slave_1: entered allmulticast mode [ 154.844657][ T5787] Bluetooth: hci1: command tx timeout [ 154.852587][ T6538] bridge_slave_1: entered promiscuous mode [ 154.920664][ T6598] warning: `syz.1.224' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 154.975018][ T6503] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 155.017796][ T6503] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 155.199819][ T6538] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 155.290861][ T6538] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 155.447963][ T42] tipc: Left network mode [ 156.068120][ T6613] netlink: 12 bytes leftover after parsing attributes in process `syz.0.228'. [ 156.234143][ T6613] fuse: Bad value for 'fd' [ 156.307471][ T6538] team0: Port device team_slave_0 added [ 156.444331][ T6538] team0: Port device team_slave_1 added [ 156.584452][ T6538] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 156.875292][ T6538] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 157.271919][ T5787] Bluetooth: hci1: command tx timeout [ 157.594768][ T6538] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 157.687281][ T6538] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 157.694304][ T6538] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 157.744603][ T6538] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 157.812305][ T6503] 8021q: adding VLAN 0 to HW filter on device bond0 [ 159.026010][ T6538] hsr_slave_0: entered promiscuous mode [ 159.048252][ T6538] hsr_slave_1: entered promiscuous mode [ 159.069326][ T6538] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 159.123353][ T6538] Cannot create hsr debugfs directory [ 159.341170][ T6503] 8021q: adding VLAN 0 to HW filter on device team0 [ 159.522968][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.530154][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 160.159398][ T6235] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.166699][ T6235] bridge0: port 2(bridge_slave_1) entered forwarding state [ 161.234221][ T6670] syzkaller0: entered promiscuous mode [ 161.275414][ T6670] syzkaller0: entered allmulticast mode [ 161.299078][ T6673] tipc: Started in network mode [ 161.316496][ T6673] tipc: Node identity face38cc3a8e, cluster identity 4711 [ 161.323970][ T6673] tipc: Enabled bearer , priority 0 [ 161.350674][ T6538] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 161.409162][ T6669] tipc: Resetting bearer [ 161.514038][ T6669] tipc: Disabling bearer [ 161.527976][ T6538] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 161.548563][ T6538] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 161.673703][ T42] hsr_slave_0: left promiscuous mode [ 161.687339][ T42] hsr_slave_1: left promiscuous mode [ 161.711539][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 161.724635][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 161.747316][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 161.760729][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 161.790456][ T42] bridge_slave_1: left allmulticast mode [ 161.799821][ T42] bridge_slave_1: left promiscuous mode [ 161.812106][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.847127][ T42] bridge_slave_0: left allmulticast mode [ 161.894792][ T42] bridge_slave_0: left promiscuous mode [ 161.900657][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.028440][ T42] veth1_macvtap: left promiscuous mode [ 162.034175][ T42] veth0_macvtap: left promiscuous mode [ 162.048625][ T42] veth1_vlan: left promiscuous mode [ 162.054042][ T42] veth0_vlan: left promiscuous mode [ 164.911912][ T42] team0 (unregistering): Port device team_slave_1 removed [ 164.958510][ T42] team0 (unregistering): Port device team_slave_0 removed [ 165.003285][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 165.050049][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 165.378294][ T42] bond0 (unregistering): Released all slaves [ 165.483915][ T6538] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 165.531509][ T6714] tipc: Enabling of bearer rejected, failed to enable media [ 166.065548][ T6538] 8021q: adding VLAN 0 to HW filter on device bond0 [ 166.274433][ T6538] 8021q: adding VLAN 0 to HW filter on device team0 [ 166.748952][ T1140] bridge0: port 1(bridge_slave_0) entered blocking state [ 166.756217][ T1140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 166.846799][ T1140] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.854081][ T1140] bridge0: port 2(bridge_slave_1) entered forwarding state [ 166.976617][ T42] IPVS: stop unused estimator thread 0... [ 167.003888][ T6538] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 167.093033][ T6503] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 167.639754][ T6538] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 167.847825][ T6771] overlayfs: failed to resolve './file1': -2 [ 168.941279][ T6783] syzkaller0: entered promiscuous mode [ 168.949906][ T6783] syzkaller0: entered allmulticast mode [ 169.013902][ T6503] veth0_vlan: entered promiscuous mode [ 169.055324][ T6783] tipc: Enabled bearer , priority 0 [ 169.083914][ T6780] tipc: Resetting bearer [ 169.121661][ T6780] tipc: Disabling bearer [ 169.465296][ T6503] veth1_vlan: entered promiscuous mode [ 169.862383][ T6503] veth0_macvtap: entered promiscuous mode [ 169.875171][ T6503] veth1_macvtap: entered promiscuous mode [ 169.948038][ T6503] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.991626][ T6503] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.017153][ T6503] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 170.027910][ T6503] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.039991][ T6503] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 170.066360][ T6503] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.090932][ T6503] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.114980][ T6503] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.139839][ T6503] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.181785][ T6503] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 170.209237][ T6503] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.244526][ T6503] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.253509][ T6503] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.284720][ T6503] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.397800][ T6538] veth0_vlan: entered promiscuous mode [ 170.579533][ T6802] syzkaller0: entered promiscuous mode [ 170.587528][ T6802] syzkaller0: entered allmulticast mode [ 170.620655][ T6538] veth1_vlan: entered promiscuous mode [ 170.672623][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 170.683520][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 172.168592][ T6824] overlayfs: failed to resolve './file1': -2 [ 173.118148][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 173.150687][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 173.200300][ T6538] veth0_macvtap: entered promiscuous mode [ 173.230517][ T6538] veth1_macvtap: entered promiscuous mode [ 173.305700][ T6538] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.344552][ T6538] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.404153][ T6538] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.461793][ T6538] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.513586][ T6538] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.525402][ T6538] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.537263][ T6538] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 173.547964][ T6538] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.559169][ T6538] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.569121][ T6538] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.579820][ T6538] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.594560][ T6538] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.620387][ T6538] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.632699][ T6538] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 174.168014][ T6538] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 174.233384][ T6538] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 174.274887][ T6538] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 174.335724][ T6538] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 174.549730][ T6844] overlayfs: failed to resolve './file0': -2 [ 174.769387][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 174.770570][ T1140] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 174.785631][ T1140] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 174.857418][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 175.644336][ T6861] loop4: detected capacity change from 0 to 512 [ 175.676307][ T6861] EXT4-fs (loop4): Test dummy encryption mode enabled [ 175.759022][ T6861] EXT4-fs error (device loop4): ext4_orphan_get:1408: inode #15: comm syz.4.273: inode has both inline data and extents flags [ 175.792674][ T6861] EXT4-fs error (device loop4): ext4_orphan_get:1413: comm syz.4.273: couldn't read orphan inode 15 (err -117) [ 175.826896][ T6861] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 176.221800][ T6870] loop5: detected capacity change from 0 to 8192 [ 176.312054][ T6870] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 177.385561][ T6875] overlayfs: failed to resolve './file1': -2 [ 178.640305][ T6890] loop1: detected capacity change from 0 to 1024 [ 178.692700][ T6890] EXT4-fs: Ignoring removed bh option [ 178.765018][ T6890] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 179.002306][ T6890] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 180.137827][ T5783] EXT4-fs error (device loop1): ext4_read_inline_dir:1591: inode #12: block 7: comm syz-executor: path /82/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 180.159801][ C1] vkms_vblank_simulate: vblank timer overrun [ 180.219694][ T5783] EXT4-fs (loop1): Remounting filesystem read-only [ 180.301983][ T6913] loop5: detected capacity change from 0 to 512 [ 180.405649][ T6913] EXT4-fs (loop5): 1 truncate cleaned up [ 180.412926][ T6913] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 180.651424][ T6538] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 180.721340][ T5783] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 181.029143][ T6853] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.180204][ T6853] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.331764][ T6853] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.569868][ T6853] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.908303][ T6853] tipc: Left network mode [ 183.089916][ T6942] overlayfs: failed to resolve './file0': -2 [ 184.065104][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 184.096825][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 184.126102][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 184.156573][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 184.172222][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 184.193035][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 184.522267][ T6961] loop5: detected capacity change from 0 to 512 [ 184.670242][ T6961] EXT4-fs (loop5): 1 truncate cleaned up [ 184.706537][ T6961] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 184.882404][ T6966] overlayfs: failed to resolve './file1': -2 [ 185.003562][ T6538] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 185.381028][ T6948] chnl_net:caif_netlink_parms(): no params data found [ 186.004845][ T6853] hsr_slave_0: left promiscuous mode [ 186.015458][ T6853] hsr_slave_1: left promiscuous mode [ 186.046239][ T6853] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 186.075021][ T6853] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 186.117931][ T6853] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 186.136990][ T6853] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 186.156864][ T6853] bridge_slave_1: left allmulticast mode [ 186.158274][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 186.162676][ T6853] bridge_slave_1: left promiscuous mode [ 186.197899][ T6853] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.237243][ T6853] bridge_slave_0: left allmulticast mode [ 186.263380][ T6853] bridge_slave_0: left promiscuous mode [ 186.274756][ T5787] Bluetooth: hci2: command tx timeout [ 186.283851][ T6853] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.430157][ T6853] veth1_macvtap: left promiscuous mode [ 186.454906][ T6853] veth0_macvtap: left promiscuous mode [ 186.460760][ T6853] veth1_vlan: left promiscuous mode [ 186.485559][ T6853] veth0_vlan: left promiscuous mode [ 188.279956][ T6853] team0 (unregistering): Port device team_slave_1 removed [ 188.327795][ T6853] team0 (unregistering): Port device team_slave_0 removed [ 188.367377][ T5787] Bluetooth: hci2: command tx timeout [ 188.399432][ T6853] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 188.473890][ T6853] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 188.956188][ T6853] bond0 (unregistering): Released all slaves [ 189.099154][ T7000] overlayfs: failed to resolve './file0': -2 [ 189.169919][ T6948] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.191265][ T6948] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.202513][ T6948] bridge_slave_0: entered allmulticast mode [ 189.211465][ T6948] bridge_slave_0: entered promiscuous mode [ 189.249212][ T6948] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.304241][ T6948] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.347399][ T6948] bridge_slave_1: entered allmulticast mode [ 189.384082][ T6948] bridge_slave_1: entered promiscuous mode [ 189.488178][ T6948] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.535756][ T6948] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 190.202051][ T6948] team0: Port device team_slave_0 added [ 190.398675][ T7014] gadgetfs: bound to dummy_udc driver [ 190.434681][ T5787] Bluetooth: hci2: command tx timeout [ 190.475288][ T7016] loop4: detected capacity change from 0 to 512 [ 190.513327][ T6948] team0: Port device team_slave_1 added [ 190.539432][ T7016] EXT4-fs (loop4): Test dummy encryption mode enabled [ 190.593759][ T7016] EXT4-fs error (device loop4): ext4_orphan_get:1408: inode #15: comm syz.4.305: inode has both inline data and extents flags [ 190.644893][ T7016] EXT4-fs error (device loop4): ext4_orphan_get:1413: comm syz.4.305: couldn't read orphan inode 15 (err -117) [ 190.685006][ T7023] loop5: detected capacity change from 0 to 512 [ 190.697111][ T7023] EXT4-fs (loop5): Test dummy encryption mode enabled [ 190.733565][ T6948] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 190.779451][ T7023] EXT4-fs error (device loop5): ext4_orphan_get:1408: inode #15: comm syz.5.307: inode has both inline data and extents flags [ 190.784643][ T6948] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 190.798465][ T7016] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 190.853577][ T7023] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.307: couldn't read orphan inode 15 (err -117) [ 190.876758][ T6948] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 190.911328][ T7023] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 190.935319][ T6948] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 190.944875][ T6948] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 190.980400][ T6948] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 191.273666][ T6853] IPVS: stop unused estimator thread 0... [ 191.319308][ T6948] hsr_slave_0: entered promiscuous mode [ 191.365899][ T6948] hsr_slave_1: entered promiscuous mode [ 191.544220][ T7031] overlayfs: failed to resolve './file1': -2 [ 192.043235][ T6948] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 192.079081][ T6948] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 192.205186][ T6948] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 192.272908][ T6948] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 192.701555][ T5787] Bluetooth: hci2: command tx timeout [ 193.591140][ T7023] overlayfs: failed to resolve './file1': -2 [ 193.659495][ T6948] 8021q: adding VLAN 0 to HW filter on device bond0 [ 193.702098][ T6948] 8021q: adding VLAN 0 to HW filter on device team0 [ 193.749292][ T1129] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.756596][ T1129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 193.825131][ T6853] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.833282][ T6853] bridge0: port 2(bridge_slave_1) entered forwarding state [ 193.996995][ T6948] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 194.218641][ T6538] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 195.136794][ T7072] loop5: detected capacity change from 0 to 1024 [ 195.175434][ T7072] EXT4-fs: Ignoring removed bh option [ 195.220464][ T7072] EXT4-fs (loop5): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 195.292020][ T7072] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 195.607600][ T6948] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 195.686660][ T6538] EXT4-fs error (device loop5): ext4_read_inline_dir:1591: inode #12: block 7: comm syz-executor: path /13/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 195.708670][ C1] vkms_vblank_simulate: vblank timer overrun [ 195.770218][ T6538] EXT4-fs (loop5): Remounting filesystem read-only [ 196.258701][ T6538] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 196.373878][ T6853] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.318214][ T6853] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.593216][ T6853] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.642979][ T6948] veth0_vlan: entered promiscuous mode [ 197.718402][ T6853] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.757720][ T6948] veth1_vlan: entered promiscuous mode [ 197.873196][ T6948] veth0_macvtap: entered promiscuous mode [ 197.898559][ T6948] veth1_macvtap: entered promiscuous mode [ 197.966582][ T6948] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 197.983623][ T6948] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 198.009723][ T6948] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 198.055458][ T6948] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 198.114795][ T6948] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 198.180513][ T6948] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 198.193096][ T6948] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 198.209054][ T6948] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 198.219916][ T6948] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 198.229919][ T6948] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 198.240976][ T6948] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 198.259850][ T6948] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 198.309744][ T7113] overlayfs: failed to resolve './file1': -2 [ 198.395847][ T6948] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 198.635787][ T6948] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 198.963405][ T6948] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.034090][ T6948] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.079301][ T6948] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.134664][ T6948] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.880708][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.894322][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.985678][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 199.996166][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 200.004117][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 200.042593][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 200.051633][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 200.064724][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 200.400593][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 200.435564][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 201.751072][ T7127] sctp: failed to load transform for md5: -2 [ 201.946063][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 202.006741][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 202.114612][ T51] Bluetooth: hci1: command tx timeout [ 202.717283][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 203.357720][ T7121] chnl_net:caif_netlink_parms(): no params data found [ 203.598610][ T6853] hsr_slave_0: left promiscuous mode [ 203.632000][ T6853] hsr_slave_1: left promiscuous mode [ 203.655109][ T7169] loop6: detected capacity change from 0 to 512 [ 203.752242][ T6853] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 203.768047][ T7169] EXT4-fs (loop6): Test dummy encryption mode enabled [ 203.796016][ T6853] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 203.824837][ T6853] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 203.832321][ T6853] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 203.892028][ T7169] EXT4-fs error (device loop6): ext4_orphan_get:1408: inode #15: comm syz.6.328: inode has both inline data and extents flags [ 203.927504][ T7169] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.328: couldn't read orphan inode 15 (err -117) [ 203.950989][ T6853] bridge_slave_1: left allmulticast mode [ 204.094299][ T6853] bridge_slave_1: left promiscuous mode [ 204.214693][ T51] Bluetooth: hci1: command tx timeout [ 204.260333][ T7169] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 204.308481][ T6853] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.587233][ T6853] bridge_slave_0: left allmulticast mode [ 204.710446][ T6853] bridge_slave_0: left promiscuous mode [ 204.743405][ T6853] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.962183][ T6853] veth1_macvtap: left promiscuous mode [ 204.978494][ T6853] veth0_macvtap: left promiscuous mode [ 205.012338][ T6853] veth1_vlan: left promiscuous mode [ 205.022309][ T6853] veth0_vlan: left promiscuous mode [ 205.151628][ T7180] overlayfs: failed to resolve './file1': -2 [ 206.275121][ T51] Bluetooth: hci1: command tx timeout [ 207.012507][ T6948] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.191398][ T7190] loop6: detected capacity change from 0 to 512 [ 207.254646][ T7190] EXT4-fs (loop6): Test dummy encryption mode enabled [ 207.268764][ T7190] EXT4-fs error (device loop6): ext4_orphan_get:1408: inode #15: comm syz.6.330: inode has both inline data and extents flags [ 207.292545][ T7190] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.330: couldn't read orphan inode 15 (err -117) [ 207.310396][ T7190] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 207.850845][ T7198] overlayfs: failed to resolve './file1': -2 [ 207.900022][ T7200] loop4: detected capacity change from 0 to 1024 [ 207.918003][ T7200] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 207.939976][ T6853] team0 (unregistering): Port device team_slave_1 removed [ 207.958475][ T7200] JBD2: no valid journal superblock found [ 207.980934][ T7200] EXT4-fs (loop4): Could not load journal inode [ 208.052666][ T6853] team0 (unregistering): Port device team_slave_0 removed [ 208.134938][ T6853] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 208.294915][ T6853] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 208.386145][ T51] Bluetooth: hci1: command tx timeout [ 209.141372][ T7204] loop4: detected capacity change from 0 to 512 [ 209.155390][ T7204] EXT4-fs: Ignoring removed mblk_io_submit option [ 209.190301][ T7204] EXT4-fs: test_dummy_encryption requires encrypt feature [ 209.786126][ T6853] bond0 (unregistering): Released all slaves [ 210.856206][ T7121] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.927678][ T7121] bridge0: port 1(bridge_slave_0) entered disabled state [ 210.959203][ T7121] bridge_slave_0: entered allmulticast mode [ 210.981002][ T7121] bridge_slave_0: entered promiscuous mode [ 211.011649][ T7121] bridge0: port 2(bridge_slave_1) entered blocking state [ 211.040394][ T7121] bridge0: port 2(bridge_slave_1) entered disabled state [ 211.070946][ T7121] bridge_slave_1: entered allmulticast mode [ 211.094312][ T7121] bridge_slave_1: entered promiscuous mode [ 211.245450][ T7221] overlayfs: failed to resolve './file1': -2 [ 211.843607][ T7121] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 211.919419][ T7121] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 212.202944][ T7121] team0: Port device team_slave_0 added [ 212.328693][ T7121] team0: Port device team_slave_1 added [ 212.585170][ T7121] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 212.630277][ T7121] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 212.673698][ T7230] loop4: detected capacity change from 0 to 512 [ 212.803332][ T7230] EXT4-fs error (device loop4): ext4_iget_extra_inode:4740: inode #15: comm syz.4.340: corrupted in-inode xattr: invalid ea_ino [ 212.825243][ T7121] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 212.892068][ T7230] EXT4-fs error (device loop4): ext4_orphan_get:1413: comm syz.4.340: couldn't read orphan inode 15 (err -117) [ 212.911820][ T7121] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 212.949659][ T7121] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 212.988897][ T7230] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 213.098093][ T7121] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 213.410396][ T7121] hsr_slave_0: entered promiscuous mode [ 213.434355][ T7121] hsr_slave_1: entered promiscuous mode [ 213.475316][ T7121] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 213.483437][ T7121] Cannot create hsr debugfs directory [ 213.549176][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 213.922817][ T7245] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input5 [ 214.709730][ T7253] netlink: 'syz.0.343': attribute type 10 has an invalid length. [ 214.731817][ T7253] syz_tun: entered promiscuous mode [ 214.844127][ T7253] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 215.914661][ T7121] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 215.981981][ T7121] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 216.010827][ T7262] FAULT_INJECTION: forcing a failure. [ 216.010827][ T7262] name failslab, interval 1, probability 0, space 0, times 0 [ 216.034623][ T7262] CPU: 0 PID: 7262 Comm: syz.4.346 Not tainted syzkaller #0 [ 216.042013][ T7262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 216.052147][ T7262] Call Trace: [ 216.055474][ T7262] [ 216.058453][ T7262] dump_stack_lvl+0x18c/0x250 [ 216.063231][ T7262] ? show_regs_print_info+0x20/0x20 [ 216.068526][ T7262] ? load_image+0x420/0x420 [ 216.073104][ T7262] ? __might_sleep+0xe0/0xe0 [ 216.077768][ T7262] ? __lock_acquire+0x7d80/0x7d80 [ 216.082856][ T7262] should_fail_ex+0x394/0x4c0 [ 216.088195][ T7262] should_failslab+0x9/0x20 [ 216.092806][ T7262] slab_pre_alloc_hook+0x59/0x300 [ 216.097912][ T7262] ? d_instantiate+0x6f/0x90 [ 216.102580][ T7262] kmem_cache_alloc+0x5a/0x2c0 [ 216.107458][ T7262] ? alloc_empty_file+0x9e/0x1d0 [ 216.112465][ T7262] alloc_empty_file+0x9e/0x1d0 [ 216.117290][ T7262] alloc_file+0x5b/0x600 [ 216.121599][ T7262] alloc_file_pseudo+0x184/0x210 [ 216.126599][ T7262] ? fput+0x1a0/0x1a0 [ 216.130677][ T7262] anon_inode_getfile+0xc5/0x1a0 [ 216.135702][ T7262] sync_file_create+0x76/0x1c0 [ 216.140533][ T7262] sw_sync_ioctl+0x921/0xaa0 [ 216.145216][ T7262] ? __bpf_trace_sync_timeline+0x100/0x100 [ 216.151103][ T7262] ? __fget_files+0x28/0x460 [ 216.155780][ T7262] ? bpf_lsm_file_ioctl+0x9/0x10 [ 216.160799][ T7262] ? security_file_ioctl+0x80/0xa0 [ 216.165989][ T7262] ? __bpf_trace_sync_timeline+0x100/0x100 [ 216.171874][ T7262] __se_sys_ioctl+0xfd/0x170 [ 216.176535][ T7262] do_syscall_64+0x55/0xb0 [ 216.181012][ T7262] ? clear_bhb_loop+0x40/0x90 [ 216.185757][ T7262] ? clear_bhb_loop+0x40/0x90 [ 216.190504][ T7262] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 216.196460][ T7262] RIP: 0033:0x7f9829d9e159 [ 216.200949][ T7262] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 216.220619][ T7262] RSP: 002b:00007f982ac25028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 216.229106][ T7262] RAX: ffffffffffffffda RBX: 00007f982a025fa0 RCX: 00007f9829d9e159 [ 216.237148][ T7262] RDX: 0000200000000b00 RSI: 00000000c0285700 RDI: 0000000000000005 [ 216.245631][ T7262] RBP: 00007f9829e3503b R08: 0000000000000000 R09: 0000000000000000 [ 216.253760][ T7262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 216.261824][ T7262] R13: 00007f982a026038 R14: 00007f982a025fa0 R15: 00007fff32d50c08 [ 216.269882][ T7262] [ 216.298121][ T7121] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 216.314778][ T7121] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 216.622971][ T6948] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.643915][ T7121] 8021q: adding VLAN 0 to HW filter on device bond0 [ 216.733017][ T7121] 8021q: adding VLAN 0 to HW filter on device team0 [ 216.796642][ T1140] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.803914][ T1140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 216.908759][ T6853] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.916021][ T6853] bridge0: port 2(bridge_slave_1) entered forwarding state [ 217.006450][ T5819] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 217.327117][ T5787] Bluetooth: hci3: command 0x0406 tx timeout [ 217.345373][ T5819] usb 5-1: config 0 has no interfaces? [ 217.351467][ T5819] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 217.394342][ T5819] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.564944][ T5819] usb 5-1: config 0 descriptor?? [ 218.488184][ T5819] usb 5-1: string descriptor 0 read error: -71 [ 219.220550][ T5819] usb 5-1: USB disconnect, device number 2 [ 219.548702][ T7121] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 219.908902][ T7313] loop4: detected capacity change from 0 to 256 [ 220.052982][ T7319] overlayfs: failed to resolve './file1': -2 [ 220.950597][ T7327] loop4: detected capacity change from 0 to 256 [ 221.061676][ T7327] FAT-fs (loop4): Directory bread(block 1285) failed [ 221.121026][ T7327] FAT-fs (loop4): Directory bread(block 1286) failed [ 221.165708][ T7327] FAT-fs (loop4): Directory bread(block 1287) failed [ 221.209089][ T7327] FAT-fs (loop4): Directory bread(block 1288) failed [ 222.396551][ T7327] FAT-fs (loop4): Directory bread(block 1285) failed [ 222.403764][ T7327] FAT-fs (loop4): Directory bread(block 1286) failed [ 222.410814][ T7327] FAT-fs (loop4): Directory bread(block 1287) failed [ 222.417655][ T7327] FAT-fs (loop4): Directory bread(block 1288) failed [ 222.980560][ T7121] veth0_vlan: entered promiscuous mode [ 223.082087][ T7121] veth1_vlan: entered promiscuous mode [ 223.320807][ T7121] veth0_macvtap: entered promiscuous mode [ 223.350678][ T7121] veth1_macvtap: entered promiscuous mode [ 223.374130][ T7121] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 223.388077][ T7121] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.415384][ T7121] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 223.443184][ T7121] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.469593][ T7121] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 223.502199][ T7121] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.558625][ T7121] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 223.601556][ T7121] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 223.644724][ T7121] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.680195][ T7121] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 223.710011][ T7358] loop6: detected capacity change from 0 to 256 [ 223.713172][ T7121] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.739179][ T7121] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 223.752101][ T7121] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.783542][ T7121] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 223.815981][ T5789] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 223.858350][ T7121] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.894628][ T7121] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.913497][ T7121] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.953323][ T7121] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.008973][ T7363] syzkaller0: entered promiscuous mode [ 224.028385][ T7363] syzkaller0: entered allmulticast mode [ 224.063106][ T7369] loop4: detected capacity change from 0 to 512 [ 224.096018][ T7369] EXT4-fs (loop4): Test dummy encryption mode enabled [ 224.187176][ T7369] EXT4-fs error (device loop4): ext4_orphan_get:1408: inode #15: comm syz.4.371: inode has both inline data and extents flags [ 224.245738][ T7369] EXT4-fs error (device loop4): ext4_orphan_get:1413: comm syz.4.371: couldn't read orphan inode 15 (err -117) [ 224.280243][ T7374] loop6: detected capacity change from 0 to 512 [ 224.296201][ T7369] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 224.339367][ T7374] EXT4-fs error (device loop6): ext4_iget_extra_inode:4740: inode #15: comm syz.6.373: corrupted in-inode xattr: invalid ea_ino [ 224.367278][ T7374] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.373: couldn't read orphan inode 15 (err -117) [ 224.400124][ T7374] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 224.634038][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 224.944100][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 225.565192][ T7384] overlayfs: failed to resolve './file1': -2 [ 226.119508][ T44] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 226.242060][ T6948] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 226.254078][ T44] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 227.473488][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 227.550622][ T7408] loop7: detected capacity change from 0 to 256 [ 227.708648][ T7410] syzkaller0: entered promiscuous mode [ 227.714330][ T7410] syzkaller0: entered allmulticast mode [ 227.905643][ T7420] loop7: detected capacity change from 0 to 512 [ 227.944647][ T7420] EXT4-fs error (device loop7): ext4_iget_extra_inode:4740: inode #15: comm syz.7.383: corrupted in-inode xattr: invalid ea_ino [ 228.015380][ T7420] EXT4-fs error (device loop7): ext4_orphan_get:1413: comm syz.7.383: couldn't read orphan inode 15 (err -117) [ 228.058368][ T7420] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 228.457488][ T7121] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 228.499222][ T7437] loop6: detected capacity change from 0 to 512 [ 228.524735][ T7437] EXT4-fs (loop6): Test dummy encryption mode enabled [ 228.556757][ T7437] EXT4-fs error (device loop6): ext4_orphan_get:1408: inode #15: comm syz.6.388: inode has both inline data and extents flags [ 228.588031][ T7437] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.388: couldn't read orphan inode 15 (err -117) [ 228.614139][ T7437] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 229.036030][ T7450] overlayfs: failed to resolve './file1': -2 [ 229.922633][ T7457] syzkaller0: entered promiscuous mode [ 229.964013][ T7457] syzkaller0: entered allmulticast mode [ 231.730055][ T6948] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 231.990088][ T7488] netlink: 96 bytes leftover after parsing attributes in process `syz.6.401'. [ 232.126037][ T7484] can0: slcan on ptm0. [ 232.142114][ T7485] FAULT_INJECTION: forcing a failure. [ 232.142114][ T7485] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.155331][ T7485] CPU: 0 PID: 7485 Comm: syz.0.403 Not tainted syzkaller #0 [ 232.162674][ T7485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 232.172788][ T7485] Call Trace: [ 232.176116][ T7485] [ 232.179094][ T7485] dump_stack_lvl+0x18c/0x250 [ 232.183866][ T7485] ? show_regs_print_info+0x20/0x20 [ 232.189128][ T7485] ? load_image+0x420/0x420 [ 232.193673][ T7485] ? __might_fault+0xaa/0x120 [ 232.198391][ T7485] ? __lock_acquire+0x7d80/0x7d80 [ 232.203463][ T7485] should_fail_ex+0x394/0x4c0 [ 232.208285][ T7485] _copy_from_user+0x2f/0xe0 [ 232.213038][ T7485] __sys_bpf+0x23e/0x890 [ 232.217319][ T7485] ? bpf_link_show_fdinfo+0x390/0x390 [ 232.222736][ T7485] ? lock_chain_count+0x20/0x20 [ 232.227632][ T7485] __x64_sys_bpf+0x7c/0x90 [ 232.232101][ T7485] do_syscall_64+0x55/0xb0 [ 232.236552][ T7485] ? clear_bhb_loop+0x40/0x90 [ 232.241264][ T7485] ? clear_bhb_loop+0x40/0x90 [ 232.246064][ T7485] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 232.252260][ T7485] RIP: 0033:0x7f92bb39e159 [ 232.256710][ T7485] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.276445][ T7485] RSP: 002b:00007f92bc321028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 232.284905][ T7485] RAX: ffffffffffffffda RBX: 00007f92bb625fa0 RCX: 00007f92bb39e159 [ 232.292911][ T7485] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012 [ 232.300998][ T7485] RBP: 00007f92bb43503b R08: 0000000000000000 R09: 0000000000000000 [ 232.309002][ T7485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 232.317033][ T7485] R13: 00007f92bb626038 R14: 00007f92bb625fa0 R15: 00007ffd7083e128 [ 232.325086][ T7485] [ 232.486696][ T7483] can0 (unregistered): slcan off ptm0. [ 232.850641][ T7503] syzkaller0: entered promiscuous mode [ 232.857057][ T7510] FAULT_INJECTION: forcing a failure. [ 232.857057][ T7510] name failslab, interval 1, probability 0, space 0, times 0 [ 232.870458][ T7503] syzkaller0: entered allmulticast mode [ 232.887011][ T7510] CPU: 1 PID: 7510 Comm: syz.4.410 Not tainted syzkaller #0 [ 232.894387][ T7510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 232.904493][ T7510] Call Trace: [ 232.907800][ T7510] [ 232.910761][ T7510] dump_stack_lvl+0x18c/0x250 [ 232.915487][ T7510] ? show_regs_print_info+0x20/0x20 [ 232.920724][ T7510] ? load_image+0x420/0x420 [ 232.925263][ T7510] ? __might_sleep+0xe0/0xe0 [ 232.929887][ T7510] ? __lock_acquire+0x7d80/0x7d80 [ 232.934968][ T7510] ? __asan_memset+0x22/0x40 [ 232.939614][ T7510] should_fail_ex+0x394/0x4c0 [ 232.944367][ T7510] should_failslab+0x9/0x20 [ 232.948929][ T7510] slab_pre_alloc_hook+0x59/0x300 [ 232.954019][ T7510] ? __netlink_kernel_create+0x1f2/0x7b0 [ 232.959693][ T7510] ? __netlink_kernel_create+0x1f2/0x7b0 [ 232.965369][ T7510] __kmem_cache_alloc_node+0x53/0x250 [ 232.970811][ T7510] ? __netlink_kernel_create+0x1f2/0x7b0 [ 232.976576][ T7510] __kmalloc+0xa7/0x240 [ 232.980779][ T7510] __netlink_kernel_create+0x1f2/0x7b0 [ 232.986307][ T7510] ? netlink_set_err+0x3b0/0x3b0 [ 232.991311][ T7510] ? __asan_memset+0x22/0x40 [ 232.995958][ T7510] ? genl_pernet_init+0xa8/0x170 [ 233.000942][ T7510] genl_pernet_init+0xba/0x170 [ 233.005839][ T7510] ? ctrl_dumppolicy_put_op+0xa30/0xa30 [ 233.011427][ T7510] ? genl_pernet_exit+0x60/0x60 [ 233.016307][ T7510] ? genl_rcv+0x40/0x40 [ 233.020605][ T7510] ? __raw_spin_lock_init+0x45/0x100 [ 233.025955][ T7510] ? debug_mutex_init+0x38/0x70 [ 233.030842][ T7510] ops_init+0x391/0x640 [ 233.035037][ T7510] setup_net+0x3b6/0xa20 [ 233.039340][ T7510] ? copy_net_ns+0x5d0/0x5d0 [ 233.043976][ T7510] ? copy_net_ns+0x342/0x5d0 [ 233.048612][ T7510] ? down_read_killable+0x1d0/0x340 [ 233.053857][ T7510] copy_net_ns+0x35e/0x5d0 [ 233.058313][ T7510] create_new_namespaces+0x3ce/0x700 [ 233.063653][ T7510] unshare_nsproxy_namespaces+0x11a/0x160 [ 233.069413][ T7510] ksys_unshare+0x4fa/0x8f0 [ 233.073962][ T7510] ? sighand_ctor+0x50/0x50 [ 233.078501][ T7510] ? lock_chain_count+0x20/0x20 [ 233.083434][ T7510] ? syscall_enter_from_user_mode+0x25/0x80 [ 233.089421][ T7510] __x64_sys_unshare+0x38/0x40 [ 233.094246][ T7510] do_syscall_64+0x55/0xb0 [ 233.098707][ T7510] ? clear_bhb_loop+0x40/0x90 [ 233.103622][ T7510] ? clear_bhb_loop+0x40/0x90 [ 233.108389][ T7510] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 233.114331][ T7510] RIP: 0033:0x7f9829d9e159 [ 233.118785][ T7510] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 233.138439][ T7510] RSP: 002b:00007f982ac25028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 233.146896][ T7510] RAX: ffffffffffffffda RBX: 00007f982a025fa0 RCX: 00007f9829d9e159 [ 233.154911][ T7510] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000060040000 [ 233.163361][ T7510] RBP: 00007f9829e3503b R08: 0000000000000000 R09: 0000000000000000 [ 233.171395][ T7510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 233.179418][ T7510] R13: 00007f982a026038 R14: 00007f982a025fa0 R15: 00007fff32d50c08 [ 233.187441][ T7510] [ 233.190630][ C1] vkms_vblank_simulate: vblank timer overrun [ 233.486508][ T7519] loop4: detected capacity change from 0 to 512 [ 233.546979][ T7519] EXT4-fs error (device loop4): ext4_iget_extra_inode:4740: inode #15: comm syz.4.412: corrupted in-inode xattr: invalid ea_ino [ 233.646762][ T7519] EXT4-fs error (device loop4): ext4_orphan_get:1413: comm syz.4.412: couldn't read orphan inode 15 (err -117) [ 233.777217][ T7519] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 235.202640][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 235.423881][ T7549] loop7: detected capacity change from 0 to 256 [ 235.482210][ T7552] netlink: 96 bytes leftover after parsing attributes in process `syz.4.419'. [ 235.536617][ T7549] netlink: 1624 bytes leftover after parsing attributes in process `syz.7.420'. [ 235.619249][ T7555] syzkaller0: entered promiscuous mode [ 235.634249][ T7555] syzkaller0: entered allmulticast mode [ 236.131040][ T7570] loop6: detected capacity change from 0 to 256 [ 236.348557][ T7570] FAT-fs (loop6): Directory bread(block 1285) failed [ 236.371583][ T7570] FAT-fs (loop6): Directory bread(block 1286) failed [ 236.378447][ T7570] FAT-fs (loop6): Directory bread(block 1287) failed [ 236.386487][ T7570] FAT-fs (loop6): Directory bread(block 1288) failed [ 236.420930][ T7570] FAT-fs (loop6): Directory bread(block 1285) failed [ 236.427793][ T7570] FAT-fs (loop6): Directory bread(block 1286) failed [ 236.434677][ T7570] FAT-fs (loop6): Directory bread(block 1287) failed [ 236.441447][ T7570] FAT-fs (loop6): Directory bread(block 1288) failed [ 237.437137][ T7583] bridge_slave_0: left allmulticast mode [ 237.452485][ T7587] loop7: detected capacity change from 0 to 256 [ 237.490856][ T7587] FAT-fs (loop7): Directory bread(block 1285) failed [ 237.498280][ T7583] bridge_slave_0: left promiscuous mode [ 237.544539][ T7587] FAT-fs (loop7): Directory bread(block 1286) failed [ 237.551343][ T7587] FAT-fs (loop7): Directory bread(block 1287) failed [ 237.584266][ T7587] FAT-fs (loop7): Directory bread(block 1288) failed [ 237.595349][ T7583] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.665983][ T7587] FAT-fs (loop7): Directory bread(block 1285) failed [ 237.672868][ T7587] FAT-fs (loop7): Directory bread(block 1286) failed [ 237.679875][ T7587] FAT-fs (loop7): Directory bread(block 1287) failed [ 237.686820][ T7587] FAT-fs (loop7): Directory bread(block 1288) failed [ 238.262954][ T7583] bridge_slave_1: left allmulticast mode [ 238.462206][ T7583] bridge_slave_1: left promiscuous mode [ 238.578816][ T7583] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.758247][ T7583] bond0: (slave bond_slave_0): Releasing backup interface [ 238.958772][ T7583] bond0: (slave bond_slave_1): Releasing backup interface [ 239.175086][ T7583] team0: Port device team_slave_0 removed [ 239.240412][ T7583] team0: Port device team_slave_1 removed [ 239.265987][ T7583] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 239.273482][ T7583] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 239.373426][ T7583] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 239.432557][ T7583] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 239.861570][ T7611] syzkaller0: entered promiscuous mode [ 239.881837][ T7611] syzkaller0: entered allmulticast mode [ 240.620860][ T7638] loop4: detected capacity change from 0 to 256 [ 240.651041][ T7638] FAT-fs (loop4): Directory bread(block 1285) failed [ 240.660791][ T7638] FAT-fs (loop4): Directory bread(block 1286) failed [ 240.692391][ T7638] FAT-fs (loop4): Directory bread(block 1287) failed [ 240.708992][ T7638] FAT-fs (loop4): Directory bread(block 1288) failed [ 240.732240][ T7638] FAT-fs (loop4): Directory bread(block 1285) failed [ 240.739217][ T7638] FAT-fs (loop4): Directory bread(block 1286) failed [ 240.746069][ T7638] FAT-fs (loop4): Directory bread(block 1287) failed [ 240.752821][ T7638] FAT-fs (loop4): Directory bread(block 1288) failed [ 241.823442][ T7645] FAULT_INJECTION: forcing a failure. [ 241.823442][ T7645] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 241.845376][ T7645] CPU: 1 PID: 7645 Comm: syz.4.441 Not tainted syzkaller #0 [ 241.852776][ T7645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 241.862900][ T7645] Call Trace: [ 241.866241][ T7645] [ 241.869225][ T7645] dump_stack_lvl+0x18c/0x250 [ 241.873965][ T7645] ? show_regs_print_info+0x20/0x20 [ 241.879221][ T7645] ? load_image+0x420/0x420 [ 241.883787][ T7645] ? __lock_acquire+0x7d80/0x7d80 [ 241.888878][ T7645] should_fail_ex+0x394/0x4c0 [ 241.893621][ T7645] prepare_alloc_pages+0x1e1/0x5b0 [ 241.898796][ T7645] __alloc_pages+0x134/0x460 [ 241.903445][ T7645] ? zone_statistics+0x170/0x170 [ 241.908429][ T7645] ? generic_access_phys+0x650/0x650 [ 241.913767][ T7645] ? alloc_pages+0x4e1/0x740 [ 241.918422][ T7645] __get_free_pages+0xc/0x30 [ 241.923065][ T7645] proc_pid_cmdline_read+0x3f1/0x830 [ 241.928440][ T7645] ? schedule+0xc7/0x170 [ 241.932764][ T7645] ? comm_show+0x150/0x150 [ 241.937375][ T7645] ? common_file_perm+0x190/0x1f0 [ 241.942477][ T7645] ? fsnotify_perm+0x271/0x5e0 [ 241.947423][ T7645] do_iter_read+0x4fb/0xcb0 [ 241.952005][ T7645] ? comm_show+0x150/0x150 [ 241.956486][ T7645] ? vfs_iter_read+0xa0/0xa0 [ 241.961167][ T7645] ? __import_iovec+0x5f2/0x850 [ 241.961215][ T7645] ? import_iovec+0x73/0xa0 [ 241.970628][ T7645] do_preadv+0x237/0x390 [ 241.974923][ T7645] ? do_writev+0x480/0x480 [ 241.979414][ T7645] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 241.985443][ T7645] ? lock_chain_count+0x20/0x20 [ 241.990350][ T7645] ? lockdep_hardirqs_on+0x98/0x150 [ 241.995615][ T7645] do_syscall_64+0x55/0xb0 [ 242.000075][ T7645] ? clear_bhb_loop+0x40/0x90 [ 242.004788][ T7645] ? clear_bhb_loop+0x40/0x90 [ 242.009506][ T7645] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 242.015436][ T7645] RIP: 0033:0x7f9829d9e159 [ 242.019894][ T7645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 242.039540][ T7645] RSP: 002b:00007f982ac25028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 242.048000][ T7645] RAX: ffffffffffffffda RBX: 00007f982a025fa0 RCX: 00007f9829d9e159 [ 242.056108][ T7645] RDX: 0000000000000001 RSI: 0000200000001200 RDI: 0000000000000005 [ 242.064129][ T7645] RBP: 00007f9829e3503b R08: 0000000000006a76 R09: 0000000000000000 [ 242.072137][ T7645] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000000 [ 242.080144][ T7645] R13: 00007f982a026038 R14: 00007f982a025fa0 R15: 00007fff32d50c08 [ 242.088161][ T7645] [ 242.091376][ C1] vkms_vblank_simulate: vblank timer overrun [ 243.482994][ T7629] netlink: 96 bytes leftover after parsing attributes in process `syz.0.436'. [ 245.085983][ T7680] loop4: detected capacity change from 0 to 1024 [ 245.167207][ T7680] EXT4-fs (loop4): mounted filesystem 00000000-0100-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 245.235311][ T7680] ext4 filesystem being mounted at /48/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 245.298748][ T7692] netlink: 96 bytes leftover after parsing attributes in process `syz.7.454'. [ 245.536842][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0100-0006-0000-000000000000. [ 245.748486][ T7700] syzkaller0: entered promiscuous mode [ 245.758649][ T7700] syzkaller0: entered allmulticast mode [ 246.284872][ T7712] FAULT_INJECTION: forcing a failure. [ 246.284872][ T7712] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 246.321356][ T7712] CPU: 0 PID: 7712 Comm: syz.6.459 Not tainted syzkaller #0 [ 246.328750][ T7712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 246.338877][ T7712] Call Trace: [ 246.342225][ T7712] [ 246.345206][ T7712] dump_stack_lvl+0x18c/0x250 [ 246.349949][ T7712] ? show_regs_print_info+0x20/0x20 [ 246.355237][ T7712] ? load_image+0x420/0x420 [ 246.359827][ T7712] ? __might_fault+0xaa/0x120 [ 246.364592][ T7712] ? __lock_acquire+0x7d80/0x7d80 [ 246.369694][ T7712] should_fail_ex+0x394/0x4c0 [ 246.374469][ T7712] _copy_from_iter+0x1cd/0x1290 [ 246.379402][ T7712] ? copyout_mc+0x70/0x70 [ 246.383882][ T7712] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 246.390097][ T7712] ? __lock_acquire+0x7d80/0x7d80 [ 246.395196][ T7712] ? lock_chain_count+0x20/0x20 [ 246.400111][ T7712] ? _raw_spin_lock_irq+0xbb/0xf0 [ 246.405207][ T7712] ? _raw_spin_lock_irqsave+0x100/0x100 [ 246.410832][ T7712] ? page_copy_sane+0x4e/0x270 [ 246.415676][ T7712] copy_page_from_iter+0x7b/0x100 [ 246.420785][ T7712] pipe_write+0x758/0x1b20 [ 246.425278][ T7712] ? pipe_write+0xce1/0x1b20 [ 246.429958][ T7712] ? pipe_read+0x1330/0x1330 [ 246.432008][ T51] Bluetooth: hci1: link tx timeout [ 246.434588][ T7712] ? wake_bit_function+0x200/0x200 [ 246.434649][ T7712] ? common_file_perm+0x198/0x1f0 [ 246.434684][ T7712] vfs_write+0x474/0x9a0 [ 246.434722][ T7712] ? file_end_write+0x250/0x250 [ 246.434768][ T7712] ? __fget_files+0x3fc/0x460 [ 246.448200][ T51] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 246.450260][ T7712] ? __fdget_pos+0x1d8/0x330 [ 246.450296][ T7712] ? ksys_write+0x74/0x260 [ 246.481118][ T7712] ksys_write+0x151/0x260 [ 246.485519][ T7712] ? __ia32_sys_read+0x90/0x90 [ 246.490361][ T7712] ? lockdep_hardirqs_on+0x98/0x150 [ 246.495628][ T7712] do_syscall_64+0x55/0xb0 [ 246.500105][ T7712] ? clear_bhb_loop+0x40/0x90 [ 246.504950][ T7712] ? clear_bhb_loop+0x40/0x90 [ 246.509691][ T7712] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 246.515651][ T7712] RIP: 0033:0x7f9388d9e159 [ 246.520128][ T7712] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 246.539799][ T7712] RSP: 002b:00007f9389c17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 246.548288][ T7712] RAX: ffffffffffffffda RBX: 00007f9389025fa0 RCX: 00007f9388d9e159 [ 246.556379][ T7712] RDX: 00000000fffffede RSI: 0000200000000400 RDI: 0000000000000005 [ 246.564386][ T7712] RBP: 00007f9388e3503b R08: 0000000000000000 R09: 0000000000000000 [ 246.572472][ T7712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 246.580475][ T7712] R13: 00007f9389026038 R14: 00007f9389025fa0 R15: 00007ffe7a263508 [ 246.588501][ T7712] [ 246.736389][ T7722] netlink: 'syz.4.463': attribute type 10 has an invalid length. [ 246.749053][ T7722] syz_tun: entered promiscuous mode [ 246.784392][ T7722] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 247.169212][ T7735] loop6: detected capacity change from 0 to 256 [ 247.269901][ T5789] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 247.525481][ T7744] netlink: 96 bytes leftover after parsing attributes in process `syz.7.470'. [ 248.533359][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 249.169400][ T7769] netlink: 'syz.0.478': attribute type 10 has an invalid length. [ 250.696825][ T7797] netlink: 96 bytes leftover after parsing attributes in process `syz.0.485'. [ 251.138115][ T7811] loop4: detected capacity change from 0 to 1024 [ 251.157095][ T7811] EXT4-fs: Ignoring removed bh option [ 251.186363][ T7811] EXT4-fs (loop4): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 251.250368][ T7811] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 251.381293][ T7811] overlayfs: missing 'lowerdir' [ 251.562498][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 251.590530][ T7828] loop6: detected capacity change from 0 to 512 [ 251.619433][ T7828] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 251.711281][ T5788] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 252.855358][ T7854] netlink: 96 bytes leftover after parsing attributes in process `syz.4.503'. [ 253.018840][ T7860] loop6: detected capacity change from 0 to 1024 [ 253.046351][ T7860] EXT4-fs: Ignoring removed bh option [ 253.073002][ T7860] EXT4-fs (loop6): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 253.123072][ T7860] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 253.178763][ T7860] overlayfs: missing 'lowerdir' [ 253.282210][ T6948] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 253.532107][ T7878] loop6: detected capacity change from 0 to 512 [ 253.562863][ T7878] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 254.621160][ T7893] loop6: detected capacity change from 0 to 128 [ 254.751763][ T7893] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 254.809711][ T7893] ext4 filesystem being mounted at /52/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 254.883113][ T7905] loop4: detected capacity change from 0 to 1024 [ 254.949372][ T7905] EXT4-fs: Ignoring removed bh option [ 254.985397][ T7893] capability: warning: `syz.6.513' uses deprecated v2 capabilities in a way that may be insecure [ 255.035349][ T7905] EXT4-fs (loop4): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 255.456482][ T6948] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 255.577471][ T7905] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 255.801218][ T7905] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 255.836840][ T7905] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 256.027174][ T7920] netlink: 96 bytes leftover after parsing attributes in process `syz.7.519'. [ 256.038288][ T7922] FAULT_INJECTION: forcing a failure. [ 256.038288][ T7922] name fail_futex, interval 1, probability 0, space 0, times 1 [ 256.067569][ T7922] CPU: 1 PID: 7922 Comm: syz.0.520 Not tainted syzkaller #0 [ 256.074959][ T7922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 256.085112][ T7922] Call Trace: [ 256.088465][ T7922] [ 256.091456][ T7922] dump_stack_lvl+0x18c/0x250 [ 256.093374][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 256.096274][ T7922] ? show_regs_print_info+0x20/0x20 [ 256.096305][ T7922] ? load_image+0x420/0x420 [ 256.096340][ T7922] should_fail_ex+0x394/0x4c0 [ 256.119858][ T7922] get_futex_key+0x136/0x1030 [ 256.124624][ T7922] ? futex_setup_timer+0xc0/0xc0 [ 256.129621][ T7922] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 256.135799][ T7922] ? __lock_acquire+0x7d80/0x7d80 [ 256.140891][ T7922] ? lock_chain_count+0x20/0x20 [ 256.145811][ T7922] futex_wait_setup+0xbc/0x270 [ 256.150742][ T7922] ? futex_wait_multiple+0x920/0x920 [ 256.156085][ T7922] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 256.162077][ T7922] ? _raw_spin_unlock+0x40/0x40 [ 256.167104][ T7922] futex_wait+0x1bc/0x5c0 [ 256.171514][ T7922] ? futex_wait_setup+0x270/0x270 [ 256.176652][ T7922] ? fd_install+0x60/0x4e0 [ 256.181239][ T7922] do_futex+0x2ff/0x3e0 [ 256.185555][ T7922] ? __ia32_sys_get_robust_list+0x110/0x110 [ 256.191533][ T7922] __se_sys_futex+0x3a9/0x440 [ 256.196257][ T7922] ? __x64_sys_futex+0xf0/0xf0 [ 256.201057][ T7922] ? __x64_sys_futex+0x21/0xf0 [ 256.205870][ T7922] do_syscall_64+0x55/0xb0 [ 256.210319][ T7922] ? clear_bhb_loop+0x40/0x90 [ 256.215058][ T7922] ? clear_bhb_loop+0x40/0x90 [ 256.219777][ T7922] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 256.225800][ T7922] RIP: 0033:0x7f92bb39e159 [ 256.230264][ T7922] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 256.250208][ T7922] RSP: 002b:00007f92bc3210e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 256.258930][ T7922] RAX: ffffffffffffffda RBX: 00007f92bb625fa8 RCX: 00007f92bb39e159 [ 256.266945][ T7922] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f92bb625fa8 [ 256.274956][ T7922] RBP: 00007f92bb625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 256.282985][ T7922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 256.291026][ T7922] R13: 00007f92bb626038 R14: 00007ffd7083e040 R15: 00007ffd7083e128 [ 256.299049][ T7922] [ 256.302212][ C1] vkms_vblank_simulate: vblank timer overrun [ 256.319660][ T7925] loop6: detected capacity change from 0 to 512 [ 256.339353][ T7925] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 258.295799][ T7965] loop4: detected capacity change from 0 to 1024 [ 258.303734][ T7965] EXT4-fs: Ignoring removed bh option [ 258.424352][ T7965] EXT4-fs (loop4): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 258.494942][ T7971] FAULT_INJECTION: forcing a failure. [ 258.494942][ T7971] name fail_futex, interval 1, probability 0, space 0, times 0 [ 258.528148][ T7970] netlink: 96 bytes leftover after parsing attributes in process `syz.7.533'. [ 258.549396][ T7971] CPU: 0 PID: 7971 Comm: syz.6.531 Not tainted syzkaller #0 [ 258.556860][ T7971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 258.567071][ T7971] Call Trace: [ 258.570419][ T7971] [ 258.573402][ T7971] dump_stack_lvl+0x18c/0x250 [ 258.578179][ T7971] ? show_regs_print_info+0x20/0x20 [ 258.583453][ T7971] ? load_image+0x420/0x420 [ 258.588026][ T7971] ? lockdep_hardirqs_on+0x98/0x150 [ 258.593314][ T7971] should_fail_ex+0x394/0x4c0 [ 258.598180][ T7971] get_futex_key+0x136/0x1030 [ 258.602931][ T7971] ? futex_setup_timer+0xc0/0xc0 [ 258.607944][ T7971] futex_wake+0x127/0x4f0 [ 258.612348][ T7971] ? futex_wake_mark+0x150/0x150 [ 258.617365][ T7971] ? rcu_read_lock_sched_held+0x8a/0x110 [ 258.623059][ T7971] ? __bpf_trace_rcu_stall_warning+0x160/0x160 [ 258.629372][ T7971] ? fd_install+0x60/0x4e0 [ 258.633860][ T7971] do_futex+0x35d/0x3e0 [ 258.638082][ T7971] ? __ia32_sys_get_robust_list+0x110/0x110 [ 258.644085][ T7971] __se_sys_futex+0x3a9/0x440 [ 258.648835][ T7971] ? __x64_sys_futex+0xf0/0xf0 [ 258.653666][ T7971] ? __x64_sys_futex+0x21/0xf0 [ 258.658588][ T7971] do_syscall_64+0x55/0xb0 [ 258.663156][ T7971] ? clear_bhb_loop+0x40/0x90 [ 258.667900][ T7971] ? clear_bhb_loop+0x40/0x90 [ 258.672652][ T7971] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 258.678613][ T7971] RIP: 0033:0x7f9388d9e159 [ 258.683095][ T7971] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 258.703010][ T7971] RSP: 002b:00007f9389c170e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 258.711506][ T7971] RAX: ffffffffffffffda RBX: 00007f9389025fa8 RCX: 00007f9388d9e159 [ 258.719554][ T7971] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f9389025fac [ 258.727604][ T7971] RBP: 00007f9389025fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 258.735732][ T7971] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 258.743760][ T7971] R13: 00007f9389026038 R14: 00007ffe7a263420 R15: 00007ffe7a263508 [ 258.751821][ T7971] [ 259.124207][ T7965] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 259.220768][ T7965] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 259.283323][ T7965] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 259.474119][ T7983] loop7: detected capacity change from 0 to 512 [ 259.494603][ T7983] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 259.563444][ T5789] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 259.643972][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 259.686076][ T7988] FAULT_INJECTION: forcing a failure. [ 259.686076][ T7988] name failslab, interval 1, probability 0, space 0, times 0 [ 259.774240][ T7988] CPU: 0 PID: 7988 Comm: syz.6.536 Not tainted syzkaller #0 [ 259.781646][ T7988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 259.791770][ T7988] Call Trace: [ 259.795098][ T7988] [ 259.798085][ T7988] dump_stack_lvl+0x18c/0x250 [ 259.802827][ T7988] ? show_regs_print_info+0x20/0x20 [ 259.808086][ T7988] ? load_image+0x420/0x420 [ 259.812655][ T7988] ? __might_sleep+0xe0/0xe0 [ 259.817316][ T7988] ? __lock_acquire+0x7d80/0x7d80 [ 259.822434][ T7988] should_fail_ex+0x394/0x4c0 [ 259.827210][ T7988] should_failslab+0x9/0x20 [ 259.831785][ T7988] slab_pre_alloc_hook+0x59/0x300 [ 259.836882][ T7988] ? __se_sys_memfd_create+0x25a/0x660 [ 259.842403][ T7988] ? __se_sys_memfd_create+0x25a/0x660 [ 259.847932][ T7988] __kmem_cache_alloc_node+0x53/0x250 [ 259.853397][ T7988] ? __se_sys_memfd_create+0x25a/0x660 [ 259.858935][ T7988] __kmalloc+0xa7/0x240 [ 259.863170][ T7988] __se_sys_memfd_create+0x25a/0x660 [ 259.868530][ T7988] do_syscall_64+0x55/0xb0 [ 259.873098][ T7988] ? clear_bhb_loop+0x40/0x90 [ 259.877840][ T7988] ? clear_bhb_loop+0x40/0x90 [ 259.882584][ T7988] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 259.888534][ T7988] RIP: 0033:0x7f9388d9e159 [ 259.893035][ T7988] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 259.912791][ T7988] RSP: 002b:00007f9389c16e08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 259.921272][ T7988] RAX: ffffffffffffffda RBX: 0000000000000bf3 RCX: 00007f9388d9e159 [ 259.929328][ T7988] RDX: 00007f9389c16ee0 RSI: 0000000000000000 RDI: 00007f9388e3521b [ 259.937803][ T7988] RBP: 0000200000001580 R08: 00000000ffffffff R09: 0000000000000000 [ 259.945842][ T7988] R10: 0000000000000001 R11: 0000000000000202 R12: 00002000000014c0 [ 259.954050][ T7988] R13: 00007f9389c16ee0 R14: 00007f9389c16ea0 R15: 0000200000000500 [ 259.962191][ T7988] [ 260.870763][ T8011] FAULT_INJECTION: forcing a failure. [ 260.870763][ T8011] name failslab, interval 1, probability 0, space 0, times 0 [ 260.883687][ T8011] CPU: 0 PID: 8011 Comm: syz.7.541 Not tainted syzkaller #0 [ 260.891034][ T8011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 260.901145][ T8011] Call Trace: [ 260.904486][ T8011] [ 260.907475][ T8011] dump_stack_lvl+0x18c/0x250 [ 260.912218][ T8011] ? show_regs_print_info+0x20/0x20 [ 260.917504][ T8011] ? load_image+0x420/0x420 [ 260.922078][ T8011] should_fail_ex+0x394/0x4c0 [ 260.926837][ T8011] should_failslab+0x9/0x20 [ 260.931429][ T8011] slab_pre_alloc_hook+0x59/0x300 [ 260.936915][ T8011] ? flow_action_cookie_create+0x26/0x90 [ 260.942621][ T8011] ? flow_action_cookie_create+0x26/0x90 [ 260.948326][ T8011] __kmem_cache_alloc_node+0x53/0x250 [ 260.953778][ T8011] ? flow_action_cookie_create+0x26/0x90 [ 260.959471][ T8011] __kmalloc+0xa7/0x240 [ 260.963721][ T8011] ? tc_setup_action+0x1ae/0xac0 [ 260.968812][ T8011] flow_action_cookie_create+0x26/0x90 [ 260.974351][ T8011] tc_setup_action+0x32c/0xac0 [ 260.979184][ T8011] ? __local_bh_enable_ip+0x13a/0x1c0 [ 260.984600][ T8011] ? tc_cleanup_offload_action+0x140/0x140 [ 260.990481][ T8011] tcf_action_offload_add_ex+0x4dd/0x820 [ 260.996202][ T8011] ? net_generic+0x240/0x240 [ 261.000904][ T8011] ? tcf_action_fill_size+0x1c/0x2d0 [ 261.006249][ T8011] ? tcf_action_fill_size+0x1c/0x2d0 [ 261.011586][ T8011] tcf_action_init+0x2de/0x970 [ 261.016397][ T8011] ? tcf_action_init_1+0x6d0/0x6d0 [ 261.021565][ T8011] ? __nla_validate+0x50/0x50 [ 261.026314][ T8011] tc_ctl_action+0x43f/0xbc0 [ 261.030955][ T8011] ? tca_get_fill+0x550/0x550 [ 261.035674][ T8011] ? trace_raw_output_contention_end+0xd0/0xd0 [ 261.041910][ T8011] ? tca_get_fill+0x550/0x550 [ 261.046628][ T8011] rtnetlink_rcv_msg+0x843/0xf90 [ 261.051611][ T8011] ? rtnetlink_rcv_msg+0x220/0xf90 [ 261.056828][ T8011] ? rtnetlink_bind+0x80/0x80 [ 261.061573][ T8011] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 261.067591][ T8011] ? lock_chain_count+0x20/0x20 [ 261.072481][ T8011] ? __local_bh_enable_ip+0x13a/0x1c0 [ 261.077890][ T8011] ? lockdep_hardirqs_on+0x98/0x150 [ 261.083132][ T8011] ? __local_bh_enable_ip+0x13a/0x1c0 [ 261.088891][ T8011] ? _local_bh_enable+0xa0/0xa0 [ 261.093874][ T8011] ? __dev_queue_xmit+0x272/0x37e0 [ 261.099024][ T8011] ? __dev_queue_xmit+0x1329/0x37e0 [ 261.104265][ T8011] ? __dev_queue_xmit+0x272/0x37e0 [ 261.109518][ T8011] ? ref_tracker_free+0x686/0x830 [ 261.114582][ T8011] netlink_rcv_skb+0x235/0x4c0 [ 261.119380][ T8011] ? rtnetlink_bind+0x80/0x80 [ 261.124099][ T8011] ? netlink_ack+0x1160/0x1160 [ 261.128905][ T8011] ? __lock_acquire+0x7d80/0x7d80 [ 261.134057][ T8011] ? netlink_deliver_tap+0x2e/0x1b0 [ 261.139324][ T8011] netlink_unicast+0x7b1/0x930 [ 261.144242][ T8011] netlink_sendmsg+0x8d0/0xbf0 [ 261.149068][ T8011] ? netlink_getsockopt+0x590/0x590 [ 261.154387][ T8011] ? apparmor_socket_sendmsg+0x8e/0x330 [ 261.159972][ T8011] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 261.165299][ T8011] ? security_socket_sendmsg+0x80/0xa0 [ 261.170789][ T8011] ? netlink_getsockopt+0x590/0x590 [ 261.176059][ T8011] ____sys_sendmsg+0x61b/0x980 [ 261.180866][ T8011] ? __asan_memset+0x22/0x40 [ 261.185513][ T8011] ? __sys_sendmsg_sock+0x30/0x30 [ 261.190600][ T8011] ? __import_iovec+0x5f2/0x850 [ 261.195505][ T8011] ? import_iovec+0x73/0xa0 [ 261.200052][ T8011] ___sys_sendmsg+0x2a6/0x360 [ 261.204768][ T8011] ? __sys_sendmsg+0x2b0/0x2b0 [ 261.209610][ T8011] __se_sys_sendmsg+0x1d0/0x2c0 [ 261.214510][ T8011] ? __x64_sys_sendmsg+0x80/0x80 [ 261.219507][ T8011] ? lockdep_hardirqs_on+0x98/0x150 [ 261.224754][ T8011] do_syscall_64+0x55/0xb0 [ 261.229207][ T8011] ? clear_bhb_loop+0x40/0x90 [ 261.233946][ T8011] ? clear_bhb_loop+0x40/0x90 [ 261.238667][ T8011] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 261.244865][ T8011] RIP: 0033:0x7f6f89d9e159 [ 261.249443][ T8011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 261.269098][ T8011] RSP: 002b:00007f6f8acf0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 261.277558][ T8011] RAX: ffffffffffffffda RBX: 00007f6f8a025fa0 RCX: 00007f6f89d9e159 [ 261.285572][ T8011] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000005 [ 261.293610][ T8011] RBP: 00007f6f89e3503b R08: 0000000000000000 R09: 0000000000000000 [ 261.301795][ T8011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 261.309803][ T8011] R13: 00007f6f8a026038 R14: 00007f6f8a025fa0 R15: 00007ffe1264c948 [ 261.317832][ T8011] [ 261.395220][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 261.401623][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.713836][ T8028] FAULT_INJECTION: forcing a failure. [ 261.713836][ T8028] name fail_futex, interval 1, probability 0, space 0, times 0 [ 261.738846][ T8029] loop4: detected capacity change from 0 to 1024 [ 261.772300][ T8028] CPU: 1 PID: 8028 Comm: syz.7.544 Not tainted syzkaller #0 [ 261.779699][ T8028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 261.789822][ T8028] Call Trace: [ 261.793158][ T8028] [ 261.796153][ T8028] dump_stack_lvl+0x18c/0x250 [ 261.800911][ T8028] ? show_regs_print_info+0x20/0x20 [ 261.806177][ T8028] ? load_image+0x420/0x420 [ 261.810792][ T8028] ? rcu_is_watching+0x15/0xb0 [ 261.815632][ T8028] ? trace_pelt_se_tp+0x39/0x100 [ 261.820664][ T8028] should_fail_ex+0x394/0x4c0 [ 261.825456][ T8028] get_futex_key+0x136/0x1030 [ 261.829604][ T8029] EXT4-fs: Ignoring removed bh option [ 261.830190][ T8028] ? futex_setup_timer+0xc0/0xc0 [ 261.840607][ T8028] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 261.846701][ T8028] ? __lock_acquire+0x7d80/0x7d80 [ 261.851795][ T8028] ? lock_chain_count+0x20/0x20 [ 261.856712][ T8028] futex_wait_setup+0xbc/0x270 [ 261.861550][ T8028] ? futex_wait_multiple+0x920/0x920 [ 261.866894][ T8028] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 261.872848][ T8028] ? _raw_spin_unlock+0x40/0x40 [ 261.877798][ T8028] futex_wait+0x1bc/0x5c0 [ 261.882199][ T8028] ? futex_wait_setup+0x270/0x270 [ 261.887317][ T8028] ? fd_install+0x60/0x4e0 [ 261.891830][ T8028] do_futex+0x2ff/0x3e0 [ 261.896053][ T8028] ? __ia32_sys_get_robust_list+0x110/0x110 [ 261.902023][ T8028] __se_sys_futex+0x3a9/0x440 [ 261.906771][ T8028] ? __x64_sys_futex+0xf0/0xf0 [ 261.911611][ T8028] ? __x64_sys_futex+0x21/0xf0 [ 261.916419][ T8028] do_syscall_64+0x55/0xb0 [ 261.920871][ T8028] ? clear_bhb_loop+0x40/0x90 [ 261.925583][ T8028] ? clear_bhb_loop+0x40/0x90 [ 261.930294][ T8028] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 261.936227][ T8028] RIP: 0033:0x7f6f89d9e159 [ 261.940677][ T8028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 261.960337][ T8028] RSP: 002b:00007f6f8acf00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 261.968814][ T8028] RAX: ffffffffffffffda RBX: 00007f6f8a025fa8 RCX: 00007f6f89d9e159 [ 261.976833][ T8028] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6f8a025fa8 [ 261.984845][ T8028] RBP: 00007f6f8a025fa0 R08: 0000000000000000 R09: 0000000000000000 [ 261.992890][ T8028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 262.001087][ T8028] R13: 00007f6f8a026038 R14: 00007ffe1264c860 R15: 00007ffe1264c948 [ 262.009117][ T8028] [ 262.012335][ C1] vkms_vblank_simulate: vblank timer overrun [ 262.043838][ T8029] EXT4-fs (loop4): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 262.192158][ T8029] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 262.261632][ T8029] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 262.271461][ T8029] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 262.312904][ T8043] loop7: detected capacity change from 0 to 512 [ 262.330579][ T8043] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 262.416882][ T8039] netlink: 'syz.0.547': attribute type 10 has an invalid length. [ 262.613616][ T6503] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 263.663987][ T8076] loop7: detected capacity change from 0 to 512 [ 263.682570][ T8076] EXT4-fs (loop7): unable to read superblock [ 265.110239][ T8089] loop6: detected capacity change from 0 to 1024 [ 265.129080][ T8089] EXT4-fs: Ignoring removed bh option [ 265.150994][ T8089] EXT4-fs (loop6): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 265.258041][ T8093] netlink: 'syz.4.561': attribute type 10 has an invalid length. [ 265.360597][ T8089] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 265.441760][ T8098] loop4: detected capacity change from 0 to 512 [ 265.476931][ T8098] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 265.498119][ T8089] overlayfs: missing 'lowerdir' [ 265.728473][ T6948] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 265.999708][ T8054] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 267.587955][ T8135] overlayfs: failed to resolve './file0': -2 [ 267.700482][ T8140] loop6: detected capacity change from 0 to 512 [ 267.719591][ T8140] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 268.519898][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 268.893878][ T5820] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 268.936213][ T5820] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 270.108498][ T8183] overlayfs: failed to resolve './file0': -2 [ 271.389899][ T8214] netlink: 'syz.6.591': attribute type 10 has an invalid length. [ 271.423506][ T8214] syz_tun: entered promiscuous mode [ 271.444055][ T8214] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 272.606842][ T8231] loop6: detected capacity change from 0 to 1024 [ 272.628055][ T8231] EXT4-fs: Ignoring removed bh option [ 272.649044][ T8231] EXT4-fs (loop6): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 272.736506][ T8231] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 272.810035][ T8231] overlayfs: missing 'workdir' [ 272.909333][ T6948] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 273.026362][ T8242] loop6: detected capacity change from 0 to 512 [ 273.056954][ T8242] EXT4-fs (loop6): Test dummy encryption mode enabled [ 273.066603][ T8242] EXT4-fs error (device loop6): ext4_orphan_get:1408: inode #15: comm syz.6.598: inode has both inline data and extents flags [ 273.081003][ T8242] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.598: couldn't read orphan inode 15 (err -117) [ 273.095248][ T8242] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 273.152289][ T8190] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 273.482692][ T8249] loop4: detected capacity change from 0 to 512 [ 273.500591][ T8249] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 273.874977][ T5787] Bluetooth: hci1: command 0x0406 tx timeout [ 274.679357][ T8269] loop4: detected capacity change from 0 to 256 [ 274.745116][ T8269] FAT-fs (loop4): Directory bread(block 1285) failed [ 274.822352][ T8269] FAT-fs (loop4): Directory bread(block 1286) failed [ 274.983229][ T8275] overlayfs: failed to resolve './file1': -2 [ 275.795610][ T8269] FAT-fs (loop4): Directory bread(block 1287) failed [ 275.804053][ T8269] FAT-fs (loop4): Directory bread(block 1288) failed [ 276.002880][ T8277] loop7: detected capacity change from 0 to 1024 [ 276.019227][ T8269] FAT-fs (loop4): Directory bread(block 1285) failed [ 276.026143][ T8269] FAT-fs (loop4): Directory bread(block 1286) failed [ 276.032968][ T8269] FAT-fs (loop4): Directory bread(block 1287) failed [ 276.040518][ T8269] FAT-fs (loop4): Directory bread(block 1288) failed [ 276.321670][ T8277] EXT4-fs: Ignoring removed bh option [ 276.340414][ T8277] EXT4-fs (loop7): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 277.127493][ T8277] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 277.329952][ T8277] overlayfs: missing 'workdir' [ 277.480767][ T6948] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 277.660857][ T7121] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 277.874509][ T5787] Bluetooth: hci1: command 0x0406 tx timeout [ 278.111206][ T8308] loop6: detected capacity change from 0 to 512 [ 278.180989][ T8308] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 279.477377][ T8327] loop4: detected capacity change from 0 to 256 [ 279.494980][ T8327] FAT-fs (loop4): Directory bread(block 1285) failed [ 279.501781][ T8327] FAT-fs (loop4): Directory bread(block 1286) failed [ 279.547878][ T8327] FAT-fs (loop4): Directory bread(block 1287) failed [ 279.583064][ T8327] FAT-fs (loop4): Directory bread(block 1288) failed [ 279.635478][ T8327] FAT-fs (loop4): Directory bread(block 1285) failed [ 279.642328][ T8327] FAT-fs (loop4): Directory bread(block 1286) failed [ 279.649171][ T8327] FAT-fs (loop4): Directory bread(block 1287) failed [ 279.655996][ T8327] FAT-fs (loop4): Directory bread(block 1288) failed [ 280.627791][ T8341] syzkaller0: entered promiscuous mode [ 280.633356][ T8341] syzkaller0: entered allmulticast mode [ 281.093631][ T8358] overlayfs: failed to resolve './file1': -2 [ 281.109825][ T8356] loop6: detected capacity change from 0 to 512 [ 281.181915][ T8356] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 282.097854][ T5787] Bluetooth: hci1: command 0x0406 tx timeout [ 283.173188][ T8375] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 283.491836][ T8384] loop6: detected capacity change from 0 to 256 [ 283.523081][ T8384] FAT-fs (loop6): Directory bread(block 1285) failed [ 283.530288][ T8384] FAT-fs (loop6): Directory bread(block 1286) failed [ 283.546206][ T8384] FAT-fs (loop6): Directory bread(block 1287) failed [ 283.556338][ T8384] FAT-fs (loop6): Directory bread(block 1288) failed [ 284.237425][ T8384] FAT-fs (loop6): Directory bread(block 1285) failed [ 284.244231][ T8384] FAT-fs (loop6): Directory bread(block 1286) failed [ 284.253674][ T8384] FAT-fs (loop6): Directory bread(block 1287) failed [ 284.260649][ T8384] FAT-fs (loop6): Directory bread(block 1288) failed [ 284.535134][ T8392] FAULT_INJECTION: forcing a failure. [ 284.535134][ T8392] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 284.637367][ T8387] ------------[ cut here ]------------ [ 284.643334][ T8387] WARNING: CPU: 0 PID: 8387 at drivers/gpu/drm/vkms/vkms_crtc.c:103 vkms_get_vblank_timestamp+0x188/0x1d0 [ 284.654852][ T8387] Modules linked in: [ 284.658815][ T8387] CPU: 0 PID: 8387 Comm: syz.4.630 Not tainted syzkaller #0 [ 284.666463][ T8387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 284.676633][ T8387] RIP: 0010:vkms_get_vblank_timestamp+0x188/0x1d0 [ 284.683122][ T8387] Code: 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 ed 49 96 fc 4c 89 33 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 b8 c7 3d fc <0f> 0b eb ea 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c ba fe ff ff 4c [ 284.703838][ T8387] RSP: 0018:ffffc900055cf6e8 EFLAGS: 00010293 [ 284.710417][ T8387] RAX: ffffffff8549bab8 RBX: ffffc900055cf860 RCX: ffff888027143c00 [ 284.718625][ T8387] RDX: 0000000000000000 RSI: 00000042413b89ab RDI: 00000042413b89ab [ 284.726810][ T8387] RBP: 1ffff92000ab9f0c R08: ffffc90004172000 R09: 0000000000000000 [ 284.735102][ T8387] R10: ffffc90004172000 R11: 0000000000000000 R12: 00000042413b89ab [ 284.743155][ T8387] R13: dffffc0000000000 R14: ffff888021724000 R15: 00000042413b89ab [ 284.751218][ T8387] FS: 0000555580626500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 284.760555][ T8387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 284.767307][ T8387] CR2: 000056262188d008 CR3: 000000002511f000 CR4: 00000000003506f0 [ 284.775418][ T8387] Call Trace: [ 284.778740][ T8387] [ 284.781721][ T8387] ? vkms_disable_vblank+0x20/0x20 [ 284.786949][ T8387] drm_crtc_next_vblank_start+0x23e/0x490 [ 284.792742][ T8387] ? drm_vblank_count_and_time+0x4e0/0x4e0 [ 284.799380][ T8387] ? drm_gem_fb_vmap+0x22c/0x8e0 [ 284.804586][ T8387] drm_atomic_helper_wait_for_fences+0x21b/0x8f0 [ 284.810981][ T8387] ? drm_atomic_helper_commit_modeset_enables+0xb00/0xb00 [ 284.818214][ T8387] ? drm_atomic_helper_prepare_planes+0x64f/0xac0 [ 284.824760][ T8387] drm_atomic_helper_commit+0x5bf/0xaf0 [ 284.830370][ T8387] ? drm_atomic_helper_async_commit+0x5c0/0x5c0 [ 284.836763][ T8387] drm_atomic_commit+0x226/0x280 [ 284.841763][ T8387] ? drm_atomic_check_only+0x3000/0x3000 [ 284.847534][ T8387] ? handle_bad_prq_event+0x2b0/0x2b0 [ 284.853412][ T8387] ? drm_client_rotation+0x446/0x570 [ 284.858812][ T8387] drm_client_modeset_commit_atomic+0x651/0x7b0 [ 284.865346][ T8387] ? drm_client_modeset_check+0x180/0x180 [ 284.871146][ T8387] ? mutex_lock_nested+0x20/0x20 [ 284.876249][ T8387] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 284.881938][ T8387] ? lockdep_hardirqs_on+0x98/0x150 [ 284.887302][ T8387] drm_client_modeset_commit_locked+0xcb/0x4c0 [ 284.893522][ T8387] drm_client_modeset_commit+0x4a/0x70 [ 284.899843][ T8387] drm_fb_helper_lastclose+0x9f/0x150 [ 284.905463][ T8387] drm_fbdev_generic_client_restore+0x34/0x40 [ 284.911593][ T8387] drm_client_dev_restore+0x138/0x270 [ 284.917104][ T8387] drm_release+0x4b3/0x670 [ 284.921590][ T8387] ? drm_lastclose+0x100/0x100 [ 284.926442][ T8387] __fput+0x221/0x940 [ 284.930501][ T8387] task_work_run+0x1d4/0x260 [ 284.935275][ T8387] ? task_work_cancel+0x220/0x220 [ 284.940381][ T8387] ? exit_to_user_mode_loop+0x3b/0x110 [ 284.946118][ T8387] exit_to_user_mode_loop+0xe6/0x110 [ 284.951481][ T8387] exit_to_user_mode_prepare+0xee/0x180 [ 284.957158][ T8387] syscall_exit_to_user_mode+0x1a/0x50 [ 284.962679][ T8387] do_syscall_64+0x61/0xb0 [ 284.967206][ T8387] ? clear_bhb_loop+0x40/0x90 [ 284.971942][ T8387] ? clear_bhb_loop+0x40/0x90 [ 284.976708][ T8387] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 284.982658][ T8387] RIP: 0033:0x7f9829d9e159 [ 284.987221][ T8387] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 285.007948][ T8387] RSP: 002b:00007fff32d50d68 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 285.016692][ T8387] RAX: 0000000000000000 RBX: 00007fff32d50e50 RCX: 00007f9829d9e159 [ 285.024760][ T8387] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 285.032780][ T8387] RBP: 00000000000456b8 R08: 0000000000000001 R09: 0000000000000000 [ 285.040896][ T8387] R10: 0000001b30c20000 R11: 0000000000000246 R12: 00007fff32d50e90 [ 285.048981][ T8387] R13: 00007f982a025fac R14: 000000000004575f R15: 00007f982a025fa0 [ 285.057076][ T8387] [ 285.060193][ T8387] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 285.067637][ T8387] CPU: 0 PID: 8387 Comm: syz.4.630 Not tainted syzkaller #0 [ 285.074964][ T8387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 285.085088][ T8387] Call Trace: [ 285.088405][ T8387] [ 285.091374][ T8387] dump_stack_lvl+0x18c/0x250 [ 285.096192][ T8387] ? show_regs_print_info+0x20/0x20 [ 285.101434][ T8387] ? load_image+0x420/0x420 [ 285.105997][ T8387] panic+0x2ca/0x720 [ 285.109950][ T8387] ? bpf_jit_dump+0xd0/0xd0 [ 285.114526][ T8387] __warn+0x2e0/0x470 [ 285.118572][ T8387] ? vkms_get_vblank_timestamp+0x188/0x1d0 [ 285.124433][ T8387] ? vkms_get_vblank_timestamp+0x188/0x1d0 [ 285.130287][ T8387] report_bug+0x2be/0x4f0 [ 285.134663][ T8387] ? vkms_get_vblank_timestamp+0x188/0x1d0 [ 285.140514][ T8387] ? vkms_get_vblank_timestamp+0x188/0x1d0 [ 285.146367][ T8387] ? vkms_get_vblank_timestamp+0x18a/0x1d0 [ 285.152234][ T8387] handle_bug+0xcf/0x120 [ 285.156545][ T8387] exc_invalid_op+0x1a/0x50 [ 285.161101][ T8387] asm_exc_invalid_op+0x1a/0x20 [ 285.165996][ T8387] RIP: 0010:vkms_get_vblank_timestamp+0x188/0x1d0 [ 285.172458][ T8387] Code: 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 ed 49 96 fc 4c 89 33 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 b8 c7 3d fc <0f> 0b eb ea 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c ba fe ff ff 4c [ 285.192307][ T8387] RSP: 0018:ffffc900055cf6e8 EFLAGS: 00010293 [ 285.198423][ T8387] RAX: ffffffff8549bab8 RBX: ffffc900055cf860 RCX: ffff888027143c00 [ 285.206437][ T8387] RDX: 0000000000000000 RSI: 00000042413b89ab RDI: 00000042413b89ab [ 285.214552][ T8387] RBP: 1ffff92000ab9f0c R08: ffffc90004172000 R09: 0000000000000000 [ 285.222596][ T8387] R10: ffffc90004172000 R11: 0000000000000000 R12: 00000042413b89ab [ 285.230618][ T8387] R13: dffffc0000000000 R14: ffff888021724000 R15: 00000042413b89ab [ 285.238735][ T8387] ? vkms_get_vblank_timestamp+0x188/0x1d0 [ 285.244608][ T8387] ? vkms_get_vblank_timestamp+0x188/0x1d0 [ 285.250474][ T8387] ? vkms_disable_vblank+0x20/0x20 [ 285.255682][ T8387] drm_crtc_next_vblank_start+0x23e/0x490 [ 285.261460][ T8387] ? drm_vblank_count_and_time+0x4e0/0x4e0 [ 285.267318][ T8387] ? drm_gem_fb_vmap+0x22c/0x8e0 [ 285.272296][ T8387] drm_atomic_helper_wait_for_fences+0x21b/0x8f0 [ 285.278677][ T8387] ? drm_atomic_helper_commit_modeset_enables+0xb00/0xb00 [ 285.285834][ T8387] ? drm_atomic_helper_prepare_planes+0x64f/0xac0 [ 285.292305][ T8387] drm_atomic_helper_commit+0x5bf/0xaf0 [ 285.297911][ T8387] ? drm_atomic_helper_async_commit+0x5c0/0x5c0 [ 285.304222][ T8387] drm_atomic_commit+0x226/0x280 [ 285.309232][ T8387] ? drm_atomic_check_only+0x3000/0x3000 [ 285.314913][ T8387] ? handle_bad_prq_event+0x2b0/0x2b0 [ 285.320331][ T8387] ? drm_client_rotation+0x446/0x570 [ 285.325674][ T8387] drm_client_modeset_commit_atomic+0x651/0x7b0 [ 285.332077][ T8387] ? drm_client_modeset_check+0x180/0x180 [ 285.337869][ T8387] ? mutex_lock_nested+0x20/0x20 [ 285.342860][ T8387] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 285.348542][ T8387] ? lockdep_hardirqs_on+0x98/0x150 [ 285.353801][ T8387] drm_client_modeset_commit_locked+0xcb/0x4c0 [ 285.360013][ T8387] drm_client_modeset_commit+0x4a/0x70 [ 285.365522][ T8387] drm_fb_helper_lastclose+0x9f/0x150 [ 285.370955][ T8387] drm_fbdev_generic_client_restore+0x34/0x40 [ 285.377065][ T8387] drm_client_dev_restore+0x138/0x270 [ 285.382500][ T8387] drm_release+0x4b3/0x670 [ 285.386981][ T8387] ? drm_lastclose+0x100/0x100 [ 285.391821][ T8387] __fput+0x221/0x940 [ 285.395863][ T8387] task_work_run+0x1d4/0x260 [ 285.400510][ T8387] ? task_work_cancel+0x220/0x220 [ 285.405599][ T8387] ? exit_to_user_mode_loop+0x3b/0x110 [ 285.411115][ T8387] exit_to_user_mode_loop+0xe6/0x110 [ 285.416546][ T8387] exit_to_user_mode_prepare+0xee/0x180 [ 285.422242][ T8387] syscall_exit_to_user_mode+0x1a/0x50 [ 285.427752][ T8387] do_syscall_64+0x61/0xb0 [ 285.432297][ T8387] ? clear_bhb_loop+0x40/0x90 [ 285.437130][ T8387] ? clear_bhb_loop+0x40/0x90 [ 285.441960][ T8387] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 285.447997][ T8387] RIP: 0033:0x7f9829d9e159 [ 285.452464][ T8387] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 285.472651][ T8387] RSP: 002b:00007fff32d50d68 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 285.481124][ T8387] RAX: 0000000000000000 RBX: 00007fff32d50e50 RCX: 00007f9829d9e159 [ 285.489150][ T8387] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 285.497258][ T8387] RBP: 00000000000456b8 R08: 0000000000000001 R09: 0000000000000000 [ 285.505370][ T8387] R10: 0000001b30c20000 R11: 0000000000000246 R12: 00007fff32d50e90 [ 285.513393][ T8387] R13: 00007f982a025fac R14: 000000000004575f R15: 00007f982a025fa0 [ 285.521443][ T8387] [ 285.525158][ T8387] Kernel Offset: disabled [ 285.529588][ T8387] Rebooting in 86400 seconds..