last executing test programs: 13m0.434857128s ago: executing program 0 (id=196): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) read$FUSE(r0, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r1 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) r2 = shmat(r1, &(0x7f0000001000/0x3000)=nil, 0x1000) shmctl$IPC_RMID(r1, 0x0) shmdt(r2) 13m0.275472363s ago: executing program 0 (id=199): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000240)='=', 0x1}], 0x1, 0x0) recvmmsg(r3, &(0x7f0000001440)=[{{&(0x7f0000000280)=@un=@abs, 0x0, &(0x7f0000001400)=[{&(0x7f0000001480)=""/1}, {&(0x7f0000000300)=""/102}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/111}]}}], 0x700, 0x40002002, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xffc1) setsockopt$sock_int(r3, 0x1, 0x10, &(0x7f0000000040)=0x55b7, 0x4) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 12m59.85389537s ago: executing program 0 (id=201): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup=r1, 0x6, 0x0, 0x50d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r4, r2, 0x15, 0x0, @val=@netkit={@void, @value, @void, @void, r3}}, 0x1c) r5 = socket$inet(0x2, 0x1, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) getsockopt$IP_SET_OP_VERSION(r5, 0x1, 0x2f, 0x0, &(0x7f0000000100)) 12m58.625005224s ago: executing program 0 (id=206): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000b80)='./file0\x00', 0x1008002, &(0x7f0000000d00)={[{@grpjquota}]}, 0x3, 0x5ee, &(0x7f0000000280)="$eJzs3c1vVFUbAPDnTj9oKXk7kDcqLqSJMZAoLS1gGuMCtoY0+BE3urDSgkiBhtZo0YSS4MbEuDHGxJUL8b9QIltWunLhxpUhIWpYmjjmztxbOu1Mv2jnEu7vlwxz7zlze86lfeace+acOwGU1lD6TyVif0TMJhGDyeJSXndkmUON193/+5Mz6SOJWu31P5NIsrT89Un2PJAd3BcRP/+UxL6u1eXOLVy9MDkzM30l2x+Zvzg7Mrdw9fD5i5Pnps9NXxp7cWz8+LHj46NHtnRe11qknbrx/oeDn0289d03/ySj3/82kcSJeCV74fLz2C5DMVT/P0lWZw2Mb3dhBenK/k5qtVotT0u6i60TG5f//noi4skYjK548MsbjE9fLbRywI6qJY33bqCMEvEPJZX3A/Jr+5XXwZVCeiVAJ9w72RgAWB3/3Y2xweirjw3svp/E8mGdJCK2NjLXbE9E3Lk9cePs7YkbsUPjcEBri9cj4qlW8Z/U478afVGtx3+lKf7TfsHp7DlNf22L5a8cKhb/0DmN+O9bM/6jTfy/kz5fa8Twu1ssv/pg873+pvjv3+opAQAAAAAAQGndOhkRL7T6/L+yNP8nWsz/GYiIE9tQ/tCK/dWf/1fubkMxQAv3Tka83HL+byWf/VvtWraEtRo9ydnzM9NHIuJ/EXEoenal+6NrlHH4831ft8sbyub/5Y+0/DvZXMCsHne7dzUfMzU5P/kQpwxk7l2PeLrl/N9kqf1PWrT/6TvD7AbL2PfczdPt8taPf2Cn1L6NONiy/X9w14pk7ftzjNT7AyN5r2C1Zz7+4od25W81/t1iAh5e2v7vXjv+q8ny+/XMbb6MowvdtXZ5W+3/9yZv1O8q1JulfTQ5P39lNKI3OdWVpjalj22+zvA4yuMhj5c0/g89u/b4X6v+f39ELK742clfzWuKc0/8O/B7u/ro/0Nx0vif2lT7v/mNsZvVH9uVv7H2/1i9rT+UpRj/g4av8jDtbU5vEY7drbI6XV8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeBxUImJPJJXhpe1KZXg4YiAi/h+7KzOX5+afP3v5g0tTaV79+/8r+Tf9Djb2k/z7/6vL9sdW7B+NiL0R8WVXf31/+MzlmamiTx4AAAAAAAAAAAAAAAAAAAAeEQNt1v+n/ugqunbAjusuugJAYVrE/y9F1APoPO0/lJf4h/IS/1Be4h/KS/xDea0d/2+Pd6wiQMdp/6G8xD8AAAAAADxW9h649WsSEYsv9dcfqd4sr6fQmgE7rVJ0BYDCuMUPlJepP1BervGBZJ38vrYHrXfkWmbPPMTBAAAAAAAAAAAAAFA6B/db/w9lZf0/lJf1/1Be+fr/AwXXA+g81/hArLOSv+X6/3WPAgAAAAAAAAAAAAC209zC1QuTMzPTV2y8+WhUo5MbtVrtWvpX8KjUZ/s3kmyGekcKzafCd/5Mezdygvlav4395OLekwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgGb/BQAA//8wviV5") sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x80800) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x4199831, 0xffffffffffffffff, 0x10000000) mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f00000028c0)='./file1\x00', 0x2a08800, &(0x7f0000000040)=ANY=[], 0x1, 0x6af, &(0x7f0000003180)="$eJzs3ctrHPcdAPDvjFYrrQuOktiJWwIVMaSlorYeyK16idtD0SGU4B5CSy+LvY6F10qQlCKb0qrvaw/5A9KDDoWcCr0b0tJTm1uuOpVAoZecdFOZ2ZndlVa71trSru18PjA7v5nfc77z2J0RYgL40lqdi8rDSGJ17q3tbHlvd6m5t7s0VWQ3IyJLpxGV1iyS9Yjkk4jr0Zriq9nKonzSr58P11ZufPbF3uetpUox5eXTQfVOZqeYYjYiJop5r8nHau9m3/YGq7dTSXsLs4BdLgMH43bQY2eY6k943gJPg6T1vdljJuJcREwXvwOiuDqkox3d6RvqKgcAAADPqBf2Yz+24/y4xwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPkuL9/0kxpWV6NpLy/f+VYl2mGhE30jGPeXhJO/VwrOMAAAAAAAAAgNPx9f3Yj+04Xy4ftP40Xsk/L+SfX4kPYjMasRFXYjvqsRVbsRELETHT1VB1u761tbEQrz+y5uKxNRdHsbUAAAAAAAAA8Nz6Tax2/v4PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABPgyRiojXLpwtleibSSkRMR0Q1K7cT8WmZfkYkZaLWtfLheMYCAAAAj236uJWf/mNgnRf2Yz+243y5fJDk9/yv5PfL0/FBrMdWrMVWNKMRt4p76OyuP93bXWru7S7d29tdyjv+2UFLq53v/2+ooectRuvZw/E9X8pL1OJ2rOVrrsTNfDC3Is1rZi4V42lPhzv5dTam2puFE47sVjHPOvtT91OE05YOW2EmrzTZjsh8MbasoRcHR+KRe6cysKeFSNtPfi4M6KncpGTImJ8r60XEH47E/M3//OUnJ2zmDLQjkUYeicWuo++VdhSmjq/8jb99/M6d5vrdO7c3587sMBqVo8fEUlckXh189D3lkagMWX6+faS3NmU1fhg/jrmYjbdjI9bi55EdD40oroxRL8plnzNdUYroidT1Q0tvP2ok1WK/tK6iaVxs5/SOqR5b0YjZmMpT9Xg9r3s+1iKJ9+JWNOJaXGufesuxHCtde/hi3z2cV8ivtOlwZ/3lb3ZCGH888ph2oH+etODwWl+pWVxf7Ipr9zV3Js/rXtOJ0ksn+D4a8tpY+VqRyPr4bT7/6VPyEP5oJBa6IvHy4Ej8OT83Npvrdzfu1N/v0/7OkeU3Jjvp35/lN/PQsh3yUkwXV5LDR0eW93L7KnM4XtXiLy6tvLQn72KelyTlmfqjrjP1WizGQnynOFOrxW+43pYW87xXe/MmypFf6so79Hsr3vvXeOIJwJDOfetctfbf2r9rH9V+V7tTe2v6B1PfnXqtGpN/n/xeZX7ijfS15K/xUfyyc/8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vs37D+7Wm83GxvGJtH/W6SaS4kU+/cpUohan1VfxwsJfdWVNxllv4P0H1d5N3jn1vmJE++vJEuWbq560nXeuj2DMExGjjGrMHHcWTJ1SxHoT2eaVayaik1V0eOzLRYHnwdWte+9f3bz/4Ntr9+rvNt5trE8uL6/MryxfW7p6e63ZmG99jnuUwFno/B7oV+Lj0Q4IAAAAAAAAAAAAeKRR/FdDV3ezY9xUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Bm1OheVyUhiYf7KfLa8t7vUzKYy3SlZiYg0jUh+EZF8EnE9WlPMdDWX9Ovnw7WVG599sfd5p61KWT4dVK9UHZi7U0wxGxETxXxgGwcHJ27vZr/2Tixpb2EWsMtl4GDc/h8AAP//ZlAA0Q==") write$binfmt_register(r0, &(0x7f00000001c0)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x1, 0x3a, 'usrjquota=', 0x3a, '\x00\x03!\f\xee\x998r~\b\x13\x89\xae\xf1\x06hz\xcc\xd6\xbb\xb8\x19\x90\x9e\xdb\xa2F\xfa_F(\x05\b\x13\x82\x12\xad\x0f^\xdc\xf2\xb5', 0x3a, './file2', 0x3a, [0x46]}, 0x5c) r1 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0) 12m57.917958836s ago: executing program 0 (id=212): epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0xa0000004}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) execve(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(0xffffffffffffffff, 0xc01064ac, 0x0) poll(&(0x7f0000000140)=[{r2, 0x8}, {r1, 0x2cfc08c20dafc34e}, {0xffffffffffffffff, 0xa8}], 0x3, 0x8000007) 12m57.427791114s ago: executing program 0 (id=217): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioperm(0x0, 0xab4b, 0x2100000000b) 12m56.924075965s ago: executing program 32 (id=217): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioperm(0x0, 0xab4b, 0x2100000000b) 10m18.188150333s ago: executing program 1 (id=884): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0x7}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r2, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x1}}}, 0x10) bind$tipc(r1, &(0x7f00000001c0)=@name={0x1e, 0x2, 0x2, {{0x42, 0x4}}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) bind$tipc(r3, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x3}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r4, &(0x7f0000000380)={&(0x7f0000000240)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10, 0x0}, 0x44) 10m17.937719996s ago: executing program 1 (id=887): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r3, 0xee01, 0x0) 10m16.811208561s ago: executing program 1 (id=891): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xe51de000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) 10m15.617117797s ago: executing program 1 (id=907): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f0000000000)={0xa0000001}) epoll_pwait2(r5, &(0x7f0000000540)=[{}], 0x1, 0x0, 0x0, 0x0) ppoll(&(0x7f0000000200)=[{r5, 0x1}], 0x1, 0x0, 0x0, 0x3) close_range(r1, r3, 0x0) 10m12.077497428s ago: executing program 1 (id=904): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/query\x00', 0x2, 0x0) read$msr(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008072, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mlock(&(0x7f00009a1000/0x10000)=nil, 0x10000) syz_clone3(&(0x7f0000000740)={0x8180080, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, 0x0}, 0x58) mkdirat(0xffffffffffffff9c, 0x0, 0x181) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) 10m9.675670772s ago: executing program 1 (id=924): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x60}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$tipc(0x1e, 0x2, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0xfffffffe, 0x80, 0xfffffffe, 0x2f8}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x4, 0x1000002, 0x91, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 9m54.377545122s ago: executing program 33 (id=924): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x60}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$tipc(0x1e, 0x2, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0xfffffffe, 0x80, 0xfffffffe, 0x2f8}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x4, 0x1000002, 0x91, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 7m30.127938315s ago: executing program 5 (id=1403): setitimer(0x0, 0x0, 0x0) clock_gettime(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x169100, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x2) io_setup(0x239f, &(0x7f0000000380)=0x0) io_submit(r3, 0x1, &(0x7f0000000b40)=[&(0x7f0000000080)={0x200000000000000, 0x0, 0x0, 0x7, 0x8, r2, 0x0}]) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) 7m26.88632836s ago: executing program 5 (id=1416): socket$packet(0x11, 0x2, 0x300) pipe(&(0x7f0000000140)) creat(&(0x7f0000000080)='./file0\x00', 0x20) socket$inet_udp(0x2, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) userfaultfd(0x80001) socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000380)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000003c0)=0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x20040, 0x1ff) syz_ublk_setup_queues(r1, r0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x2f6}, &(0x7f0000000d40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe700, 0x8000, 0xffffff, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8720, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x5, 0xfffefff7}}], 0x1, 0x0, 0x0) 7m25.701371744s ago: executing program 5 (id=1421): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000050000000000000001000004080000000000000003000000100000000000000000000002000000000300000000000004040000000000002e"], 0x0, 0x4d}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r3, 0x3, 0x1}, 0x48) 7m24.105588728s ago: executing program 5 (id=1425): syz_mount_image$vfat(&(0x7f0000000140), &(0x7f00000002c0)='./file0\x00', 0x2048c5, &(0x7f0000000300)={[{@rodir}, {@shortname_winnt}, {@shortname_mixed}, {@numtail}, {@uni_xlate}, {@fat=@quiet}, {@shortname_mixed}, {@utf8}, {@fat=@flush}, {@fat=@dos1xfloppy}, {@shortname_lower}, {@shortname_win95}, {@shortname_winnt}, {@uni_xlateno}, {@uni_xlate}, {@uni_xlate}]}, 0x0, 0x2c7, &(0x7f0000002b80)="$eJzs3EFrE1sUwPHTTJumLW2yKA/eg4cH3ehmaOMnCNKCGFBqI+pCmNqJhoxJmImRiNjuxJ2fo7h0paB+gW7cuRc3RRDcdCGONJmJMR2btFqnbf4/KHM7Z87MHe69cKbQu3X92b1y0TOLVl0SKZWEyLpsi2R2WoGR4JhotZPSbV3OTX15///VGzcv5fL5hSXVxdzy+ayqzpx6/eDR89Nv61PXXsy8GpfNzK2tz9kPm/9s/rv1bTm8e1XE0pVqtW6tOLaulryyqXrFsS3P1lLFs926WuqG8aJTrdWaalVWpydrru15alWaWrabWq9q3W2qdccqVdQ0TZ2elGFj7DujsLG0ZOUOpTOIw0TUSdfNWUZksLDxNzoFAACOlrjq/7slT0ueVqo79f0e9X9CuuN96n+Roa7/D6r261BkPYnjZCRcvl0rOkT9DwAAAAAAAAAAAAAAAAAAAADAcbDt+2nf99PhMfwZF5GUiIS/x91PHI4Bxt9g/E+urn/cS4k4TxqFRqF9bMc7m0PMjYl8bc2HQLu9eDG/MKctGXnjrAX5a42CITtzKFeUUudhmej8+Xa+duevyZhMhvmO2JKVtMxG52cj8huFpJw9448HT7bFlLS8uy1VcWS1Na9/5D+eV71wOd+TP9G6DgAAAACAk8DUjl3f7624qeG2IT3x9snO9/mcpPv8faDn+3pU/huN770BAAAAABgmXlLKluPYrtd82K/xNMgZ6OIj2Ag3s/0jNxSJ+3VSg148KiLBmZfx9dnYd1ZCRHpDY7vORDeM3xvlTyI/r4vZ2Ic7qiFJkb4X+0Znrn68314Be9159y7BAAAAAE6GsPofibsjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMsYF3GgscZKOyrscZ8bwlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcDR8DwAA//9KIAfL") r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000500)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1333404, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0/file0\x00', 0x0, 0x13481, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) rseq(0x0, 0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$watch_queue(r1, 0x0, 0x0) stat(0x0, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) read$FUSE(r0, &(0x7f0000000840)={0x2020}, 0x2020) 7m23.778761243s ago: executing program 5 (id=1427): r0 = gettid() r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, '\x00', "5193bb672965593497c186a80e00", '\x00\x00=*', "1202000000040030"}, 0x38) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e23, 0x5, @mcast1, 0x6}}, 0x0, 0x0, 0x1d, 0x0, "824770ed9d3fc1114fa98b3115b51a7042ccec5e95bd9f46a985c3cf9ffa5fb6b26498702bcbe954eea58a3582073718f1ad6bd6721d341b42f3e5aae27255f15e424dc0e9b55d3af11e97f6ef2f1b4c"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e24, 0x8, @loopback}}, 0x0, 0x0, 0x41, 0x0, "b208405cce4456e4fc8f2dabd194ff3763f799f91cf7e5e8260998f956ec57c24451db07550335ebf4a3d0168ccaa268e928f39cd7494c2b19ebef230a3373685fbacfcf3b6e9633bd997a9bfcf08f67"}, 0xd8) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback, 0xffff}, 0x1c) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r2, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 7m20.739701634s ago: executing program 5 (id=1436): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x400, 0x1410c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0xffffffff, [{0x0, 0x1}]}, @func_proto, @restrict={0x0, 0x0, 0x0, 0x6, 0x2}]}}, 0x0, 0x4a}, 0x28) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./trace/current_tracer\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='blk', 0x3) ioctl$HDIO_GETGEO(r1, 0x301, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000140)={r4, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000002c0)={r4, 0x11, 0x6, @random="08d32bfb45c9"}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r4, {0xb, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4) 7m19.381535987s ago: executing program 34 (id=1436): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x400, 0x1410c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0xffffffff, [{0x0, 0x1}]}, @func_proto, @restrict={0x0, 0x0, 0x0, 0x6, 0x2}]}}, 0x0, 0x4a}, 0x28) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./trace/current_tracer\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='blk', 0x3) ioctl$HDIO_GETGEO(r1, 0x301, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000140)={r4, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000002c0)={r4, 0x11, 0x6, @random="08d32bfb45c9"}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r4, {0xb, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4) 6m41.895651556s ago: executing program 7 (id=1533): epoll_create1(0x0) epoll_create1(0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) listen(r0, 0x5a) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x24040014, &(0x7f0000000000)={0xa, 0x4e22, 0x40, @empty}, 0x1c) accept4$inet6(r0, 0x0, 0x0, 0x800) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x7, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 6m40.614931656s ago: executing program 7 (id=1537): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000000)={0x11, @loopback, 0x0, 0x0, 'lblcr\x00', 0x32, 0x0, 0xfffffffc}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) 6m34.020604077s ago: executing program 7 (id=1552): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0xc, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000000000407d1e9c3100000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000200)={0x6, &(0x7f00000001c0)=[{0x7fff, 0x1, 0x7, 0x2}, {0x3, 0x2, 0x40, 0x4}, {0x6, 0xd, 0xf, 0xde68}, {0x2, 0x4, 0x3, 0xfffff800}, {0x8, 0x0, 0x6, 0xff}, {0x8, 0x2, 0x1, 0x4}]}, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000400)={0x2c, r2, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4001}, 0x4004890) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x444}}, &(0x7f0000000100)={0x0, 0x22, 0x7, {[@main=@item_4={0x3, 0x0, 0xb, "e94641e5"}, @global=@item_012={0x1, 0x1, 0x9, "e1"}]}}, 0x0}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r3) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r4, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000030000000000000002000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff05000300030000001c000080060001000200000008000200ac141427050003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x80) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000240)={'pim6reg1\x00', @broadcast}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x9, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000711822000000000095"], &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @cgroup_sock=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 6m31.539749602s ago: executing program 7 (id=1565): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='mountinfo\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x20000019}) syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f00000009c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1404c, &(0x7f00000007c0)={[{@noload}, {@resgid}, {@inlinecrypt}, {@usrquota}, {@discard}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x3}}, {@min_batch_time={'min_batch_time', 0x3d, 0x7}}, {@test_dummy_encryption_v1}, {@noblock_validity}]}, 0x5, 0x491, &(0x7f0000000300)="$eJzs3M1vG0UbAPBnN7HbvO3bhFK+Wj4CBVEhSPoF9MABEEgcioQEBzhaSahK3YKaINEqEimHckIIiTviyL/ACS4IcQGJK9yrShXqhZaT0dq7iZ1s7Ka1Y8C/n+T2md21Zx7PjjO7EyeAkTWd/ZNE7I6I3yJislXsPGC69d+N68tzN68vzyXRaLz5R9I87s/ry3PFocXzdrUXIokDJfUuXrh4plavL5zPy7NLZz+YXbxw8ZnTZ6v5phPHjx15/rmjz/Ylz12R5tFr73zx+snPOvJfl0efTHfb+USj0efqhuv/bfH4ENvB1ozl/VVpjv/JGGvrvcl49ZPVwsdDaiAwMI1Go7Fr890rDeA/LInOsiEPo6L4QV9c/5ZdB784sNnH8F17qXUBlOV9I3+09oyv3jGorLu+7afpiHh75a+vskcM5j4EAECH77L5z9PZbGd5Lpt7rM0/0ri37bg9+drQVETcFRF7I+LuOBf7IuKeiOax90XE/Vuou9q5SNKcZm6c/6RX7yjBHrL53wv52lbn/K+Y/cXUWLN0oVWISvLu6frC4fw9ORSVHVn5SJc6vn/l188329c+/8seWf3FXDBvx9XxHZ3Pma8t1W4/407XLkXsHy/LP1ldCUgi4oGI2F/2AmnvOk4/9c2Dm+2bnumVfxd9WGhqfB3xZKv/V2Jd/oWkc32ydmrh1MK5oyeK9cnZnVFfODxbnBUb/fTL5TfKtqe31P+DlfX//0rP/9X8p5L29drFrddx+fdPN72mma7kwRbO/5XaUq2avNWMi8Xij2pLS+ePRFSTk61Gt28/uvbcolwcn+V/6GD5+N8ba+/EgYjITuKHIuLhiHgk77tHI+KxiDjYJf8fX378vfXbJor8u/d/tcvL9kWW//yW+n8tqEbnlrTkmCwYO/PDtx2VTq2Fef43u3/+HW9Gh/Itt/L5t7EV5cGdvn8AAADwb5BGxO5I0pnVOE1nZlq/w7+vtfSd+fDcfOs7AlNRSYs7XZNt90OL3xFolS9FRKOtXF84FmnzvvGXYxPN8szc+/X5oWUNRP5dnbLxn7kyNuzWAQPnC1swuox/GF1dx39l+9oBbL8N47/rmN8x0LYA26vk5//EMNoBbL+y+b+/9wOjYd34t+wHI8T9fxhdxj+MLuMfRtLiRPT+knzXoHil23x6r2Ay4k5beGZn2a6fS/+mQf+CqAzqlf8ZQaQDr6I62FNrYEGStXlP9D74ytCbunkwvM8kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAfvo7AAD//1yDywo=") r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) mkdir(&(0x7f0000001c00)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x290d010, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0xa65400, 0x0) 6m30.581232267s ago: executing program 7 (id=1569): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r3, &(0x7f0000007700), 0x318, 0xfc0, 0x0) 6m24.160232698s ago: executing program 7 (id=1581): openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x1e1080, 0x0) r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000001540)=ANY=[@ANYBLOB="12010000020000402505a1a4400000000101090264000101000000090400001202060000052406000005240000000d240f0100000000400000000009058103ff0303ea03090582022000000000090503020002000000e5e23805307025648743788a41674c010cc989ddbd12b2f07faefbc46e5deb0b9c16000c745ad30ddfe97c10be09ed329248d910ecb0e60ce100b62c68011d66c79916b51a0a07f9cc88f59fe66c0f80a357e7921a420dfe6f28545d7fd947a8ebb995752fb0392287449c0d3d97d8375fa8f1281f9c78a1f732a2e97b6889b534bb58b407e6f5a4c1f4dc166e833d4ab0112a2fc26a69ee450d92d3631569a9df"], 0x0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r2, &(0x7f0000000200)="00112233445566778899aabb0800", 0xe, 0x0, &(0x7f0000000540)={0x11, 0x0, 0x2}, 0x14) r3 = fcntl$dupfd(r1, 0x406, r1) getsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x5, 0xe2, &(0x7f0000001640)="7a4a258ad8dabc3e67736c7ab15ed0bbae9fb562db94349f0db0759c1becb8deb48325d9871f08a5125ca29d1b4d69b1126de17ed47362308a01f01e60a7da64f4562bdb9eee879026f6940aaff18211ae906761222da184c85fda8791e5065f63e2876c0ac79a075c7440f5b7c193cf02235890cb7666e1f813468877ea4e69bebc4a8005f63f774878281f2298b18b781090c2e3f2e65921e6f647fccad24bf1c67964f4b1a8993465a1bcb083bc650a32b88b65f4358e3e09d4bab4c45bea341393cc8c5d637ee68b2542de7dd36663e0c1710dc34d429c5ba02f871fec686f41") syz_usb_connect$midi(0x3, 0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="12015002000000408205270040000102030109022c0001018b70040904000002010320050905240e08007ff740042501000905870240"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c00000004000000010000840700000023000000030040000500000005000000000000010500000020000000070000000000000802000000006100302e6161982e"], 0x0, 0x58}, 0x28) 6m24.103960187s ago: executing program 3 (id=1582): mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = dup2(r0, r0) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x3f, 0x4a, 0x400404, 0x40000000, 0xfffffffffffeff01}) 6m23.528509386s ago: executing program 35 (id=1581): openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x1e1080, 0x0) r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000001540)=ANY=[@ANYBLOB="12010000020000402505a1a4400000000101090264000101000000090400001202060000052406000005240000000d240f0100000000400000000009058103ff0303ea03090582022000000000090503020002000000e5e23805307025648743788a41674c010cc989ddbd12b2f07faefbc46e5deb0b9c16000c745ad30ddfe97c10be09ed329248d910ecb0e60ce100b62c68011d66c79916b51a0a07f9cc88f59fe66c0f80a357e7921a420dfe6f28545d7fd947a8ebb995752fb0392287449c0d3d97d8375fa8f1281f9c78a1f732a2e97b6889b534bb58b407e6f5a4c1f4dc166e833d4ab0112a2fc26a69ee450d92d3631569a9df"], 0x0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r2, &(0x7f0000000200)="00112233445566778899aabb0800", 0xe, 0x0, &(0x7f0000000540)={0x11, 0x0, 0x2}, 0x14) r3 = fcntl$dupfd(r1, 0x406, r1) getsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x5, 0xe2, &(0x7f0000001640)="7a4a258ad8dabc3e67736c7ab15ed0bbae9fb562db94349f0db0759c1becb8deb48325d9871f08a5125ca29d1b4d69b1126de17ed47362308a01f01e60a7da64f4562bdb9eee879026f6940aaff18211ae906761222da184c85fda8791e5065f63e2876c0ac79a075c7440f5b7c193cf02235890cb7666e1f813468877ea4e69bebc4a8005f63f774878281f2298b18b781090c2e3f2e65921e6f647fccad24bf1c67964f4b1a8993465a1bcb083bc650a32b88b65f4358e3e09d4bab4c45bea341393cc8c5d637ee68b2542de7dd36663e0c1710dc34d429c5ba02f871fec686f41") syz_usb_connect$midi(0x3, 0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="12015002000000408205270040000102030109022c0001018b70040904000002010320050905240e08007ff740042501000905870240"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c00000004000000010000840700000023000000030040000500000005000000000000010500000020000000070000000000000802000000006100302e6161982e"], 0x0, 0x58}, 0x28) 6m22.586001958s ago: executing program 3 (id=1585): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000200)={0x1, &(0x7f00000008c0)=[{0x6, 0x0, 0xfd, 0x4}]}) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0x8) connect$inet(r2, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) r3 = accept$inet(r1, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xf, 0x4, 0x4, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0x6, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r4}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x3c}, @generic={0x95}], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@map=r4, r5, 0x7, 0x0, 0x0, @void, @value=0x0}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r4, &(0x7f0000000640), &(0x7f0000000680)=@tcp=r3}, 0x20) sendto(r3, &(0x7f0000000700)='ab', 0xfffffcf4, 0x11, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 6m21.418470418s ago: executing program 3 (id=1587): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) writev(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 6m20.303725099s ago: executing program 3 (id=1591): r0 = socket(0x10, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff000000008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB="400401000000000008000a00", @ANYRES32=r4], 0x50}}, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r7, @ANYBLOB="0100"], 0x3c}}, 0x0) 6m15.767981267s ago: executing program 3 (id=1606): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x404, &(0x7f0000000480)={[{@nogrpid}, {@barrier}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x68}}, {@errors_remount}, {@nombcache}, {@quota}, {@nojournal_checksum}]}, 0x3, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") syz_open_dev$loop(0x0, 0x80000001, 0x614000) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) clock_nanosleep(0x7, 0x0, &(0x7f0000000280)={r0, r1+10000000}, &(0x7f00000002c0)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r2, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 6m14.378753585s ago: executing program 3 (id=1600): unshare(0x60040000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=@newlink={0x6c, 0x10, 0x437, 0x3, 0x3, {0x0, 0x0, 0x0, r2, 0x51b0b}, [@IFLA_LINKINFO={0x4c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x3c, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_LOCAL={0x14, 0x6, @remote}, @IFLA_GRE_REMOTE={0x14, 0x7, @remote}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x7fffffff}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x29, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1021, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_MTU={0x8, 0x4, 0x8001}]}, 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) writev(r0, &(0x7f00000016c0)=[{&(0x7f0000000640)='U', 0x1}], 0x1) r4 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r4, &(0x7f0000000040)={&(0x7f0000000140)={0xa, 0xa, 0x4, @mcast2}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000001080)="671723d7c6012c", 0x7}, {&(0x7f0000000200)="9efef5abfd2a00000000000600"/33, 0x21}], 0x2}, 0x20028b88) 5m58.758557434s ago: executing program 36 (id=1600): unshare(0x60040000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=@newlink={0x6c, 0x10, 0x437, 0x3, 0x3, {0x0, 0x0, 0x0, r2, 0x51b0b}, [@IFLA_LINKINFO={0x4c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x3c, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_LOCAL={0x14, 0x6, @remote}, @IFLA_GRE_REMOTE={0x14, 0x7, @remote}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x7fffffff}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x29, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1021, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_MTU={0x8, 0x4, 0x8001}]}, 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) writev(r0, &(0x7f00000016c0)=[{&(0x7f0000000640)='U', 0x1}], 0x1) r4 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r4, &(0x7f0000000040)={&(0x7f0000000140)={0xa, 0xa, 0x4, @mcast2}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000001080)="671723d7c6012c", 0x7}, {&(0x7f0000000200)="9efef5abfd2a00000000000600"/33, 0x21}], 0x2}, 0x20028b88) 1m3.972774779s ago: executing program 9 (id=2310): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)=0xfffffffb) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) ioctl$sock_ifreq(r0, 0x8914, &(0x7f00000001a0)={'wlan1\x00', @ifru_flags}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0x0) ioctl$sock_ifreq(r0, 0x8914, &(0x7f00000001c0)={'wlan1\x00', @ifru_flags=0x1}) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000), 0x501, 0x0) ioctl$CAPI_REGISTER(r4, 0x400c4301, &(0x7f0000000080)={0x0, 0x0, 0x800}) writev(r4, &(0x7f0000000500)=[{&(0x7f0000000380)="a989d7b184832e98", 0x89a9}], 0x1) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000480), 0x890, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYBLOB="e5f4054b97f0583b3384aea40c751ee822cd2376947ef3", @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=r3, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x60a41, 0xb3836f6d7a15f29) ioctl$CAPI_REGISTER(r4, 0x400c4301, &(0x7f0000000040)={0x4, 0xead, 0xfffffff1}) close_range(r3, 0xffffffffffffffff, 0x0) 1m0.793536054s ago: executing program 9 (id=2316): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) openat$vcsa(0xffffffffffffff9c, 0x0, 0x400000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x6, 0x7, 0x3f8, 0x1, 0x32}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./proc\x00', 0x8f) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) 59.35668404s ago: executing program 9 (id=2318): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x38, 0x0, 0x8, 0x9, 0x80000001, 0x3, 0x4, 0xffff, 0x0, 0x300000}, 0x0) sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf947b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_rdma(&(0x7f0000000180), &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x1008840, &(0x7f0000000840)=ANY=[@ANYBLOB="7472616e733d72646d612c706f95743d307830303030342c00"/36]) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 57.756007445s ago: executing program 9 (id=2322): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macsec0\x00'}) ioctl$EVIOCGMTSLOTS(0xffffffffffffffff, 0x8040450a, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) openat(0xffffffffffffffff, &(0x7f0000000240)='./sys\x00', 0x0, 0x42) write(0xffffffffffffffff, &(0x7f0000000300)='pcspkr', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) openat(0xffffffffffffff9c, 0x0, 0x101202, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ed) symlinkat(&(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') 57.251272132s ago: executing program 9 (id=2324): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) io_setup(0x5, &(0x7f0000000240)) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) read$dsp(r4, 0x0, 0x0) r5 = inotify_init() inotify_add_watch(r5, 0x0, 0xa50003d1) 55.059848448s ago: executing program 9 (id=2328): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000a20000/0x2000)=nil) r3 = epoll_create1(0x0) r4 = fcntl$dupfd(r3, 0x2, 0xffffffffffffffff) close_range(r4, 0xffffffffffffffff, 0x2) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000)=0xffffffffffffffff, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x64) pidfd_send_signal(r5, 0x21, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 39.896267428s ago: executing program 37 (id=2328): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000a20000/0x2000)=nil) r3 = epoll_create1(0x0) r4 = fcntl$dupfd(r3, 0x2, 0xffffffffffffffff) close_range(r4, 0xffffffffffffffff, 0x2) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000)=0xffffffffffffffff, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x64) pidfd_send_signal(r5, 0x21, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 15.954052194s ago: executing program 6 (id=2389): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f0000000a00)={[{@noquota}, {@abort}, {@max_batch_time={'max_batch_time', 0x3d, 0x8}}, {@abort}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x7}}, {@max_batch_time={'max_batch_time', 0x3d, 0xffffffffffffff00}}, {@errors_remount}, {@commit={'commit', 0x3d, 0x7}}, {@orlov}], [{@subj_role={'subj_role', 0x3d, 'commit'}}]}, 0xfc, 0x587, &(0x7f0000000440)="$eJzs3d9rU2cfAPDvSdP689UKIu/7XgzBizmcqW33w8Fg7nJsMmG7d6GNRZoaaVKxnaBezJvdDBmMMWHsD9j9LmX/wP4KYRNkSNkuxiDjpCc1tknTdtFE8/nA0efJOSfP+eY539PnyUlIAEPrePpPLuJ/EfFVEnG4ZV0+spXH17ZbfXxjJl2SqNc/+T2JJHusuX2S/X8gq/w3In7+IuJUbnO71eWV+WK5XFrM6hO1hasT1eWV05cXinOludKVqenps29OT73z9ls9i/W1C39++/H9D85+eWL1mx8fHrmbxLk4mK1rjeNfuNVaOV78OyuNxrkNG072oLFBkvT7ANiVkSzPRyO9BhyOkSzrgZffzYioA0Mqkf8wpJrjgObcvkfz4BfGo/fXJkCN2Mda48+vvTcSextzo/2ryVMzo3S+O96D9tM2fvrt3t10ia3fh9jXpQ6wI7duR8SZfH7z9T/Jrn+7d6bx5vHWNrYxbH9/oJ/up+Of19uN/3Lr459oM/450CZ3d6N7/uce9qCZjtLx37ttx7/rl67xkaz2n8aYbzS5dLlcOhMRhyLiZNS73vo4u/qg3mld6/gvXdL2m2PB7Dge5vc8vc9ssVaMiLFdhvyUR7cj/p9vF3+y3v9Jm/5PX48L22zjWOneK53WdY//2ar/EPFq2/5/0q3J1vcnJxrnw0TzrNjsjzvHfunU/pbx7+15uJuk/b9/6/jHk9b7tdWdt/H93r9Kndbt9vwfSz5tlJtJcL1Yqy1ORowlH21+fOrJvs16c/s0/pMntr7+tTv/08nXZ9uM/87ROx037ff5n8Y/u6P+33nhwYeff5c9182dx5/2/xuN0snskez61152rmz3AHvxGgIAAAAAAMCgyEXEwUhyhfVyLlcorH2+42jsz5Ur1dqpS5WlK7PR+K7seIzmmne6D7d8HmIy+zxssz61oT4dEUci4uuRfY16YaZSnu138AAAAAAAAAAAAAAAAAAAADAgDnT4/n/q15F+Hx3wzDV+2GBPv48C6IeuP/nfi196AgZS1/wHXlryH4aX/IfhJf9heMl/GF7yH4aX/IfhJf8BAAAAAAAAAAAAAAAAAAAAAAAAAACgpy6cP58u9dXHN2bS+uy15aX5yrXTs6XqfGFhaaYwU1m8WpirVObKpcJMZaHb85UrlauTU7F0faJWqtYmqssrFxcqS1dqFy8vFOdKF0ujzyUqAAAAAAAAAAAAAAAAAAAAeLFUl1fmi+VyaVGhY+G9GIjDeJYBrtnV7vlBiWJ7hUMRMQCH8VwKe9b69HbWvTvbvY8XJQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADY4J8AAAD//3TNLqg=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4000000086}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() r1 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r1, &(0x7f0000000200)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e23, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000300)=[{0x18, 0x110, 0x1, 'd'}], 0x18}, 0x0) sendmsg(r1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000280)={0x40, 0x403, 0xc}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 14.253188436s ago: executing program 6 (id=2392): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x4, @remote, 0x3}, 0x1c) listen(r1, 0x3) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x2) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x724) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) 11.259572219s ago: executing program 6 (id=2395): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r5, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r3}, 0x20) sendmmsg$inet6(r3, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000ac0)="b0", 0x1}], 0x1}}], 0x1, 0x0) 9.466675016s ago: executing program 2 (id=2399): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r3, 0xa02000000000000, 0x60, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r4 = io_uring_setup(0xa0, &(0x7f0000000080)={0x0, 0xb9d8, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002700)=""/4096, 0x2500}], 0x0, 0xa}, 0x20) 8.843513903s ago: executing program 8 (id=2401): setns(0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000840)={r2, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x4) setsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000300)=@assoc_value={r4, 0x9cc}, 0x8) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=@v1={0x1000000, [{0xffff8000, 0x3}]}, 0xc, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fcntl$notify(r5, 0x11, 0x286237e8b9b45828) 8.227722159s ago: executing program 2 (id=2402): mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000380)={{{@in6=@dev, @in6=@dev}}, {{@in6=@private1}, 0x0, @in=@dev}}, &(0x7f0000000480)=0xe8) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1fa) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) rmdir(&(0x7f00000002c0)='./ffs\x00') r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) 8.134537365s ago: executing program 4 (id=2403): r0 = socket$inet6(0xa, 0x1, 0x0) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x840, &(0x7f0000000140), 0x1, 0x241, &(0x7f0000000840)="$eJzs3U9oFFccB/DfzO42TbKUtL0UCm2hlNIGQnor9JJeWgiUEEoptIUUES9KIsQEb4knLx70rJKTlyDejB4ll+BFETxFzSFeBA0eDB70sDI7iUSz/oGJO+J8PjC7M7vvze8Ns983exkmgMoaiIiRiKhFxGBENCIi2dngm3wZ2Npc6F2ZiGi1/nyYtNvl27ntfv0RMR8RP0fEcprEwXrE7NK/649Xf//+xEzju3NL//R29SC3bKyv/bF5duz4xdGfZq/fvD+WxEg0XziuvZd0+KyeRHz2Loq9J5J62SPgbYwfvXAry/3nEfFtO/+NSCM/eSenP1puxI9nXtX31IMbX3ZzrMDea7Ua2TVwvgVUThoRzUjSoYjI19N0aCj/D3+71pcempo+MnhgamZyf9kzFbBXmhFrv13uudT/Uv7v1fL8Ax+uLP9/jS/eydY3a2WPBuimLP+D/8/9EPIPlSP/UF3yD9Ul/1Bdr8t/WtKYgO5w/Yfqkn+oLvmH6pJ/qC75h+ramX8AoFpaPWXfgQyUpez5BwAAAAAAAAAAAAAAAAAA2G2hd2Vie+lWzaunIzZ+jYh6p/q1recQfNx+7XuUZM2eS/Juhfz3dcEdFHS+5LuvP7lbbv1rX5Vbf24yYv5YRAzX67t/f0nh52B8+obvG/sKFijol7/Lrf90sdz6o6sRV7L5Z7jT/JPGF+33zvNPMzt/BesfflJwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTNswAAAP//ceptKw==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x0, 0x1f8, 0x1f8, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@multicast2, @loopback, 0xffffffff, 0xffffffff, 0x7, 0x9, {@mac=@random="3b4c52fb5365", {[0xff, 0x0, 0xff, 0x0, 0xff]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}, {[0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x50, 0x1, 0xe, 0x9cd4, 0x0, 0xffff, 'veth0_to_team\x00', 'ip_vti0\x00', {}, {0xff}, 0x0, 0x202}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x308}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}, @empty, @local, @multicast2, 0x2}}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 0x0, 0x20, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}}, {}, 0x0, 0x0, 0x0, 0x0, 0xfff9, 0x0, 'veth0_to_batadv\x00', 'netpci0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x3f}, 0x8, 0xffffffff}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x380000, @loopback, 0x54}, 0x1c) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000002c0)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@loopback, 0x4e21, 0xa, 0x4e21, 0x0, 0xa, 0x20, 0x0, 0x0, 0x0, 0xee01}, {0x800, 0x5a, 0x2, 0xfffffffffffffe90, 0x7, 0x3, 0x980, 0x6}, {0x1, 0x3, 0x5, 0x1}, 0x9, 0x6e6bb4, 0x2, 0x0, 0x2, 0x2}, {{@in6=@private0, 0x4d4, 0x3c}, 0x2, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x3503, 0x0, 0x0, 0x8, 0x80, 0x5, 0x5}}, 0xe8) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 7.736989093s ago: executing program 8 (id=2404): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x24040810) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) ptrace$peekuser(0x3, r0, 0x1) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) r4 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r4, 0x9) r5 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r5, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) readv(r3, &(0x7f0000000b40)=[{&(0x7f0000000cc0)=""/154, 0xfdef}, {0x0}, {0x0}], 0x3) sendmsg$TCPDIAG_GETSOCK(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) 7.23355882s ago: executing program 2 (id=2405): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$alg(0x26, 0x5, 0x0) syz_open_dev$media(&(0x7f0000000380), 0x10, 0x101000) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x57a, 0x1000, 0x40002, 0x2a7}, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x80, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x8, 0xffffffffd24b2432, 0x5, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x7ffe}}, 0x50) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x0, 0x252}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x1, 0x2100, 0x1b4, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3d88, 0x40000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x2, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587f, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0xe0b, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=ANY=[], 0xf0}}, 0x0) 6.984152782s ago: executing program 4 (id=2406): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x9, &(0x7f0000000040)=0x80000000, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x40f00, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x2}, 0x4c) recvmmsg(r1, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4096, 0x1e67}, {&(0x7f00000000c0)=""/250, 0x4}], 0x2, 0x0, 0xd64}}], 0x300, 0x34000, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="a787000000ff000000000b00000404000180"], 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 5.068012461s ago: executing program 8 (id=2407): socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getrusage(0x0, &(0x7f0000000280)) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) syz_clone(0x0, 0x0, 0x29, 0x0, 0x0, 0x0) 4.948243582s ago: executing program 2 (id=2408): r0 = socket(0x10, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x4, 0x2000005, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r4, 0x0, 0xf3a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000001, 0x2010, 0xffffffffffffffff, 0xea50b000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'veth1_macvtap\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004c040}, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) write$cgroup_pid(r4, &(0x7f0000000000), 0xffffff98) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) close_range(r0, 0xffffffffffffffff, 0x0) 4.947358472s ago: executing program 4 (id=2409): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x84, @rand_addr=0x64010101, 0x4e1d, 0x3, 'rr\x00', 0x1, 0xa8a, 0x2c}, 0x2c) socket$kcm(0x29, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'gre0\x00', 0x5001}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000140)={{0x84, @private=0xa010100, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x1, 0xf2, 0x0, 0x7}]}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r3, &(0x7f0000000e40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000640)='=', 0x1}], 0x1}}], 0x1, 0x2090) 4.274555537s ago: executing program 8 (id=2410): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf9477000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semctl$SETVAL(0x0, 0x0, 0x10, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/console\x00', 0x1, 0x0) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0xffffffffffffffda, 0x0, {0x7, 0x2d, 0x7, 0x10c4404, 0x2, 0x6, 0x7, 0x6, 0x0, 0x0, 0x4}}, 0xff18) 3.368497613s ago: executing program 6 (id=2411): socket$nl_audit(0x10, 0x3, 0x9) openat(0xffffffffffffff9c, 0x0, 0x40, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) close_range(r0, r0, 0x2) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffd}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x3}}, 0x26) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x801, 0x0) ioctl$PPPIOCATTCHAN(r5, 0x40047438, &(0x7f0000000500)=0x2) ioctl$PPPIOCBRIDGECHAN(r5, 0x40047435, &(0x7f0000000200)=0x1) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) 2.882638046s ago: executing program 2 (id=2412): syz_mount_image$ext4(&(0x7f0000000780)='ext2\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f00000007c0)={[{@max_dir_size_kb}, {@journal_async_commit}]}, 0x1, 0x4ff, &(0x7f0000000280)="$eJzs3cFvG1kZAPDPTuw4aXaTXfYACHbLslBQVSdxd6PVHmA5IYRWQuwRpG5I3CiKHUexs2xCD9kzVyRW4gRH/gDOe+LOBcGNSzkgFYiQGiQORjOeJG5qt1aT2mn8+0mjeW/exN97Tee9+mviF8DYuh4RBxFRjIiPImIuu57Ljni/cyT3PTy8t3p0eG81F+32h//Kpe3Jtej6msS17DVLEfHj70f8LPd43Obe/uZKrVbdyeoLrfr2QnNv/9ZGfWW9ul7dqlSWl5YX3739TuXCxvpGvZiVvnr/Twff/kXSrdnsSvc4LlJn6IWTOInJiPjh8wg2AhPZeIqj7gjPJB8Rr0bEm+nzPxcT6XcTALjK2u25aM911wGAqy6f5sBy+XKWC5iNfL5c7uTwXouZfK3RbN2829jdWuvkyuajkL+7UasuZrnC+SjkkvpSWj6tV87Ub0fEKxHxq6nptF5ebdTWRvkPHwAYY9dO1/+Z7FK6/gMAV1xp1B0AAIbO+g8A48f6DwDjx/oPAOOns/5Pj7obAMAQef8PAOPH+g8AY+VHH3yQHO2j7POv1z7e291sfHxrrdrcLNd3V8urjZ3t8nqjsZ5+Zk/9aa9XazS2l96O3U/mv7PdbC009/bv1Bu7W6076ed636kW0rsOhjAyAKCfV974/K+5ZEV+bzo9omsvh8JIewY8b/lRdwAYmYlRdwAYGbt9wfg6x3t86QF40fXYm7eXUq9fEGq32350CF5cN74k/w/jqiv/bymHMSP/D+NL/h/GV7udG3TP/xj0RgDgcpPjB/r8GMCr2fn32X8O/HTt7B2fPc9eAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOV2vP9vOdsLfDby+XI54qWImI9C7u5GrboYES9HxF+mClNJfWnEfQYAziv/j1y2/9eNubdmH2l6/dpJsRgRP//Nh7/+ZKXV2vlzRDH376nj663PsuuV4fceAHi643U6PXe9kX94eG/1+Bhmfx58LyJKnfhHh8U4Ook/GZPpuRSFiJj5Ty6rd+S6chfncfBpRHyx1/hzMZvmQDo7n56Nn8R+aajx84/Ez6dtnXPyZ/GFC+gLjJvPk/nn/V7PXz6up+fez38pnaHOL5v/kpdaPUrnwNP4x/PfRJ/57/qgMd7+4w86pensi093e37wacSXJyOOYx91zT/H8XN94r81YPy/feX1N/u1tX8bcSN6x++OtdCqby809/ZvbdRX1qvr1a1KZXlpefHd2+9UFtIc9UL/1eCf7918uV9bMv6ZPvFLTxn/NwYc/+/+99FPvvaE+N8q9oqfj9eeED9ZE785YPyVmT+U+rUl8dceH//kIN//mwPGv//3/ce2DQcARqe5t7+5UqtVdxQULn8h+St7CbrRs/DdYcUqRu+mX36980yfaWq3nylWvxnjIrJuwGVw8tBHxH9H3RkAAAAAAAAAAAAAAKCnYfzG0qjHCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNX1/wAAAP//oBTNIA==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_SETINTERFACE(r3, 0x80085504, &(0x7f0000000180)) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) pipe(&(0x7f0000000040)) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000000000)={0xb127f50, 0x5, 0xfffffff8, 0x3, 0x6}, 0x14) socket$inet6(0xa, 0x1, 0x0) 2.881436106s ago: executing program 4 (id=2413): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./bus\x00', 0x21081e, &(0x7f00000000c0)={[{@nomblk_io_submit}, {@data_err_ignore}, {@discard}], [{@fsname={'fsname', 0x3d, '/'}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'data_err=ignore'}}, {@appraise_type}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@hash}]}, 0x1, 0x512, &(0x7f00000010c0)="$eJzs3U9sG1kZAPBvnOZvs5vusgdAsFt2Fwqq6iTublX1AOWEEKqE6BGkNiRuFMWOo9gpTeghPXNFohInOHLkwLkn7lwQ3LiUAxJ/oqIGicOgGdvFSezWapM4G/9+0mjezBvN972m8178HPsFMLSSiNiJiLGIuBsRMx3nsy1uNreLEfF89+Hi3u7DxSTS9PY/k7w+O9d5r8z51j0nIuIH34n4cXI4bn1re3WhUilvtI5nG9X12frW9pWV6sJyebm8Vipdm782d/3qp6Uja+sH1bFW6ctP/7DzjZ9maU23znS24yg1mz76Ik7mXER87ziCDcBIqz1jg06E11KIiHcj4sP8+Z+JkfynCQCcZWk6E+lM5zEAcNYV8jmwpFBszQVMR6FQLDbn8N6LqUKlVm9cvlfbXFtqzpVdiNHCvZVKea41V3guIrLj+bwur0+y49KB46sR8U5E/Hx8Mj8uLtYqS4P8xQcAhtj5A+P/v8eb4z8AcMZNDDoBAODEGf8BYPgY/wFg+Bj/AWD4NMf/yUGnAQCcIK//AWD4GP8BYKh8/9atbEv3Wt9/vXR/a3O1dv/KUrm+WqxuLhYXaxvrxeVabTn/zp7qq+5XqdXW5z+JzQcXvrleb8zWt7bvVGuba407+fd63ymP5lftnEDLAIBe3vngyZ/zNUBuTOZbdKzlMDrQzIDjVhh0AsDAjAw6AWBgrPYFw+sNXuObHoAzossSvftMdPuAUJqm6fGlBByzS1/oZ/4/6aOHAD5rOub//RUwDBnz/zC8zP/D8ErTpN81/6PfCwGA083v/0CPd/febe1/03pz4EdLB694fJxZAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOnWXv+32FoLfDoKhWIx4q2IuBCjyb2VSnkuIt6OiD+Nj45nx/MDzhkAeFOFvyWt9b8uzXw8va/q/fMvimMR8ZNf3v7Fg4VGY+OPEWPJv8bb5xuPW+dL3QMcdwsAgJdrj9P5vuOF/PPdh4vt7STz+fu3I2KiGX9vdyz2WvG3nrXXJp6I0YiYepZE51rFScfcxZvYeRQRn+/W/iSm8zmQ5sqnB+Nnsd860fiFffELeV1zn/1bfO4IcoFh8yTrf252e/4KcTHfd3/+s7NHsXZ6q//LbrW4l/eB/4/f7v9GevR/F/uN8cnvv9ssTR6uexTxxXMR7dh7Hf1PO37SI/7Hfcb/y5fe/7BXXfqriEvRPX5nrNlGdX22vrV9ZaW6sFxeLq+VSiNxbe761U9Ls/kc9Wzv0eAfNy6/3asua/9Uj/gTr2j/V/ts/6//e/eHX3lJ/K9/1C1+Id57SfxsTPxan/EXpn430asui7/Uo/2v+vlf7nXTZP+C4k//un1o2XAAYHDqW9urC5VKeUNBIS/8Nk5FGt0L2X/ZU5BG18K3juXO6cyhqrHofvHPPmo+0weq0vS1ovfqMY5i1g04DV489BHxn0EnAwAAAAAAAAAAAAAAdHUSn44adBsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4u/4XAAD//+sG0e8=") openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prlimit64(0x0, 0x8, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) r3 = fsopen(&(0x7f0000000280)='binder\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fchdir(r3) unshare(0x2a020400) 2.880346126s ago: executing program 8 (id=2414): move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x40000, 0x10) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0xd) r1 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) membarrier(0x10, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000300)={0x0}) r4 = socket$nl_audit(0x10, 0x3, 0x9) open(&(0x7f0000000000)='./file0\x00', 0x1e5240, 0x141) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000001c0)={r3, 0x3, r4, 0x3, 0x80000}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) syz_open_procfs(0xffffffffffffffff, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, 0x0, 0x0) 1.624659312s ago: executing program 6 (id=2415): socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0x9, 0x0, &(0x7f0000000000)="259a53f271a76d2673", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) socket$inet6(0xa, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000680)='fdinfo\x00') socket$inet_udp(0x2, 0x2, 0x0) r1 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$iso9660(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x804808, &(0x7f0000001600)=ANY=[@ANYRES32=r1, @ANYRES8=r1, @ANYBLOB="0c2ec34edb42fe4f2c1b832d9141290140e677e53cc188dc41581142590d4e0713f4ae95293dd9ce1c8836b03632dab46a43356a89c37f32b221bf1e737101a03cdb083ffc8585af679581ab62438f23ef4adeb4629413", @ANYRESHEX, @ANYRES32=r1, @ANYRES64, @ANYRESOCT=0x0, @ANYRESDEC, @ANYRES8=r1, @ANYBLOB="b209eb6ac758b26226e3afb394a796baf3c6ce63c6342fceeedece41257e82ae0c182b8db1d9bcee3c8cc711a99a1b9fe2152fc846cdf5b62cf323b61a14c81100aa81ab73f3ed2ef2c4ffd4000435582841d1ec94cab677ebe3c11acdffc890d218a41f668954cb9f57fa7f418649"], 0x2, 0x55e, &(0x7f0000001080)="$eJzs3V1v00oawPHHpV2irNRdLSuEqgJD2ZWKVIKTQFDEldeZpIbEjmwHtVeooimqSGFFWWnbG7Y37K50zofgXJ4Pcb4ROh+BI4+dvuYF6Oup/r+ojGOPPY/TaB6miccCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADEcmu2XbSk6fmdJTWcWwuD1t7TbO8jK+TegWJEuyJW8iO5nNxIV934697m68k/czKbPpuVXFLkZPuP1//85NrkRH//EQF/k5++80ibW9uvV3q97ruTCuQCunl1+LaG9r0o8FpOQysvClS1UrEfLNYjVfeaOlqOYt1SbqidOAjVvHtPFavVstKF5aDjN2pOU/dXPr5fsu2KelpoayeMAv/B00LkLnrNpuc3TJ1kc1LncfJGfObFKtZOS6m19V63PO4EkkrFr6lUGlepZJdKxWKpVKw8qj56bNuTR1bYh8iRGif3psXv0wn23sDxTGT5X5riiS8dWRI18OFKTUIJpDVke6af///+QI9sd3/+72f5G3ubZ8Tk/1vps1vD8v+QWM7usSlbsi2vZUV60pOuvDv3iM720RAtvngSSSCetMQxa1S2RklVKlIRW17IotSnkl9iXTxpipZIliWSWLR5R7kSihZHYgkkFCXz4so9UVKUqlSlLEq0FGRZAumILw2piWOOsibr5nUvi7KGxbhbqTj0NPL9911XSiPOlvyP4zvJ7hs4li/9/A8AAAAAAC4ty/z1fcr83DTP615T2+cdFgAAAAAAOEHmk//ZpDDfzropFuN/AAAAAAAuG8tcY2eJSF5up0trYpnLpfgjAAAAAAAAl4T5/P9WUpg5UG6LtTtdCuN/AAAAAAAuif+NnWM/al+1fvlVwnDK2mkv/c3aMHPzOhtX0v2uHD5iXJ+xprODmKKSFpOTrp61cmml3UkwP2fF2rg4rL0AnN0A/vMtAVyblB/kTlrnzmparmZb/pS2kq97TV1wg+aTojjO9ESsl+J/vVn/t5jT/7/fmrZyst7rFl6+7a2aWHaSo+xsZBMoHplHcUQs7818C+aai4FnPGUuxMjazVuytt7r2u2lq9mRnY2JdGHiYIsfpke0+VHm0lpz2Yy3+f6WtM1c0maxMOzssyiKxzzzj3I3rXN3/m5aDIiiNC6K0v4oBr8Wx4+iPC6K8jGjAIDzsjYmC1lyJO9+Ry93KLsn3d5XZHf5xuz+UebTOvMzpmOdnBnQo9vjenT7mNnt5yP3QBqWY5N2fzyUVT8lO3wa2m7ULFnJS3jl/cY/5frm1vb99Y2VV91X3TelUrliP7TtRyWZMqeRFeQeAMAA+++xYw3M/6PuwvPlS5K7H2aj6p3Do+os4/1l9ysFBXkpb6Unq7JgrjYw3zgY+P+O/L6vISyMGbXmTZpM7/CyMGJU9wdzlUP/uKWRdQ/GUD6LXwUAAGdmbkweHp3/07H7wphx98FcPnp0nN93tzYAAHA6dPjZysf/tcLQa78oVqtFJ17UKgzcZyr0ag2tPD/Wobvo+A2t2mEQB27QTBaeezUdqajTbgdhrOpBqNpB5C2Z6QNVduv3SLccP/bcqN3UTqSVG/ix48aq5kWuanf+0fSiRR2anaO2dr265zqxF/gqCjqhqwtKRVrvq+jVtB97dS9Z9FU79FpOmFPPg2anpVVNR27oteMgPWC/Lc+vB2HLHLZw3i82AAAXxObW9uuVXq/77hQXBjacO/NTBQAAmTFZGgAAAAAAAAAAAAAAAAAAAAAAXABncf0fC5d8oT8V9EWJh4UTWBjbdXw49c4JwKn6LQAA//8FIlBo") r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket(0x10, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/asound/seq/clients\x00', 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r3, 0x10000}}, 0xa) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 1.534490057s ago: executing program 4 (id=2416): socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x20000000}, @func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x2, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_io_uring_setup(0xd3a, &(0x7f0000000080)={0x0, 0x8000002, 0x3a10, 0x3, 0x3}, &(0x7f0000000280)=0x0, &(0x7f0000000580)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000380)=@IORING_OP_MSG_RING={0x28, 0x14, 0x0, r4, 0x0, 0x0, 0x8, 0x2, 0x1}) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f00000002c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x1, 0xad0, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x8}}}, &(0x7f0000000340)) 1.473212488s ago: executing program 2 (id=2417): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x40040854) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) sendmmsg$inet6(r0, &(0x7f0000000a80)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4d7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) 339.638772ms ago: executing program 4 (id=2418): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x24040810) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) ptrace$peekuser(0x3, r0, 0x1) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) r4 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r4, 0x9) r5 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r5, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) readv(r3, &(0x7f0000000b40)=[{&(0x7f0000000cc0)=""/154, 0xfdef}, {0x0}, {0x0}], 0x3) sendmsg$TCPDIAG_GETSOCK(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) 173.41349ms ago: executing program 8 (id=2419): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd87}, &(0x7f0000000240)=0x40) writev(r3, &(0x7f00000001c0)=[{0x0}], 0x1) close_range(0xffffffffffffffff, r3, 0x0) 0s ago: executing program 6 (id=2420): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000580), &(0x7f00000005c0)={'fscrypt:', @desc3}, &(0x7f0000000600)={0x0, "af90151a5dd598c6a6f07a701cc150dd4f2639568ea6baa1edc5b8c720c51d5c438f08f1377c60f83d32830646581c116f58f00751fea1d8862e29ad015b0985", 0x28}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x35, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x31}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x61, 0x65, 0x34, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61, 0x30, 0x33]}, &(0x7f00000007c0)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccdd2233445566778899aabbccddeeff00", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x32, 0x30, 0x62, 0x67, 0x30, 0x30, 0x0, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x64]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3c}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x38, 0x38, 0x30, 0x30, 0x6e, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x20040}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f00000006c0)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x61, 0x35, 0x32, 0x66, 0x33, 0x0, 0x62, 0x34, 0x37, 0x36, 0x39, 0x64, 0x36, 0x33, 0x64, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa00000000ff00112233445566778899aabbccddeeff", 0x2b}, 0x48, r0) add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='c', 0x1, r0) add_key(&(0x7f0000000680)='encrypted\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, r0) kernel console output (not intermixed with test programs): 46045][ T9761] loop3: detected capacity change from 0 to 512 [ 451.882864][ T9761] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 451.924718][ T9761] FAT-fs (loop3): Filesystem has been set read-only [ 451.986261][ T9765] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1372'. [ 452.928613][ T9772] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 454.168796][ T9780] netlink: 'syz.2.1375': attribute type 2 has an invalid length. [ 454.572476][ T9796] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 458.180873][ T9838] batman_adv: batadv0: Adding interface: veth0 [ 458.187121][ T9838] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 458.225899][ T9838] batman_adv: batadv0: Interface activated: veth0 [ 458.247838][ T9838] batman_adv: batadv0: Interface deactivated: veth0 [ 458.265359][ T9838] batman_adv: batadv0: Removing interface: veth0 [ 462.439237][ T9872] overlayfs: failed to clone upperpath [ 462.479851][ T9870] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1407'. [ 462.703084][ T9858] serio: Serial port ptm0 [ 463.065235][ T9895] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1412'. [ 463.101148][ T9895] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1412'. [ 463.121308][ T9895] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 463.130527][ T9895] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 463.139447][ T9895] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 463.148185][ T9895] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 463.457091][ T9904] device batadv_slave_1 entered promiscuous mode [ 463.488361][ T9904] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1417'. [ 463.505077][ T9904] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 464.351174][ T9904] device batadv_slave_1 left promiscuous mode [ 464.357409][ T9904] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 465.998652][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 466.126751][ T9927] loop5: detected capacity change from 0 to 128 [ 466.378787][ T5036] FAT-fs (loop5): error, corrupted directory (invalid entries) [ 466.419430][ T5036] FAT-fs (loop5): error, corrupted directory (invalid entries) [ 467.592870][ T9044] tipc: Left network mode [ 468.965307][ T9958] sctp: [Deprecated]: syz.2.1434 (pid 9958) Use of struct sctp_assoc_value in delayed_ack socket option. [ 468.965307][ T9958] Use struct sctp_sack_info instead [ 469.001332][ T9959] tipc: Failed to remove unknown binding: 66,0,0/0:3104328029/3104328031 [ 469.041418][ T9959] tipc: Failed to remove unknown binding: 66,0,0/0:3104328029/3104328030 [ 469.092907][ T9959] tipc: Failed to remove unknown binding: 66,0,0/0:3104328029/3104328031 [ 469.140408][ T9959] tipc: Failed to remove unknown binding: 66,0,0/0:3104328029/3104328030 [ 470.500307][ T9973] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 470.532375][ T9973] 8021q: adding VLAN 0 to HW filter on device bond0 [ 470.614600][ T9973] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 470.819954][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 470.952828][ T9985] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1440'. [ 471.357703][ T9985] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1440'. [ 471.866027][ T4289] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 471.876338][ T4289] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 471.896073][ T4289] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 471.904602][ T4289] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 471.913227][ T4289] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 471.920924][ T4289] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 472.586886][ T9044] device hsr_slave_0 left promiscuous mode [ 472.607095][ T9044] device hsr_slave_1 left promiscuous mode [ 472.675753][ T9044] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 472.692188][ T9044] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 472.735919][ T9044] device bridge_slave_1 left promiscuous mode [ 472.770299][ T9044] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.826038][ T9044] device bridge_slave_0 left promiscuous mode [ 472.851783][ T9044] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.992172][ T4276] Bluetooth: hci1: command 0x0409 tx timeout [ 474.008019][ T4276] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 474.018503][ T4276] CPU: 1 PID: 4276 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 474.026149][ T4276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 474.036440][ T4276] Workqueue: hci0 hci_rx_work [ 474.041225][ T4276] Call Trace: [ 474.044614][ T4276] [ 474.047657][ T4276] dump_stack_lvl+0x188/0x24e [ 474.052508][ T4276] ? show_regs_print_info+0x12/0x12 [ 474.057923][ T4276] ? load_image+0x410/0x410 [ 474.062509][ T4276] sysfs_create_dir_ns+0x26a/0x290 [ 474.067715][ T4276] ? __lock_acquire+0x7c40/0x7c40 [ 474.072900][ T4276] ? sysfs_warn_dup+0xa0/0xa0 [ 474.077677][ T4276] ? do_raw_spin_unlock+0x11d/0x230 [ 474.082962][ T4276] kobject_add_internal+0x617/0xca0 [ 474.088354][ T4276] kobject_add+0x160/0x230 [ 474.093011][ T4276] ? kobject_init+0x1c0/0x1c0 [ 474.097787][ T4276] ? __raw_spin_lock_init+0x41/0x100 [ 474.103158][ T4276] ? klist_children_get+0x50/0x50 [ 474.108261][ T4276] ? get_device_parent+0x121/0x3e0 [ 474.113453][ T4276] device_add+0x470/0x1050 [ 474.118018][ T4276] hci_conn_add_sysfs+0xd1/0x1e0 [ 474.123038][ T4276] le_conn_complete_evt+0xf93/0x15c0 [ 474.128486][ T4276] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 474.134798][ T4276] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 474.140488][ T4276] ? mutex_unlock+0x10/0x10 [ 474.145225][ T4276] ? skb_pull_data+0xec/0x1f0 [ 474.149981][ T4276] hci_le_conn_complete_evt+0x183/0x440 [ 474.155626][ T4276] ? hci_remote_host_features_evt+0x230/0x230 [ 474.162134][ T4276] hci_event_packet+0x7b3/0x1290 [ 474.167145][ T4276] ? lock_chain_count+0x20/0x20 [ 474.172073][ T4276] ? bis_list+0x280/0x280 [ 474.176465][ T4276] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 474.182473][ T4276] ? kcov_remote_start+0x50f/0x810 [ 474.187636][ T4276] ? lockdep_hardirqs_on+0x94/0x140 [ 474.192993][ T4276] ? hci_send_to_monitor+0x9c/0x4a0 [ 474.198285][ T4276] hci_rx_work+0x3eb/0xd40 [ 474.202864][ T4276] ? _raw_spin_unlock+0x40/0x40 [ 474.207896][ T4276] ? process_one_work+0x7b4/0x1160 [ 474.213077][ T4276] process_one_work+0x8ab/0x1160 [ 474.218095][ T4276] ? worker_detach_from_pool+0x240/0x240 [ 474.224012][ T4276] ? _raw_spin_lock_irq+0xb7/0xf0 [ 474.229113][ T4276] ? _raw_spin_lock_irqsave+0x100/0x100 [ 474.234780][ T4276] ? wq_worker_running+0x97/0x190 [ 474.239871][ T4276] worker_thread+0xaf5/0x12a0 [ 474.244999][ T4276] kthread+0x29d/0x330 [ 474.249167][ T4276] ? worker_clr_flags+0x1a0/0x1a0 [ 474.254352][ T4276] ? kthread_blkcg+0xd0/0xd0 [ 474.259007][ T4276] ret_from_fork+0x1f/0x30 [ 474.263522][ T4276] [ 474.267773][ T4276] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 474.281126][ T4276] Bluetooth: hci0: failed to register connection device [ 474.330609][T10030] loop3: detected capacity change from 0 to 128 [ 474.418972][T10030] EXT4-fs error (device loop3): __ext4_fill_super:5465: inode #2: comm syz.3.1450: iget: checksum invalid [ 474.463088][T10030] EXT4-fs (loop3): get root inode failed [ 474.468922][T10030] EXT4-fs (loop3): mount failed [ 474.549849][ T9931] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 474.660624][ T9044] bond2 (unregistering): (slave bond4): Releasing backup interface [ 474.693658][ T9044] bond4 (unregistering): Released all slaves [ 474.928086][T10041] loop3: detected capacity change from 0 to 512 [ 475.106496][ T9044] bond2 (unregistering): (slave bond3): Releasing backup interface [ 475.119425][T10044] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 475.130594][T10044] FAT-fs (loop3): Filesystem has been set read-only [ 475.138063][ T9044] bond3 (unregistering): Released all slaves [ 475.145024][T10044] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 475.166753][T10045] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1452'. [ 475.182744][ T9044] bond2 (unregistering): Released all slaves [ 475.385780][ T9044] bond1 (unregistering): Released all slaves [ 475.435529][ T4325] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 475.652903][ T4325] usb 4-1: Using ep0 maxpacket: 16 [ 475.684855][ T4325] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 475.693251][ T4325] usb 4-1: config 1 has no interface number 0 [ 475.699562][ T4325] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 475.709551][ T4325] usb 4-1: config 1 interface 105 altsetting 2 endpoint 0x82 has invalid maxpacket 24896, setting to 1024 [ 475.721134][ T4325] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 475.731817][ T4325] usb 4-1: config 1 interface 105 has no altsetting 0 [ 475.769139][ T4325] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 475.792715][ T4325] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 475.801063][ T4325] usb 4-1: Product: syz [ 475.805334][ T4325] usb 4-1: Manufacturer: syz [ 475.810065][ T4325] usb 4-1: SerialNumber: syz [ 475.833753][T10044] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 475.845924][T10044] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 476.069339][ T4276] Bluetooth: hci1: command 0x041b tx timeout [ 476.295294][T10044] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 476.309509][T10044] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 476.337489][ T9044] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 476.402470][ T9044] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 476.848704][ T9044] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 476.858391][ T9044] bond0 (unregistering): Released all slaves [ 477.153105][T10041] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1451'. [ 477.187182][T10043] netlink: 'syz.6.1452': attribute type 30 has an invalid length. [ 477.197739][ T4325] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 477.268923][ T4325] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 477.312234][ T4325] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 477.411928][ T4325] aqc111 4-1:1.105 eth13: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, a2:58:cc:a8:92:46 [ 477.499452][ T4325] usb 4-1: USB disconnect, device number 9 [ 477.533827][ T9997] chnl_net:caif_netlink_parms(): no params data found [ 477.628069][ T4325] aqc111 4-1:1.105 eth13: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 478.150880][ T4276] Bluetooth: hci1: command 0x040f tx timeout [ 478.719972][ T4325] aqc111 4-1:1.105 eth13 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 478.759964][ T4325] aqc111 4-1:1.105 eth13 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 478.770152][ T4325] aqc111 4-1:1.105 eth13 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 478.844401][ T9997] bridge0: port 1(bridge_slave_0) entered blocking state [ 478.924823][ T9997] bridge0: port 1(bridge_slave_0) entered disabled state [ 478.985433][ T9997] device bridge_slave_0 entered promiscuous mode [ 479.035998][ T9997] bridge0: port 2(bridge_slave_1) entered blocking state [ 479.149198][ T9997] bridge0: port 2(bridge_slave_1) entered disabled state [ 479.261104][ T9997] device bridge_slave_1 entered promiscuous mode [ 479.496312][ T9997] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 479.731582][ T9997] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 480.415470][ T4283] Bluetooth: hci1: command 0x0419 tx timeout [ 481.043090][ T4283] Bluetooth: hci0: command 0x0406 tx timeout [ 481.364409][ T9997] team0: Port device team_slave_0 added [ 481.436488][ T9997] team0: Port device team_slave_1 added [ 481.625973][ T9997] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 481.690950][ T9997] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 481.839097][ T9997] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 481.871883][T10104] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1465'. [ 481.950005][ T9997] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 481.969157][ T9997] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 482.127880][T10112] loop3: detected capacity change from 0 to 512 [ 482.138448][ T9997] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 482.177982][T10110] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1465'. [ 482.807022][T10112] EXT4-fs: Ignoring removed mblk_io_submit option [ 482.850769][T10112] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 482.889806][T10116] loop6: detected capacity change from 0 to 8 [ 482.936119][T10116] SQUASHFS error: lzo decompression failed, data probably corrupt [ 482.980628][T10112] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 483.050862][T10116] SQUASHFS error: Failed to read block 0x91: -5 [ 483.057254][T10116] SQUASHFS error: Unable to read metadata cache entry [8f] [ 483.066166][T10112] EXT4-fs (loop3): orphan cleanup on readonly fs [ 483.102272][ T9997] device hsr_slave_0 entered promiscuous mode [ 483.156315][T10112] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:477: comm syz.3.1467: Invalid block bitmap block 0 in block_group 0 [ 483.178532][T10116] SQUASHFS error: Unable to read inode 0x7 [ 483.185447][ T9997] device hsr_slave_1 entered promiscuous mode [ 483.264124][T10112] Quota error (device loop3): write_blk: dquota write failed [ 483.292411][ T9997] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 483.309435][T10112] Quota error (device loop3): qtree_write_dquot: Error -28 occurred while creating quota [ 483.325969][ T9997] Cannot create hsr debugfs directory [ 483.375597][T10112] EXT4-fs error (device loop3): ext4_acquire_dquot:6841: comm syz.3.1467: Failed to acquire dquot type 1 [ 483.449475][T10112] EXT4-fs (loop3): 1 orphan inode deleted [ 483.459460][ T7287] Quota error (device loop3): do_check_range: Getting block 0 out of range 1-5 [ 483.558744][ T7287] EXT4-fs error (device loop3): ext4_release_dquot:6877: comm kworker/u4:27: Failed to release dquot type 1 [ 484.201127][T10112] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 485.304071][ T4277] EXT4-fs (loop3): unmounting filesystem. [ 487.355533][T10159] overlayfs: missing 'lowerdir' [ 487.478102][T10160] overlayfs: bad mount option "redirect_dir=nofollow:/" [ 488.163018][ T9997] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 488.226965][ T9997] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 488.315429][ T9997] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 488.358020][ T9997] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 488.587424][T10179] ip_tables: iptables: counters copy to user failed while replacing table [ 488.665007][ T9997] 8021q: adding VLAN 0 to HW filter on device bond0 [ 488.769286][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 488.782438][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 488.797915][T10184] loop6: detected capacity change from 0 to 256 [ 488.860250][T10186] 9pnet_virtio: no channels available for device 127.0.0.1 [ 489.016841][T10184] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x987a2e96, utbl_chksum : 0xe619d30d) [ 489.311170][T10184] syz.6.1483: attempt to access beyond end of device [ 489.311170][T10184] loop6: rw=524288, sector=34359738488, nr_sectors = 8 limit=256 [ 489.425967][T10184] syz.6.1483: attempt to access beyond end of device [ 489.425967][T10184] loop6: rw=0, sector=34359738488, nr_sectors = 8 limit=256 [ 489.487308][ T9997] 8021q: adding VLAN 0 to HW filter on device team0 [ 489.545624][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 489.549184][ T26] audit: type=1800 audit(2000000100.310:423): pid=10184 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1483" name="file1" dev="loop6" ino=1048644 res=0 errno=0 [ 489.586611][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 489.630130][ T7287] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.637379][ T7287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 489.655047][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 489.678010][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 489.718489][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 489.780039][ T7287] bridge0: port 2(bridge_slave_1) entered blocking state [ 489.787222][ T7287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 489.857614][T10195] loop3: detected capacity change from 0 to 512 [ 490.095854][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 490.166158][ T9044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 490.188023][T10195] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 490.203074][T10195] ext4 filesystem being mounted at /300/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 490.270151][ T9044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 490.441575][ T9044] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 490.534805][ T4277] EXT4-fs (loop3): unmounting filesystem. [ 490.592985][ T9044] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 490.697455][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 490.790238][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 490.834251][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 490.854619][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 490.883772][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 490.909942][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 490.952168][ T9997] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 491.979331][T10220] netlink: 'syz.4.1492': attribute type 1 has an invalid length. [ 492.171007][T10229] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 492.187984][T10229] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 492.196476][T10229] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 492.267916][T10229] device hsr1 left promiscuous mode [ 492.472588][T10228] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1494'. [ 492.783640][T10232] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1494'. [ 493.492530][ T4283] Bluetooth: hci4: unexpected subevent 0x01 length: 19 > 18 [ 493.502166][ T4283] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 494.253590][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 494.305144][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 494.556410][ T9997] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 495.253245][T10261] loop3: detected capacity change from 0 to 256 [ 495.323958][T10261] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x987a2e96, utbl_chksum : 0xe619d30d) [ 495.971295][T10261] syz.3.1500: attempt to access beyond end of device [ 495.971295][T10261] loop3: rw=524288, sector=34359738488, nr_sectors = 8 limit=256 [ 496.069924][T10261] syz.3.1500: attempt to access beyond end of device [ 496.069924][T10261] loop3: rw=0, sector=34359738488, nr_sectors = 8 limit=256 [ 496.173908][ T26] audit: type=1800 audit(2000000107.000:424): pid=10261 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1500" name="file1" dev="loop3" ino=1048646 res=0 errno=0 [ 496.423500][T10278] loop6: detected capacity change from 0 to 256 [ 496.460574][T10278] exfat: Bad value for 'fmask' [ 499.062322][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 499.084823][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 499.587933][ T9997] device veth0_vlan entered promiscuous mode [ 499.672321][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 499.719896][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 499.810380][ T9997] device veth1_vlan entered promiscuous mode [ 499.878788][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 499.899665][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 499.989795][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 500.096994][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 500.120108][ T9997] device veth0_macvtap entered promiscuous mode [ 500.148709][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 500.179779][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 500.266976][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 500.322001][ T9997] device veth1_macvtap entered promiscuous mode [ 500.362471][ T9997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 500.385698][ T9997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 500.412118][ T9997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 500.485770][ T9997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 500.552972][ T9997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 500.619253][ T9997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 500.631334][ T9997] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 500.666540][ T6259] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 500.694086][ T6259] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 500.745913][ T6259] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 500.802176][ T9997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 500.840888][ T9997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 500.882625][ T9997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 500.969503][ T9997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 501.042284][ T9997] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 501.063179][T10329] device bond_slave_0 entered promiscuous mode [ 501.070011][T10329] device bond_slave_1 entered promiscuous mode [ 501.118844][T10329] device bond_slave_0 left promiscuous mode [ 501.124936][T10329] device bond_slave_1 left promiscuous mode [ 501.167272][T10329] bond3: (slave vlan2): making interface the new active one [ 501.201679][T10329] device bond_slave_0 entered promiscuous mode [ 501.207945][T10329] device bond_slave_1 entered promiscuous mode [ 501.260561][T10329] bond3: (slave vlan2): Enslaving as an active interface with an up link [ 501.299293][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 501.354329][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.361324][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.380250][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 501.402646][ T9997] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.419560][ T9997] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.439153][ T9997] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.448008][ T9997] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 502.769925][T10341] fuse: Unknown parameter 'group_i' [ 502.999199][ T9046] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 503.007277][ T9046] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 503.077060][ T9044] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 503.214842][ T9044] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 503.254984][ T9044] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 503.340057][ T7287] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 504.592255][T10369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1519'. [ 504.605347][T10369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1519'. [ 504.618641][T10369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1519'. [ 504.631115][T10369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1519'. [ 504.640792][T10369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1519'. [ 507.539707][T10418] 9pnet_virtio: no channels available for device 127.0.0.1 [ 509.112713][T10432] bond4: (slave vlan2): making interface the new active one [ 509.131773][T10432] bond4: (slave vlan2): Enslaving as an active interface with an up link [ 509.615662][T10447] loop6: detected capacity change from 0 to 512 [ 509.726929][T10447] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 509.786722][T10447] ext4 filesystem being mounted at /96/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 510.384827][ T7957] EXT4-fs (loop6): unmounting filesystem. [ 510.722964][T10465] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 510.763024][T10465] bridge0: port 1(bridge_slave_0) entered disabled state [ 510.790516][T10465] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 510.880881][T10467] netlink: 'syz.6.1539': attribute type 9 has an invalid length. [ 512.334409][ T27] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 512.502434][T10491] 9pnet_virtio: no channels available for device 127.0.0.1 [ 512.529149][ T27] usb 4-1: Using ep0 maxpacket: 32 [ 512.536572][ T27] usb 4-1: config 0 has no interfaces? [ 512.571072][ T27] usb 4-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 512.616758][ T27] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.690250][ T27] usb 4-1: Product: syz [ 512.695429][ T27] usb 4-1: Manufacturer: syz [ 512.721381][ T27] usb 4-1: SerialNumber: syz [ 512.870137][ T27] usb 4-1: config 0 descriptor?? [ 513.399333][ T4262] usb 4-1: USB disconnect, device number 10 [ 516.499288][ T27] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 516.717632][ T27] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 516.751553][ T27] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 516.782521][ T27] usb 8-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 516.823330][ T27] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 516.900566][T10550] netlink: 52 bytes leftover after parsing attributes in process `syz.6.1556'. [ 516.910416][ T27] usb 8-1: config 0 descriptor?? [ 516.918142][T10550] bridge0: port 2(bridge_slave_1) entered disabled state [ 516.946810][T10550] netlink: 76 bytes leftover after parsing attributes in process `syz.6.1556'. [ 516.971870][T10550] bridge0: port 2(bridge_slave_1) entered blocking state [ 516.979151][T10550] bridge0: port 2(bridge_slave_1) entered forwarding state [ 516.995013][T10550] netlink: 52 bytes leftover after parsing attributes in process `syz.6.1556'. [ 517.007159][T10550] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.358325][ T27] isku 0003:1E7D:319C.0006: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.7-1/input0 [ 517.663865][T10564] loop3: detected capacity change from 0 to 256 [ 517.694174][ T27] isku 0003:1E7D:319C.0006: couldn't init struct isku_device [ 517.717418][ T27] isku 0003:1E7D:319C.0006: couldn't install keyboard [ 517.775050][T10564] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 517.807488][ T27] isku: probe of 0003:1E7D:319C.0006 failed with error -71 [ 517.899507][ T27] usb 8-1: USB disconnect, device number 2 [ 517.956818][T10570] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 518.106677][T10570] CIFS: Attempting to mount \\127.0.0.1\share [ 518.256202][T10567] fido_id[10567]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 518.299116][ T4323] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 518.772100][T10570] CIFS: VFS: Error connecting to socket. Aborting operation. [ 518.838363][T10570] CIFS: VFS: cifs_mount failed w/return code = -4 [ 518.847086][T10583] loop7: detected capacity change from 0 to 512 [ 518.860438][T10583] EXT4-fs: inline encryption not supported [ 518.886809][T10583] EXT4-fs (loop7): Test dummy encryption mode enabled [ 518.913216][T10583] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 518.959095][ T4323] usb 7-1: Using ep0 maxpacket: 32 [ 518.966785][ T4323] usb 7-1: config 0 has no interfaces? [ 519.009801][ T4323] usb 7-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 519.069907][ T4323] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 519.078130][ T4323] usb 7-1: Product: syz [ 519.090255][ T4323] usb 7-1: Manufacturer: syz [ 519.095037][ T4323] usb 7-1: SerialNumber: syz [ 519.102493][ T4323] usb 7-1: config 0 descriptor?? [ 519.110925][T10583] EXT4-fs error (device loop7): ext4_orphan_get:1435: comm syz.7.1565: bad orphan inode 131083 [ 519.143827][T10583] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 519.349729][ T4323] usb 7-1: USB disconnect, device number 5 [ 523.010372][ T4283] Bluetooth: hci3: unexpected event 0x03 length: 1 < 11 [ 525.881550][T10591] EXT4-fs (loop7): unmounting filesystem. [ 525.953155][ T6264] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.280848][ T6264] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.323225][ T6264] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.544270][ T6264] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.657483][ T26] audit: type=1326 audit(2000000138.480:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10654 comm="syz.3.1585" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fddaa79e159 code=0x0 [ 527.715826][T10657] loop6: detected capacity change from 0 to 512 [ 527.769522][T10657] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 527.832238][T10657] EXT4-fs error (device loop6): ext4_init_orphan_info:623: comm syz.6.1593: orphan file block 0: bad magic [ 527.907321][T10657] EXT4-fs (loop6): mount failed [ 527.991323][T10657] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1593'. [ 528.411749][ T4276] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 528.424675][ T4276] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 528.441921][ T4276] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 528.453148][ T4276] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 528.472728][ T4276] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 528.480324][ T4276] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 530.552207][ T4283] Bluetooth: hci1: command 0x0409 tx timeout [ 532.948962][ T4283] Bluetooth: hci1: command 0x041b tx timeout [ 534.484075][T10726] loop3: detected capacity change from 0 to 512 [ 534.555345][T10726] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 534.761698][T10726] EXT4-fs (loop3): 1 truncate cleaned up [ 534.835392][T10726] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 535.029381][ T4283] Bluetooth: hci1: command 0x040f tx timeout [ 535.599238][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 535.734620][ T4277] EXT4-fs (loop3): unmounting filesystem. [ 536.429389][T10672] chnl_net:caif_netlink_parms(): no params data found [ 536.550473][T10753] overlayfs: failed to clone upperpath [ 537.119068][ T4283] Bluetooth: hci1: command 0x0419 tx timeout [ 537.394664][T10761] device ip6gre1 entered promiscuous mode [ 538.303889][ T4323] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 538.322709][ T4323] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 538.355946][ T4321] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 538.779261][T10672] bridge0: port 1(bridge_slave_0) entered blocking state [ 538.806889][T10672] bridge0: port 1(bridge_slave_0) entered disabled state [ 538.826096][T10672] device bridge_slave_0 entered promiscuous mode [ 538.834464][T10775] FAULT_INJECTION: forcing a failure. [ 538.834464][T10775] name failslab, interval 1, probability 0, space 0, times 0 [ 538.868764][T10775] CPU: 0 PID: 10775 Comm: syz.6.1604 Not tainted syzkaller #0 [ 538.876324][T10775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 538.886532][T10775] Call Trace: [ 538.889880][T10775] [ 538.892878][T10775] dump_stack_lvl+0x188/0x24e [ 538.897620][T10775] ? show_regs_print_info+0x12/0x12 [ 538.902892][T10775] ? load_image+0x410/0x410 [ 538.907463][T10775] ? __might_sleep+0xd0/0xd0 [ 538.912124][T10775] ? __lock_acquire+0x7c40/0x7c40 [ 538.917219][T10775] should_fail_ex+0x390/0x4c0 [ 538.921970][T10775] should_failslab+0x5/0x20 [ 538.926520][T10775] slab_pre_alloc_hook+0x59/0x300 [ 538.931605][T10775] ? memcg_list_lru_alloc+0x331/0xb00 [ 538.937039][T10775] __kmem_cache_alloc_node+0x4f/0x270 [ 538.942474][T10775] ? memcg_list_lru_alloc+0x331/0xb00 [ 538.947903][T10775] __kmalloc+0xa3/0x240 [ 538.952149][T10775] memcg_list_lru_alloc+0x331/0xb00 [ 538.957441][T10775] ? slab_pre_alloc_hook+0xb1/0x300 [ 538.962787][T10775] ? memcg_reparent_list_lrus+0x850/0x850 [ 538.968575][T10775] ? get_obj_cgroup_from_current+0xd0/0x280 [ 538.974533][T10775] ? get_obj_cgroup_from_current+0xd0/0x280 [ 538.980497][T10775] slab_pre_alloc_hook+0x2ad/0x300 [ 538.985665][T10775] ? slab_pre_alloc_hook+0xb1/0x300 [ 538.990934][T10775] kmem_cache_alloc_lru+0x49/0x2e0 [ 538.996096][T10775] ? __d_alloc+0x2e/0x6e0 [ 539.000518][T10775] __d_alloc+0x2e/0x6e0 [ 539.004721][T10775] ? d_alloc_pseudo+0xe/0x70 [ 539.009454][T10775] d_alloc_pseudo+0x19/0x70 [ 539.014010][T10775] alloc_file_pseudo+0xe0/0x200 [ 539.018922][T10775] ? alloc_empty_file_noaccount+0x80/0x80 [ 539.024881][T10775] ? alloc_anon_inode+0x22e/0x300 [ 539.029957][T10775] ? memcpy+0x3c/0x60 [ 539.033997][T10775] ? alloc_anon_inode+0x22e/0x300 [ 539.039090][T10775] aio_setup_ring+0x1f1/0xf50 [ 539.043833][T10775] ? free_ioctx_reqs+0x180/0x180 [ 539.048839][T10775] ioctx_alloc+0x315/0x7b0 [ 539.053342][T10775] __se_sys_io_setup+0x7b/0x190 [ 539.058243][T10775] do_syscall_64+0x4c/0xa0 [ 539.062721][T10775] ? clear_bhb_loop+0x60/0xb0 [ 539.067461][T10775] ? clear_bhb_loop+0x60/0xb0 [ 539.072187][T10775] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 539.078146][T10775] RIP: 0033:0x7fa0d559e159 [ 539.082614][T10775] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 539.102362][T10775] RSP: 002b:00007fa0d6464028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 539.110833][T10775] RAX: ffffffffffffffda RBX: 00007fa0d5825fa0 RCX: 00007fa0d559e159 [ 539.118869][T10775] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 00000000000003ff [ 539.126890][T10775] RBP: 00007fa0d563506b R08: 0000000000000000 R09: 0000000000000000 [ 539.134913][T10775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 539.142965][T10775] R13: 00007fa0d5826038 R14: 00007fa0d5825fa0 R15: 00007fff85f57f28 [ 539.151009][T10775] [ 539.196726][ T4321] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 539.238060][T10672] bridge0: port 2(bridge_slave_1) entered blocking state [ 539.257898][T10672] bridge0: port 2(bridge_slave_1) entered disabled state [ 539.269738][ T4321] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 539.300272][T10672] device bridge_slave_1 entered promiscuous mode [ 539.432014][ T6264] device hsr_slave_0 left promiscuous mode [ 539.438869][ T6264] device hsr_slave_1 left promiscuous mode [ 539.454007][ T6264] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 539.464406][ T6264] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 539.480585][ T6264] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 539.488258][ T6264] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 539.496779][ T6264] device bridge_slave_1 left promiscuous mode [ 539.503939][ T6264] bridge0: port 2(bridge_slave_1) entered disabled state [ 539.531786][ T6264] device bridge_slave_0 left promiscuous mode [ 539.543813][ T6264] bridge0: port 1(bridge_slave_0) entered disabled state [ 540.735237][ T6264] device veth1_macvtap left promiscuous mode [ 540.744976][ T6264] device veth0_macvtap left promiscuous mode [ 540.765368][ T6264] device veth1_vlan left promiscuous mode [ 540.780844][ T6264] device veth0_vlan left promiscuous mode [ 541.852418][ T7] libceph: connect (2)127.0.0.1:6789 error -101 [ 541.880651][ T7] libceph: ceph_tcp_connect failed: -101 [ 541.886370][ T7] libceph: mon0 (2)127.0.0.1:6789 connect error [ 542.182190][ T7] libceph: connect (2)127.0.0.1:6789 error -101 [ 542.188894][ T7] libceph: ceph_tcp_connect failed: -101 [ 542.200011][ T7] libceph: mon0 (2)127.0.0.1:6789 connect error [ 542.719897][T10804] ceph: No mds server is up or the cluster is laggy [ 543.016058][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 543.028370][ T7] libceph: connect (2)127.0.0.1:6789 error -101 [ 543.051490][ T7] libceph: ceph_tcp_connect failed: -101 [ 543.057230][ T7] libceph: mon0 (2)127.0.0.1:6789 connect error [ 545.278630][T10836] loop6: detected capacity change from 0 to 512 [ 545.524262][T10836] EXT4-fs (loop6): Cannot turn on journaled quota: type 1: error -2 [ 545.539308][T10836] EXT4-fs error (device loop6): ext4_iget_extra_inode:4763: inode #15: comm syz.6.1618: corrupted in-inode xattr [ 545.561184][T10836] EXT4-fs error (device loop6): ext4_orphan_get:1414: comm syz.6.1618: couldn't read orphan inode 15 (err -117) [ 545.576559][T10836] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 546.214700][ T7957] EXT4-fs (loop6): unmounting filesystem. [ 548.512995][ T6264] team0 (unregistering): Port device team_slave_1 removed [ 548.619795][ T6264] team0 (unregistering): Port device team_slave_0 removed [ 548.756786][ T6264] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 548.993327][ T6264] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 549.264533][T10867] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 549.264533][T10867] The task syz.2.1623 (10867) triggered the difference, watch for misbehavior. [ 549.614229][ T6264] bond0 (unregistering): Released all slaves [ 549.753258][T10672] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 549.793574][T10858] device syzkaller0 entered promiscuous mode [ 549.810599][T10672] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 549.966602][T10672] team0: Port device team_slave_0 added [ 549.987459][T10672] team0: Port device team_slave_1 added [ 550.138420][T10672] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 550.188278][T10672] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 550.224587][T10672] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 550.242993][T10672] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 550.251150][T10672] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 550.278959][T10672] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 550.303293][T10879] netlink: 'syz.4.1624': attribute type 4 has an invalid length. [ 550.917592][T10672] device hsr_slave_0 entered promiscuous mode [ 551.247304][T10672] device hsr_slave_1 entered promiscuous mode [ 551.269170][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 551.328378][T10672] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 551.353774][T10672] Cannot create hsr debugfs directory [ 554.581671][T10672] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 554.713719][T10672] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 554.802549][T10672] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 554.894896][T10672] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 555.582865][ T4283] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 555.594151][ T4283] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 555.604030][ T4283] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 555.615129][ T4283] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 555.623569][ T4283] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 555.647486][ T4289] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 556.990450][T10672] 8021q: adding VLAN 0 to HW filter on device bond0 [ 557.105504][T10949] 8021q: adding VLAN 0 to HW filter on device bond10 [ 557.156909][T10951] bond10: (slave geneve2): Enslaving as a backup interface with an up link [ 557.268762][ T4301] bond10: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 557.609236][ T4696] IPv6: ADDRCONF(NETDEV_CHANGE): bond10: link becomes ready [ 557.711779][ T4696] bond10: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 557.743687][T10672] 8021q: adding VLAN 0 to HW filter on device team0 [ 557.750132][ T4283] Bluetooth: hci5: command 0x0409 tx timeout [ 557.793577][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 557.835937][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 557.988760][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 558.010664][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 558.043103][ T6254] bridge0: port 1(bridge_slave_0) entered blocking state [ 558.050359][ T6254] bridge0: port 1(bridge_slave_0) entered forwarding state [ 558.128129][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 558.138171][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 558.147168][ T6254] bridge0: port 2(bridge_slave_1) entered blocking state [ 558.154368][ T6254] bridge0: port 2(bridge_slave_1) entered forwarding state [ 558.166849][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 558.325775][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 558.408901][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 558.794561][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 558.835066][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 558.893153][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 558.993049][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 559.132988][T10758] bond0: (slave syz_tun): Releasing backup interface [ 559.163751][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 559.187902][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 559.220496][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 559.294402][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 559.307197][ T6254] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 559.327600][T10929] chnl_net:caif_netlink_parms(): no params data found [ 559.391221][T10672] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 559.626999][T10929] bridge0: port 1(bridge_slave_0) entered blocking state [ 559.658266][T10929] bridge0: port 1(bridge_slave_0) entered disabled state [ 559.724222][T10929] device bridge_slave_0 entered promiscuous mode [ 559.777701][T10929] bridge0: port 2(bridge_slave_1) entered blocking state [ 559.803200][T10929] bridge0: port 2(bridge_slave_1) entered disabled state [ 559.829263][ T4283] Bluetooth: hci5: command 0x041b tx timeout [ 559.845686][T10929] device bridge_slave_1 entered promiscuous mode [ 559.974742][T10929] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 560.036669][T10929] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 560.212813][T10929] team0: Port device team_slave_0 added [ 560.252732][T10929] team0: Port device team_slave_1 added [ 560.403307][T10929] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 560.443155][T10929] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 560.572262][T10929] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 560.639247][T10929] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 560.646263][T10929] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 560.909170][T10929] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 560.970973][ T6252] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 560.983154][ T6252] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 561.688727][T10672] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 561.797739][T10929] device hsr_slave_0 entered promiscuous mode [ 561.840272][T10929] device hsr_slave_1 entered promiscuous mode [ 561.867105][T10929] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 561.883642][T11024] trusted_key: encrypted_key: insufficient parameters specified [ 561.899227][T10929] Cannot create hsr debugfs directory [ 561.909331][ T4283] Bluetooth: hci5: command 0x040f tx timeout [ 562.799895][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.808898][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.308744][T10929] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 563.319825][T10929] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 563.331547][T10929] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 563.342589][T10929] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 563.432588][T10929] 8021q: adding VLAN 0 to HW filter on device bond0 [ 563.458065][T10929] 8021q: adding VLAN 0 to HW filter on device team0 [ 563.512588][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 563.536350][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 563.545674][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 563.563123][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 563.572671][ T4652] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.579880][ T4652] bridge0: port 1(bridge_slave_0) entered forwarding state [ 563.674231][T11041] loop6: detected capacity change from 0 to 128 [ 563.714474][T11041] affs: No valid root block on device loop6 [ 564.296517][ T4283] Bluetooth: hci5: command 0x0419 tx timeout [ 564.311393][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 564.320512][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 564.329401][ T4652] bridge0: port 2(bridge_slave_1) entered blocking state [ 564.336555][ T4652] bridge0: port 2(bridge_slave_1) entered forwarding state [ 564.344719][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 564.355328][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 564.364573][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 564.373950][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 564.384039][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 564.409813][T10932] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 564.451246][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 564.496259][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 564.526535][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 564.713634][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 564.754134][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 564.799946][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 564.829117][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 564.858288][T11054] Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 564.876969][T10929] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 564.898425][ T26] audit: type=1326 audit(2000000175.720:426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6bbb9e159 code=0x7ffc0000 [ 565.026684][ T26] audit: type=1326 audit(2000000175.760:427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6bbb9e159 code=0x7ffc0000 [ 565.126181][ T26] audit: type=1326 audit(2000000175.760:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6bbb9e159 code=0x7ffc0000 [ 565.172064][T11064] futex_wake_op: syz.6.1658 tries to shift op by 144; fix this program [ 565.209143][ T26] audit: type=1326 audit(2000000175.760:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fe6bbb97ed7 code=0x7ffc0000 [ 565.306720][ T26] audit: type=1326 audit(2000000175.760:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe6bbb3f4d9 code=0x7ffc0000 [ 565.342915][ T26] audit: type=1326 audit(2000000175.760:431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe6bbb5e98e code=0x7ffc0000 [ 565.429463][T11071] netlink: 'syz.2.1660': attribute type 13 has an invalid length. [ 565.445260][T11071] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1660'. [ 565.465776][ T26] audit: type=1326 audit(2000000175.760:432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe6bbb5e98e code=0x7ffc0000 [ 565.492815][T11071] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 565.521293][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 565.540328][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 565.572582][ T26] audit: type=1326 audit(2000000175.760:433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6bbb9e159 code=0x7ffc0000 [ 565.623797][ T4696] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 565.648744][ T4696] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 565.679231][ T4696] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 565.689281][ T26] audit: type=1326 audit(2000000175.760:434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6bbb9e159 code=0x7ffc0000 [ 565.719763][ T4696] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 565.736528][ T26] audit: type=1326 audit(2000000175.760:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11055 comm="syz.2.1656" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6bbb9e159 code=0x7ffc0000 [ 565.745382][T10672] device veth0_vlan entered promiscuous mode [ 565.833417][T10672] device veth1_vlan entered promiscuous mode [ 566.015233][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 566.053093][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 566.298280][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 566.540770][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 566.826180][T10672] device veth0_macvtap entered promiscuous mode [ 567.007514][T11093] xt_nat: multiple ranges no longer supported [ 567.269283][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 567.374357][T10929] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 567.620130][T10672] device veth1_macvtap entered promiscuous mode [ 567.628198][ T6245] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 567.653509][ T6245] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 567.754824][T10672] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 567.789104][T10672] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 567.829515][T10672] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 567.938502][T10672] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.020669][T10672] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 568.123218][T10672] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.206695][T10672] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 568.536474][T10672] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 568.778214][T10672] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.880388][T10672] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 568.941186][T10672] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.986334][T10672] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 569.038197][ T9046] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 569.057568][ T9046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 569.087412][ T9046] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 569.127907][ T9046] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 569.157476][T10672] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.194548][T10672] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.248134][T10672] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.287727][T10672] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 570.380016][ T6245] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.387932][ T6245] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 570.466519][ T4525] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 570.515668][ T6245] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.545245][ T6245] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 570.566527][ T6259] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 572.175782][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 572.209502][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 572.979192][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 573.067955][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 573.126063][T10929] device veth0_vlan entered promiscuous mode [ 573.138484][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 573.148480][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 573.188471][T10929] device veth1_vlan entered promiscuous mode [ 573.207672][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 573.231518][T11172] futex_wake_op: syz.4.1678 tries to shift op by 144; fix this program [ 573.281046][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 573.307433][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 573.338556][T10929] device veth0_macvtap entered promiscuous mode [ 573.366436][T10929] device veth1_macvtap entered promiscuous mode [ 573.465063][T10929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 573.531457][T10929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 573.602735][T10929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 573.639098][T10929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 573.694617][T10929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 573.730788][T10929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 573.779472][T10929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 573.810509][T10929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 573.833520][T10929] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 573.857013][ T9046] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 573.882586][ T9046] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 573.911833][ T9046] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 573.942465][ T9046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 573.977209][T10929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.007707][T10929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.068496][T10929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.114086][T10929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.158909][T10929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.229113][T10929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.319175][T10929] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 574.337347][ T6245] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 574.357748][ T6245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 574.414137][T10929] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.443881][T10929] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.476218][T10929] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.505420][T10929] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.933307][ T4696] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 574.983153][ T4696] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 575.152551][ T4696] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 575.223033][ T4652] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 575.252547][ T4652] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 575.321501][ T6245] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 577.329335][T11217] loop9: detected capacity change from 0 to 4096 [ 577.392275][T11223] loop8: detected capacity change from 0 to 256 [ 577.434453][T11217] NILFS (loop9): broken superblock, retrying with spare superblock (blocksize = 1024) [ 577.496178][T11217] NILFS (loop9): mounting unchecked fs [ 577.614265][T11217] NILFS (loop9): recovery complete [ 577.656782][T11226] NILFS (loop9): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 578.049528][T11230] loop8: detected capacity change from 0 to 4096 [ 578.106729][T11230] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 578.221570][T11230] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 578.543501][T11240] xt_CT: You must specify a L4 protocol and not use inversions on it [ 578.577342][T10672] EXT4-fs (loop8): unmounting filesystem. [ 579.522424][T11254] loop9: detected capacity change from 0 to 128 [ 579.564015][T11254] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 579.770311][T11254] ext4 filesystem being mounted at /2/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 580.561410][T11266] device lo entered promiscuous mode [ 581.491047][T11285] loop6: detected capacity change from 0 to 128 [ 582.010738][T11266] device tunl0 entered promiscuous mode [ 582.799224][T11266] device gre0 entered promiscuous mode [ 582.986217][T11266] device gretap0 entered promiscuous mode [ 583.086351][T11266] device erspan0 entered promiscuous mode [ 583.259765][T11266] device ip_vti0 entered promiscuous mode [ 583.318628][T11301] loop6: detected capacity change from 0 to 4096 [ 583.326350][T11266] device ip6_vti0 entered promiscuous mode [ 583.390863][T11301] NILFS (loop6): broken superblock, retrying with spare superblock (blocksize = 1024) [ 583.423469][T11266] device sit0 entered promiscuous mode [ 583.439498][T11301] NILFS (loop6): mounting unchecked fs [ 583.530801][T11301] NILFS (loop6): recovery complete [ 583.565210][T11304] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 583.669719][T11266] device ip6tnl0 entered promiscuous mode [ 583.775930][T11266] device ip6gre0 entered promiscuous mode [ 583.848498][ T26] kauditd_printk_skb: 14 callbacks suppressed [ 583.848574][ T26] audit: type=1326 audit(2000000194.670:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11286 comm="syz.4.1705" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc22bf9e159 code=0x0 [ 583.850977][T11266] device syz_tun entered promiscuous mode [ 583.976978][T11266] device ip6gretap0 entered promiscuous mode [ 584.076803][T11266] bridge0: port 2(bridge_slave_1) entered disabled state [ 584.084405][T11266] bridge0: port 1(bridge_slave_0) entered disabled state [ 584.139396][T11266] device bridge0 entered promiscuous mode [ 584.217574][T11266] device vcan0 entered promiscuous mode [ 584.247275][T11266] device bond0 entered promiscuous mode [ 584.253211][T11266] device bond_slave_0 entered promiscuous mode [ 584.260836][T11266] device bond_slave_1 entered promiscuous mode [ 584.347553][T11266] device team0 entered promiscuous mode [ 584.353845][T11266] device team_slave_0 entered promiscuous mode [ 584.371641][T11266] device team_slave_1 entered promiscuous mode [ 584.428478][T11266] device dummy0 entered promiscuous mode [ 584.495021][T11266] device nlmon0 entered promiscuous mode [ 584.508478][T11266] device caif0 entered promiscuous mode [ 584.576822][T11266] device batadv0 entered promiscuous mode [ 584.671787][T11266] device vxcan0 entered promiscuous mode [ 584.900814][T11266] device vxcan1 entered promiscuous mode [ 585.332010][T11266] device veth0 entered promiscuous mode [ 585.450892][T11266] device veth1 entered promiscuous mode [ 586.433186][T11266] device wg0 entered promiscuous mode [ 586.493984][T11266] device wg1 entered promiscuous mode [ 586.576443][T11266] device wg2 entered promiscuous mode [ 586.635024][T11266] device veth0_to_bridge entered promiscuous mode [ 586.790433][T11266] device veth1_to_bridge entered promiscuous mode [ 586.959716][T11266] device veth0_to_bond entered promiscuous mode [ 587.076641][T11266] device veth1_to_bond entered promiscuous mode [ 587.198516][T11266] device veth0_to_team entered promiscuous mode [ 587.376407][T11266] device veth1_to_team entered promiscuous mode [ 587.690373][T11266] device veth0_to_batadv entered promiscuous mode [ 587.730671][T11266] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 587.756848][T11266] device batadv_slave_0 entered promiscuous mode [ 588.417957][T11266] device veth1_to_batadv entered promiscuous mode [ 588.458635][T11266] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 588.500220][T11266] device batadv_slave_1 entered promiscuous mode [ 588.604032][T11266] device xfrm0 entered promiscuous mode [ 588.660377][T11266] device veth0_to_hsr entered promiscuous mode [ 589.495208][T11266] device veth1_to_hsr entered promiscuous mode [ 589.677904][T11266] device hsr0 entered promiscuous mode [ 589.785361][T11266] device veth1_virt_wifi entered promiscuous mode [ 589.907926][T11266] device veth0_virt_wifi entered promiscuous mode [ 589.945014][T11266] device virt_wifi0 entered promiscuous mode [ 591.089705][T11266] device vlan0 entered promiscuous mode [ 591.149289][T11266] device vlan1 entered promiscuous mode [ 591.471246][T11266] device macvlan0 entered promiscuous mode [ 591.620479][T11266] device macvlan1 entered promiscuous mode [ 591.652280][T11266] device ipvlan0 entered promiscuous mode [ 591.737979][T11266] device ipvlan1 entered promiscuous mode [ 592.389269][T11266] device macvtap0 entered promiscuous mode [ 592.516531][T11266] device macsec0 entered promiscuous mode [ 592.556662][T11266] device geneve0 entered promiscuous mode [ 592.645130][T11266] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.659090][T11266] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.678566][T11266] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.698822][T11266] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.719514][T11266] device geneve1 entered promiscuous mode [ 592.768237][T11266] device netdevsim0 entered promiscuous mode [ 592.798342][T11266] device netdevsim1 entered promiscuous mode [ 592.825936][T11266] device netdevsim2 entered promiscuous mode [ 592.869502][T11266] device netdevsim3 entered promiscuous mode [ 592.921977][T11266] device wlan0 entered promiscuous mode [ 592.966926][T11266] device wlan1 entered promiscuous mode [ 593.323649][T11358] ip_tables: iptables: counters copy to user failed while replacing table [ 593.390553][T10929] EXT4-fs (loop9): unmounting filesystem. [ 593.560422][T11366] syzkaller0: create flow: hash 1970683988 index 2 [ 594.392866][ T6069] syzkaller0: tun_net_xmit 76 [ 594.398685][ T6069] syzkaller0: tun_net_xmit 48 [ 594.428056][ T7] syzkaller0: tun_net_xmit 76 [ 594.455101][T11362] syzkaller0: delete flow: hash 1970683988 index 2 [ 594.760947][ T6069] syzkaller0: tun_net_xmit 76 [ 595.709153][ T6069] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 596.245837][ T6069] usb 10-1: config 253 has an invalid interface number: 130 but max is 0 [ 596.396164][ T6069] usb 10-1: config 253 has no interface number 0 [ 596.721647][ T6069] usb 10-1: config 253 interface 130 has no altsetting 0 [ 596.740680][ T6069] usb 10-1: New USB device found, idVendor=1e59, idProduct=0002, bcdDevice=98.ed [ 596.768853][ T6069] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.805040][ T6069] usb 10-1: Product: syz [ 596.819132][ T6069] usb 10-1: Manufacturer: syz [ 596.823896][ T6069] usb 10-1: SerialNumber: syz [ 598.631245][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 602.079063][ T6069] dvb-usb: found a 'EvolutePC TVWay+' in cold state, will try to load a firmware [ 602.156584][ T6069] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 602.190873][ T6069] dib0700: firmware download failed at 7 with -22 [ 604.132931][T11163] syz.2.1675 (11163) used greatest stack depth: 17744 bytes left [ 604.648367][ T4326] usb 10-1: USB disconnect, device number 2 [ 606.131705][T11461] netlink: 'syz.2.1749': attribute type 4 has an invalid length. [ 606.468527][T11471] bond0 speed is unknown, defaulting to 1000 [ 607.512492][T11479] loop9: detected capacity change from 0 to 4096 [ 608.149484][T11479] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 608.358183][T11494] loop6: detected capacity change from 0 to 512 [ 608.497297][T11494] FAT-fs (loop6): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 609.509096][T11351] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 609.599139][T11494] FAT-fs (loop6): Filesystem has been set read-only [ 609.749166][T11351] usb 10-1: Using ep0 maxpacket: 32 [ 609.767819][T11351] usb 10-1: config index 0 descriptor too short (expected 29220, got 36) [ 609.827297][T11351] usb 10-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 609.883803][T11351] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 609.912194][T11351] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 609.948051][T11351] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 609.989035][T11512] loop6: detected capacity change from 0 to 2048 [ 609.991154][T11351] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 610.019201][T11516] futex_wake_op: syz.8.1762 tries to shift op by 144; fix this program [ 610.039306][T11351] usb 10-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 610.065687][T11351] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.121122][T11351] usb 10-1: config 0 descriptor?? [ 610.139490][T11512] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 610.293783][T11351] usblp 10-1:0.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 610.323314][T11351] usb 10-1: USB disconnect, device number 3 [ 610.395288][T11351] usblp0: removed [ 610.431429][T10929] EXT4-fs (loop9): unmounting filesystem. [ 610.572034][ T7957] EXT4-fs (loop6): unmounting filesystem. [ 611.335385][T11537] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1778'. [ 613.169230][T11555] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1771'. [ 613.179395][T11557] EXT4-fs warning (device sda1): verify_group_input:175: Bad blocks count 0 [ 613.222137][T11551] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1767'. [ 613.254431][T11552] loop6: detected capacity change from 0 to 512 [ 613.434514][T11555] bridge1: port 1(veth1) entered blocking state [ 613.449356][T11555] bridge1: port 1(veth1) entered disabled state [ 613.467073][T11552] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 613.512047][T11555] device veth1 entered promiscuous mode [ 613.608395][T11559] bridge1: port 2(veth0_to_bond) entered blocking state [ 613.638413][T11559] bridge1: port 2(veth0_to_bond) entered disabled state [ 613.675289][T11559] device veth0_to_bond entered promiscuous mode [ 613.703520][T11569] loop9: detected capacity change from 0 to 512 [ 613.737747][T11564] bridge1: port 3(veth5) entered blocking state [ 613.765144][T11564] bridge1: port 3(veth5) entered disabled state [ 613.781625][T11569] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 613.800668][T11569] ext4 filesystem being mounted at /10/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 613.818782][T11564] device veth5 entered promiscuous mode [ 614.312581][T10929] EXT4-fs (loop9): unmounting filesystem. [ 616.859511][T11608] loop6: detected capacity change from 0 to 128 [ 618.136065][T11617] ip_tables: iptables: counters copy to user failed while replacing table [ 619.451595][ T4283] Bluetooth: hci0: unexpected event 0x03 length: 1 < 11 [ 619.547277][T11636] tipc: Started in network mode [ 619.569955][T11636] tipc: Node identity a21dc18f8b41, cluster identity 4711 [ 619.577531][T11636] tipc: Enabled bearer , priority 0 [ 619.589481][T11638] device syzkaller0 entered promiscuous mode [ 619.611552][T11630] bond0 speed is unknown, defaulting to 1000 [ 619.638581][T11636] tipc: Resetting bearer [ 619.661103][T11634] tipc: Resetting bearer [ 619.708134][T11634] tipc: Disabling bearer [ 622.187575][ T26] audit: type=1800 audit(2000000233.010:451): pid=11656 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1797" name="bus" dev="ramfs" ino=60626 res=0 errno=0 [ 623.597612][T11687] netlink: 'syz.4.1807': attribute type 1 has an invalid length. [ 624.373421][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.379933][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.587913][T11696] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1807'. [ 624.610219][T11696] 8021q: adding VLAN 0 to HW filter on device bond11 [ 624.677034][T11700] 8021q: adding VLAN 0 to HW filter on device bond11 [ 624.760751][T11700] bond11: (slave geneve3): Error -99 calling set_mac_address [ 624.859060][T11703] futex_wake_op: syz.2.1811 tries to shift op by 144; fix this program [ 624.924925][T11703] syz.2.1811 sent an empty control message without MSG_MORE. [ 626.090088][T11725] input: syz0 as /devices/virtual/input/input13 [ 631.350335][T11767] netlink: 'syz.8.1825': attribute type 1 has an invalid length. [ 632.286001][T10940] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 632.767940][T11788] nftables ruleset with unbound set [ 632.767938][T11789] ptrace attach of "ci2-linux-6-1-kasan/syz-executor exec"[7957] was attempted by "ci2-linux-6-1-kasan/syz-executor exec"[11789] [ 632.804053][T11767] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1825'. [ 632.839951][T10940] usb 10-1: config 0 has an invalid interface number: 11 but max is 0 [ 632.865142][T10940] usb 10-1: config 0 has no interface number 0 [ 632.873757][T11767] 8021q: adding VLAN 0 to HW filter on device bond1 [ 632.880628][T10940] usb 10-1: config 0 interface 11 altsetting 253 endpoint 0x7 has an invalid bInterval 129, changing to 11 [ 632.923584][T10940] usb 10-1: config 0 interface 11 altsetting 253 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 632.973267][T10940] usb 10-1: config 0 interface 11 altsetting 253 endpoint 0x87 has invalid wMaxPacketSize 0 [ 633.026950][T10940] usb 10-1: config 0 interface 11 has no altsetting 0 [ 633.055072][T10940] usb 10-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 633.098009][T10940] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.142534][T10940] usb 10-1: config 0 descriptor?? [ 633.284749][T10940] keyspan 10-1:0.11: Keyspan 2 port adapter converter detected [ 633.297312][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 81 [ 633.305339][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 82 [ 633.313466][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 1 [ 633.323132][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 2 [ 633.349328][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 85 [ 633.357277][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 5 [ 633.425816][T10940] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 633.455624][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 83 [ 633.515240][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 84 [ 633.564957][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 3 [ 633.597336][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 4 [ 633.634086][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 86 [ 633.654417][T10940] keyspan 10-1:0.11: found no endpoint descriptor for endpoint 6 [ 633.684493][T10940] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 633.833224][T10940] usb 10-1: USB disconnect, device number 4 [ 633.870759][T10940] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 633.900578][T10940] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 633.938015][T10940] keyspan 10-1:0.11: device disconnected [ 633.993342][T11770] 8021q: adding VLAN 0 to HW filter on device bond1 [ 634.048064][T11770] bond1: (slave geneve2): Error -99 calling set_mac_address [ 634.311991][T11817] MPTCP: kernel_bind error, err=-98 [ 634.390148][T11819] device syzkaller0 entered promiscuous mode [ 636.812552][T11844] tipc: Enabling of bearer rejected, failed to enable media [ 637.599615][T11859] No such timeout policy "syz1" [ 637.981469][T11865] futex_wake_op: syz.9.1844 tries to shift op by 144; fix this program [ 638.107535][T11866] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 638.175009][T11866] overlayfs: failed to resolve './file1/file0': -2 [ 639.384000][T11886] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1850'. [ 642.578427][T11911] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1855'. [ 643.286847][T11938] 8021q: adding VLAN 0 to HW filter on device bond0 [ 643.316222][T11938] 8021q: adding VLAN 0 to HW filter on device team0 [ 643.366260][T11938] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 644.745691][T11962] tipc: Enabling of bearer rejected, failed to enable media [ 646.276286][T11988] 8021q: VLANs not supported on gre0 [ 646.509625][T11988] af_packet: tpacket_rcv: packet too big, clamped from 100 to 4294967272. macoff=96 [ 648.317786][ T26] audit: type=1800 audit(2000000259.140:452): pid=11993 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1871" name="bus" dev="ramfs" ino=61616 res=0 errno=0 [ 648.785395][T12005] loop9: detected capacity change from 0 to 128 [ 649.724382][T12017] loop6: detected capacity change from 0 to 256 [ 649.732038][T12017] FAT-fs (loop6): Unrecognized mount option "shortname=winmt" or missing value [ 650.350832][T12006] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 650.402082][T12014] loop6: detected capacity change from 0 to 512 [ 650.464830][T12014] EXT4-fs error (device loop6): ext4_xattr_inode_iget:401: comm syz.6.1877: inode #1: comm syz.6.1877: iget: illegal inode # [ 650.482425][T12014] EXT4-fs error (device loop6): ext4_xattr_inode_iget:406: comm syz.6.1877: error while reading EA inode 1 err=-117 [ 650.495780][T12014] EXT4-fs (loop6): 1 orphan inode deleted [ 650.501694][T12014] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 650.868613][T12031] __vm_enough_memory: pid: 12031, comm: syz.9.1879, no enough memory for the allocation [ 651.186569][ T7957] EXT4-fs (loop6): unmounting filesystem. [ 651.989236][ T4276] Bluetooth: hci1: command 0x0406 tx timeout [ 652.808859][T12049] tipc: Enabling of bearer rejected, failed to enable media [ 653.010221][T12038] jffs2: notice: (12038) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 653.881822][T12038] jffs2: fork failed for JFFS2 garbage collect thread: 4 [ 656.535788][T12097] netlink: 'syz.4.1894': attribute type 1 has an invalid length. [ 656.717143][T12098] 8021q: adding VLAN 0 to HW filter on device bond13 [ 656.774468][T12098] bond12: (slave bond13): making interface the new active one [ 656.814526][T12098] bond12: (slave bond13): Enslaving as an active interface with an up link [ 656.949402][T12100] bond12: (slave gretap1): Enslaving as a backup interface with an up link [ 663.432357][T12159] __vm_enough_memory: pid: 12159, comm: syz.2.1906, no enough memory for the allocation [ 664.621167][T12167] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 664.834250][T12181] "syz.6.1910" (12181) uses obsolete ecb(arc4) skcipher [ 665.189135][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 667.353545][T12206] __vm_enough_memory: pid: 12206, comm: syz.8.1919, no enough memory for the allocation [ 668.296117][T12214] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 672.675402][T12255] __vm_enough_memory: pid: 12255, comm: syz.6.1931, no enough memory for the allocation [ 674.377463][T12274] loop9: detected capacity change from 0 to 128 [ 674.565616][T12274] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 674.626830][T12274] ext4 filesystem being mounted at /48/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 677.046563][T10929] EXT4-fs (loop9): unmounting filesystem. [ 678.452896][T12324] device syzkaller0 entered promiscuous mode [ 678.851578][T12332] IPv6: ADDRCONF(NETDEV_CHANGE): eql: link becomes ready [ 678.898821][T12332] IPv6: ADDRCONF(NETDEV_CHANGE): wpan0: link becomes ready [ 678.920585][T12332] IPv6: ADDRCONF(NETDEV_CHANGE): wpan1: link becomes ready [ 678.937146][T12332] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 681.327606][T12355] "syz.9.1956" (12355) uses obsolete ecb(arc4) skcipher [ 683.750852][ T4276] Bluetooth: hci5: command 0x0406 tx timeout [ 684.095402][T12389] netlink: 'syz.6.1965': attribute type 4 has an invalid length. [ 685.830766][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.839098][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.748810][T12418] loop9: detected capacity change from 0 to 256 [ 687.574327][T12418] exFAT-fs (loop9): failed to load upcase table (idx : 0x00011a39, chksum : 0xd4e5c97b, utbl_chksum : 0xe619d30d) [ 688.253148][T12430] IPVS: dh: FWM 3 0x00000003 - no destination available [ 696.926572][T12500] jffs2: notice: (12500) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 698.456358][T12518] bond0 speed is unknown, defaulting to 1000 [ 701.241228][T12549] jffs2: notice: (12549) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 702.681691][T12549] jffs2: fork failed for JFFS2 garbage collect thread: 4 [ 704.236162][ T4283] Bluetooth: hci1: hcon ffff888032bf8000 sent 1 < count 1025 [ 704.987372][T12584] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2003'. [ 704.998785][T12584] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2003'. [ 705.008147][T12584] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2003'. [ 705.019240][T12584] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2003'. [ 705.028433][T12584] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2003'. [ 705.338498][T12586] loop9: detected capacity change from 0 to 128 [ 713.495842][T12649] netlink: 'syz.8.2022': attribute type 1 has an invalid length. [ 713.696337][T12649] bond2: (slave bridge1): making interface the new active one [ 713.751279][T12649] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 714.238350][T12671] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2018'. [ 714.251081][T12671] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2018'. [ 714.261600][T12671] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2018'. [ 714.274434][T12671] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2018'. [ 714.658330][T12671] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2018'. [ 715.851180][T12669] tipc: Started in network mode [ 715.868419][T12669] tipc: Node identity ac1414aa, cluster identity 4711 [ 715.930336][T12669] tipc: New replicast peer: 172.20.20.187 [ 715.948426][T12669] tipc: Enabled bearer , priority 10 [ 716.659767][T12686] ip_tables: iptables: counters copy to user failed while replacing table [ 717.126781][T12687] loop6: detected capacity change from 0 to 32768 [ 717.152267][ T4326] tipc: Node number set to 2886997162 [ 717.569181][T12694] netlink: 2 bytes leftover after parsing attributes in process `syz.8.2039'. [ 721.462769][T12737] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2036'. [ 722.062329][T12744] device syzkaller0 entered promiscuous mode [ 722.070856][T12742] overlayfs: failed to clone upperpath [ 722.119391][T12748] netlink: 'syz.2.2042': attribute type 1 has an invalid length. [ 722.196589][T12748] 8021q: adding VLAN 0 to HW filter on device bond4 [ 722.277144][T12750] device veth0_to_bond left promiscuous mode [ 722.286532][T12750] bridge1: port 2(veth0_to_bond) entered disabled state [ 722.444475][T12750] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 722.464024][ T6250] IPv6: ADDRCONF(NETDEV_CHANGE): bond4: link becomes ready [ 722.495937][T12753] device bridge2 entered promiscuous mode [ 722.624433][T12753] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 723.128615][T12759] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 723.138158][T12759] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 723.147909][T12759] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 723.169459][ T26] audit: type=1800 audit(2000000333.950:453): pid=12759 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.2038" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 729.587378][ T4696] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 730.625199][T12835] loop6: detected capacity change from 0 to 8 [ 730.641053][T12835] SQUASHFS error: lzo decompression failed, data probably corrupt [ 730.649225][T12835] SQUASHFS error: Failed to read block 0x91: -5 [ 730.655654][T12835] SQUASHFS error: Unable to read metadata cache entry [8f] [ 730.663105][T12835] SQUASHFS error: Unable to read inode 0x11f [ 730.739270][T12836] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 731.001922][T12839] loop9: detected capacity change from 0 to 512 [ 731.121192][T12839] EXT4-fs error (device loop9): ext4_xattr_inode_iget:401: inode #2: comm syz.9.2063: missing EA_INODE flag [ 731.213329][T12839] EXT4-fs error (device loop9): ext4_xattr_inode_iget:406: comm syz.9.2063: error while reading EA inode 2 err=-117 [ 731.319628][T12839] EXT4-fs (loop9): 1 orphan inode deleted [ 731.325455][T12839] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 733.155138][T12872] netlink: 'syz.2.2068': attribute type 1 has an invalid length. [ 733.267707][T12874] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 733.328085][T12874] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 733.367634][T12874] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 733.408822][T12874] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 733.468644][T12874] bond5: (slave geneve2): making interface the new active one [ 733.525817][T12874] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 733.575301][T12872] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2068'. [ 733.626165][T12872] 8021q: adding VLAN 0 to HW filter on device bond5 [ 734.678472][T10929] EXT4-fs (loop9): unmounting filesystem. [ 735.453022][T12893] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2074'. [ 736.076007][T12901] tipc: Enabling of bearer rejected, failed to enable media [ 737.580434][T12919] loop6: detected capacity change from 0 to 512 [ 737.597913][T12916] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 737.694155][T12916] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 737.721058][T12919] EXT4-fs error (device loop6): ext4_xattr_inode_iget:401: inode #2: comm syz.6.2080: missing EA_INODE flag [ 738.035167][T12919] EXT4-fs error (device loop6): ext4_xattr_inode_iget:406: comm syz.6.2080: error while reading EA inode 2 err=-117 [ 738.366595][T12919] EXT4-fs (loop6): 1 orphan inode deleted [ 738.419255][T12919] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 739.177525][T12937] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2072'. [ 739.355165][ T7957] EXT4-fs (loop6): unmounting filesystem. [ 740.661563][T12956] syz.2.2086 (12956) used greatest stack depth: 16848 bytes left [ 747.192287][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.198658][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.861714][T13007] overlayfs: failed to clone lowerpath [ 748.704702][T13015] netlink: 'syz.4.2102': attribute type 1 has an invalid length. [ 749.417219][T13015] 8021q: adding VLAN 0 to HW filter on device bond14 [ 749.426205][T13021] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 749.436039][T13021] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 749.446086][T13021] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 749.622020][T13025] device bridge4 entered promiscuous mode [ 749.659838][T13025] bond14: (slave bridge4): Enslaving as an active interface with an up link [ 749.670390][ T9046] IPv6: ADDRCONF(NETDEV_CHANGE): bond14: link becomes ready [ 752.426578][T13054] ip_tables: iptables: counters copy to user failed while replacing table [ 753.873849][T13075] device lo left promiscuous mode [ 753.879568][T13075] device tunl0 left promiscuous mode [ 753.885429][T13075] device gre0 left promiscuous mode [ 753.891265][T13075] device gretap0 left promiscuous mode [ 753.897301][T13075] device erspan0 left promiscuous mode [ 753.903383][T13075] device ip_vti0 left promiscuous mode [ 753.909462][T13075] device ip6_vti0 left promiscuous mode [ 753.915592][T13075] device sit0 left promiscuous mode [ 753.921403][T13075] device ip6tnl0 left promiscuous mode [ 753.927466][T13075] device ip6gre0 left promiscuous mode [ 753.933507][T13075] device syz_tun left promiscuous mode [ 753.939560][T13075] device ip6gretap0 left promiscuous mode [ 753.945842][T13075] device bridge0 left promiscuous mode [ 753.952410][T13075] device vcan0 left promiscuous mode [ 753.958271][T13075] device bond0 left promiscuous mode [ 753.964828][T13075] device team0 left promiscuous mode [ 753.971980][T13075] device dummy0 left promiscuous mode [ 753.977925][T13075] device nlmon0 left promiscuous mode [ 754.719201][T13075] device caif0 left promiscuous mode [ 754.724574][T13075] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 756.191775][T13096] RDS: rds_bind could not find a transport for fec0:ffff:ffff:ffff::1, load rds_tcp or rds_rdma? [ 758.376972][T13115] device dummy0 entered promiscuous mode [ 758.438238][T13115] device vlan2 entered promiscuous mode [ 758.916116][T13129] ip_tables: iptables: counters copy to user failed while replacing table [ 760.653642][T13152] sctp: [Deprecated]: syz.8.2126 (pid 13152) Use of struct sctp_assoc_value in delayed_ack socket option. [ 760.653642][T13152] Use struct sctp_sack_info instead [ 761.105429][T13162] netlink: 48 bytes leftover after parsing attributes in process `syz.9.2127'. [ 761.759916][T13166] overlayfs: failed to clone lowerpath [ 764.174423][ T6240] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 765.174701][T13203] sctp: [Deprecated]: syz.6.2118 (pid 13203) Use of int in max_burst socket option. [ 765.174701][T13203] Use struct sctp_assoc_value instead [ 766.975101][ T6240] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.400433][T13217] loop9: detected capacity change from 0 to 2048 [ 767.455252][T13217] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 767.973861][ T6240] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.694953][ T6240] bond0: (slave netdevsim0): Releasing backup interface [ 769.015445][ T6240] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 778.697047][T13343] Console: switching to colour VGA+ 80x25 [ 778.794994][T13343] Console: switching to colour frame buffer device 128x48 [ 778.975706][ T6240] device gretap0 left promiscuous mode [ 780.642860][T13371] loop9: detected capacity change from 0 to 64 [ 780.905870][T13371] MINIX-fs: mounting unchecked file system, running fsck is recommended [ 783.286929][T13391] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2173'. [ 783.387036][T13395] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2178'. [ 784.530504][T13410] 9pnet_virtio: no channels available for device 127.0.0.1 [ 786.926202][ T6240] device bond0 left promiscuous mode [ 786.939052][ T6240] device bond_slave_1 left promiscuous mode [ 787.181179][ T6240] device dummy0 left promiscuous mode [ 787.187304][ T6240] bridge0: port 1(dummy0) entered disabled state [ 787.231054][ T6240] device hsr_slave_0 left promiscuous mode [ 787.239446][ T6240] device hsr_slave_1 left promiscuous mode [ 787.997784][T13441] loop9: detected capacity change from 0 to 512 [ 789.671041][ T4283] Bluetooth: hci5: unknown advertising packet type: 0x30 [ 789.671118][ T4283] Bluetooth: hci5: unknown advertising packet type: 0x74 [ 789.686618][T13440] FAT-fs (loop9): error, corrupted directory (invalid entries) [ 789.702950][ T4283] Bluetooth: hci5: unknown advertising packet type: 0x69 [ 789.702979][ T4283] Bluetooth: hci5: unknown advertising packet type: 0x66 [ 789.710266][ T4283] Bluetooth: hci5: unknown advertising packet type: 0x65 [ 789.718503][ T4283] Bluetooth: hci5: unknown advertising packet type: 0x5f [ 789.725945][ T4283] Bluetooth: hci5: unknown advertising packet type: 0x30 [ 789.786366][ T6240] device veth0_vlan left promiscuous mode [ 790.034517][ T6240] bond4 (unregistering): (slave vlan2): Releasing active interface [ 790.057358][ T6240] bond4 (unregistering): Released all slaves [ 792.724131][ T6240] bond1 (unregistering): (slave bond3): Releasing backup interface [ 792.734587][ T6240] bond3 (unregistering): Released all slaves [ 793.073156][ T6240] bond1 (unregistering): (slave bond2): Releasing backup interface [ 793.087497][ T6240] bond2 (unregistering): Released all slaves [ 793.104056][ T6240] bond1 (unregistering): Released all slaves [ 793.110466][ T4326] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 793.959700][ T4326] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 793.970366][ T4326] usb 10-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 793.982303][ T4326] usb 10-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 794.009460][ T4326] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.017616][ T4326] usb 10-1: Product: syz [ 794.022695][ T4326] usb 10-1: Manufacturer: syz [ 794.027749][ T4326] usb 10-1: SerialNumber: syz [ 794.535964][ T4326] usb 10-1: 0:2 : does not exist [ 794.555232][ T4326] usb 10-1: unknown interface protocol 0x1, assuming v1 [ 794.562908][ T4326] usb 10-1: cannot find UAC_HEADER [ 795.057835][ T4326] snd-usb-audio: probe of 10-1:1.1 failed with error -22 [ 795.236250][ T4326] usb 10-1: USB disconnect, device number 5 [ 796.623474][ T6240] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 796.632723][ T7] infiniband syz1: ib_query_port failed (-19) [ 798.322365][ T6240] bond0 (unregistering): Released all slaves [ 798.432164][ T6240] smc: removing net device lo with user defined pnetid SYZ0 [ 798.448068][T13445] tipc: Enabling of bearer rejected, failed to enable media [ 798.467239][T11351] bond0 speed is unknown, defaulting to 1000 [ 798.474206][T13455] netlink: 12030 bytes leftover after parsing attributes in process `syz.6.2192'. [ 804.980805][T13602] Bluetooth: MGMT ver 1.22 [ 805.105147][T13609] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2220'. [ 806.176702][T13634] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2224'. [ 806.876969][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.884355][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.891188][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.897963][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.904782][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.911609][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.918413][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.925224][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.932064][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.938974][T13637] tc action pedit offset must be on 32 bit boundaries [ 806.945775][T13637] 0: reclassify loop, rule prio 0, protocol 800 [ 808.762081][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.782540][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 813.229595][T13708] netlink: 104 bytes leftover after parsing attributes in process `syz.9.2240'. [ 817.344800][T13759] loop6: detected capacity change from 0 to 512 [ 818.052011][T13759] EXT4-fs: Ignoring removed nomblk_io_submit option [ 818.158972][T13759] EXT4-fs (loop6): can't mount with both data=journal and delalloc [ 818.991528][T13770] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 819.541358][T13766] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2256'. [ 819.660760][T13772] RDS: rds_bind could not find a transport for fec0:ffff:ffff:ffff::1, load rds_tcp or rds_rdma? [ 820.940061][ T4283] Bluetooth: hci3: unknown advertising packet type: 0x30 [ 820.940139][ T4283] Bluetooth: hci3: unknown advertising packet type: 0x74 [ 820.947782][ T4283] Bluetooth: hci3: unknown advertising packet type: 0x69 [ 820.958567][ T4283] Bluetooth: hci3: unknown advertising packet type: 0x66 [ 820.966232][ T4283] Bluetooth: hci3: unknown advertising packet type: 0x65 [ 820.976035][ T4283] Bluetooth: hci3: unknown advertising packet type: 0x5f [ 820.983943][ T4283] Bluetooth: hci3: unknown advertising packet type: 0x30 [ 822.000875][ T4283] Bluetooth: hci1: unexpected cc 0x042d length: 63 > 7 [ 826.129072][ T4283] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 826.138372][ T4283] Bluetooth: hci1: Injecting HCI hardware error event [ 826.148260][ T4283] Bluetooth: hci1: hardware error 0x00 [ 827.577522][T13860] device bond6 entered promiscuous mode [ 829.270909][T13874] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 829.379186][ T4283] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 829.923669][T13883] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2288'. [ 836.293680][T13927] sctp: [Deprecated]: syz.4.2290 (pid 13927) Use of struct sctp_assoc_value in delayed_ack socket option. [ 836.293680][T13927] Use struct sctp_sack_info instead [ 838.050269][T13935] 8021q: adding VLAN 0 to HW filter on device bond3 [ 838.796233][T13945] overlayfs: failed to clone lowerpath [ 847.087289][ T6247] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 847.110827][T14027] fuse: Unknown parameter 'åôK—ðX;3„®¤ uè"Í#v”~ó' [ 857.704085][ T26] audit: type=1326 audit(2000000468.520:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14113 comm="syz.2.2330" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe6bbb9e159 code=0x0 [ 861.168881][T14152] comedi comedi0: comedi_test: 1000000 microvolt, 100000 microsecond waveform attached [ 861.700062][T14162] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2337'. [ 867.809010][ T26] audit: type=1326 audit(2000000478.390:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14201 comm="syz.4.2347" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc22bf9e159 code=0x7ffc0000 [ 867.928040][ T26] audit: type=1326 audit(2000000478.390:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14201 comm="syz.4.2347" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc22bf9e159 code=0x7ffc0000 [ 868.076354][ T26] audit: type=1326 audit(2000000478.490:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14201 comm="syz.4.2347" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=132 compat=0 ip=0x7fc22bf9e159 code=0x7ffc0000 [ 868.373952][ T26] audit: type=1326 audit(2000000478.490:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14201 comm="syz.4.2347" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc22bf9e159 code=0x7ffc0000 [ 869.774134][ T26] audit: type=1326 audit(2000000478.490:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14201 comm="syz.4.2347" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc22bf9e159 code=0x7ffc0000 [ 869.774186][ T26] audit: type=1326 audit(2000000478.560:460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14201 comm="syz.4.2347" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7fc22bf9e159 code=0x7ffc0000 [ 869.774230][ T26] audit: type=1326 audit(2000000478.560:461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14201 comm="syz.4.2347" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc22bf9e159 code=0x7ffc0000 [ 869.774271][ T26] audit: type=1326 audit(2000000478.560:462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14201 comm="syz.4.2347" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc22bf9e159 code=0x7ffc0000 [ 869.991849][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.991992][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.661177][T14226] sd 0:0:1:0: PR command failed: 1026 [ 870.666870][T14226] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 870.673934][T14226] sd 0:0:1:0: Add. Sense: Invalid command operation code PÚÿÿÿ-D devtmpfs./dev/console[ 875.533845][T14264] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 876.359168][T14264] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 876.368555][T14264] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 876.378699][ T4276] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 876.386643][T14264] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 876.394641][T14264] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 878.036423][ T4331] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 878.671711][ T4283] Bluetooth: hci2: command 0x0409 tx timeout [ 879.199475][T14296] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2363'. [ 879.229310][T14296] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2363'. [ 879.273329][T14296] device geneve2 entered promiscuous mode [ 880.762176][T14264] Bluetooth: hci2: command 0x041b tx timeout [ 881.121807][ T4331] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.800114][T14264] Bluetooth: hci2: command 0x040f tx timeout [ 883.943254][ T4331] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 884.878290][T14264] Bluetooth: hci2: command 0x0419 tx timeout [ 885.224589][ T4331] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.630732][T14370] loop6: detected capacity change from 0 to 512 [ 890.254711][ T26] audit: type=1326 audit(2000000501.080:463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14368 comm="syz.2.2378" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6bbb9e159 code=0x7ffc0000 [ 890.282428][T14261] chnl_net:caif_netlink_parms(): no params data found [ 890.442731][ T26] audit: type=1326 audit(2000000501.110:464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14368 comm="syz.2.2378" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6bbb9e159 code=0x7ffc0000 [ 890.556096][ T26] audit: type=1326 audit(2000000501.230:465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14368 comm="syz.2.2378" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fe6bbb9e159 code=0x7ffc0000 [ 890.820313][ T4331] tipc: Left network mode [ 891.341782][T14261] bridge0: port 1(bridge_slave_0) entered blocking state [ 891.540985][T14261] bridge0: port 1(bridge_slave_0) entered disabled state [ 891.553718][T14261] device bridge_slave_0 entered promiscuous mode [ 891.562885][T14261] bridge0: port 2(bridge_slave_1) entered blocking state [ 891.589027][T14261] bridge0: port 2(bridge_slave_1) entered disabled state [ 891.619234][T14261] device bridge_slave_1 entered promiscuous mode [ 892.850848][T14410] overlayfs: failed to resolve './file1/file0': -2 [ 893.069926][T14261] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 894.143386][T14261] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 894.332558][T14437] loop6: detected capacity change from 0 to 1024 [ 894.975524][T14437] EXT4-fs: Invalid want_extra_isize 7 [ 895.022104][T14261] team0: Port device team_slave_0 added [ 895.030868][T14261] team0: Port device team_slave_1 added [ 897.592098][T14261] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 897.610067][T14261] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 898.735410][T14261] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 898.959876][T14261] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 898.966986][T14261] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 899.120460][T14261] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 899.835584][T14261] device hsr_slave_0 entered promiscuous mode [ 899.886575][T14261] device hsr_slave_1 entered promiscuous mode [ 899.935749][T14481] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2397'. [ 899.958684][T14481] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2397'. [ 900.040063][T14481] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 900.101400][T14481] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 900.177184][T14481] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 900.246702][T14481] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 900.310757][T14481] device geneve2 entered promiscuous mode [ 900.389757][T14481] IPv6: ADDRCONF(NETDEV_CHANGE): geneve2: link becomes ready [ 902.049283][T14501] sctp: [Deprecated]: syz.8.2401 (pid 14501) Use of int in max_burst socket option. [ 902.049283][T14501] Use struct sctp_assoc_value instead PÚÿÿÿ-D devtmpfs./dev/console[ 909.904804][T14574] loop6: detected capacity change from 0 to 164 [ 910.129661][ T4331] ------------[ cut here ]------------ [ 910.136054][ T4331] WARNING: CPU: 1 PID: 4331 at net/mac80211/chan.c:2017 ieee80211_link_release_channel+0x150/0x180 [ 910.147222][ T4331] Modules linked in: [ 910.151343][ T4331] CPU: 1 PID: 4331 Comm: kworker/u4:6 Not tainted syzkaller #0 [ 910.158969][ T4331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 910.169139][ T4331] Workqueue: netns cleanup_net [ 910.173983][ T4331] RIP: 0010:ieee80211_link_release_channel+0x150/0x180 [ 910.180944][ T4331] Code: 7c 2d 00 00 74 08 48 89 df e8 0c 17 19 f8 bf 18 1e 00 00 48 03 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 15 19 81 00 e8 30 d2 c7 f7 <0f> 0b eb c5 48 c7 c1 24 e9 20 8e 80 e1 07 80 c1 03 38 c1 0f 8c 51 [ 910.200665][ T4331] RSP: 0018:ffffc900040776e8 EFLAGS: 00010293 [ 910.206794][ T4331] RAX: ffffffff89ba60b0 RBX: ffff8880632a95a8 RCX: ffff88802d39da00 [ 910.214873][ T4331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 910.222944][ T4331] RBP: 0000000000000000 R08: ffffffff8e20b46f R09: 1ffffffff1c4168d [ 910.231101][ T4331] R10: dffffc0000000000 R11: fffffbfff1c4168e R12: ffff8880632aaab0 [ 910.239170][ T4331] R13: 1ffff1100c6552b5 R14: ffff8880632aa228 R15: dffffc0000000000 [ 910.247200][ T4331] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 910.256237][ T4331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 910.262931][ T4331] CR2: 00007f16c85f38ac CR3: 000000005de84000 CR4: 00000000003506e0 [ 910.271024][ T4331] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 910.279092][ T4331] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 910.287119][ T4331] Call Trace: [ 910.290489][ T4331] [ 910.293461][ T4331] ? trace_drv_return_void+0x240/0x240 [ 910.299105][ T4331] unregister_netdevice_many_notify+0x13c4/0x1990 [ 910.305591][ T4331] ? unregister_netdevice_many+0x20/0x20 [ 910.311350][ T4331] ? mutex_unlock+0x10/0x10 [ 910.315929][ T4331] ? unregister_netdevice_queue+0x17c/0x330 [ 910.321923][ T4331] ? list_netdevice+0x640/0x640 [ 910.326845][ T4331] ? ieee80211_txq_teardown_flows+0x15c/0x220 [ 910.333007][ T4331] ? cfg80211_shutdown_all_interfaces+0x173/0x1c0 [ 910.339519][ T4331] ieee80211_remove_interfaces+0x44b/0x700 [ 910.345377][ T4331] ? ieee80211_unregister_hw+0x51/0x290 [ 910.351023][ T4331] ? ieee80211_do_stop+0x2020/0x2020 [ 910.356376][ T4331] ? atomic_notifier_chain_unregister+0xf1/0x100 [ 910.362821][ T4331] ieee80211_unregister_hw+0x59/0x290 [ 910.368255][ T4331] mac80211_hwsim_del_radio+0x285/0x480 [ 910.373908][ T4331] ? rhashtable_remove_fast+0xc50/0xc50 [ 910.379563][ T4331] hwsim_exit_net+0x589/0x650 [ 910.384295][ T4331] ? hwsim_init_net+0x80/0x80 [ 910.389062][ T4331] ? __ip_vs_dev_cleanup_batch+0x234/0x250 [ 910.395022][ T4331] cleanup_net+0x703/0xba0 [ 910.399569][ T4331] ? ops_free_list+0x3b0/0x3b0 [ 910.404488][ T4331] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 910.410514][ T4331] ? _raw_spin_unlock+0x40/0x40 [ 910.415446][ T4331] ? _raw_spin_unlock_irq+0x1f/0x40 [ 910.420751][ T4331] ? process_one_work+0x7b4/0x1160 [ 910.425936][ T4331] process_one_work+0x8ab/0x1160 [ 910.431020][ T4331] ? worker_detach_from_pool+0x240/0x240 [ 910.436819][ T4331] ? _raw_spin_lock_irq+0xb7/0xf0 [ 910.441982][ T4331] ? _raw_spin_lock_irqsave+0x100/0x100 [ 910.447628][ T4331] ? wq_worker_running+0x97/0x190 [ 910.452769][ T4331] worker_thread+0xaf5/0x12a0 [ 910.457538][ T4331] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 910.463579][ T4331] kthread+0x29d/0x330 [ 910.467703][ T4331] ? worker_clr_flags+0x1a0/0x1a0 [ 910.472859][ T4331] ? kthread_blkcg+0xd0/0xd0 [ 910.477517][ T4331] ret_from_fork+0x1f/0x30 [ 910.482086][ T4331] [ 910.485161][ T4331] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 910.492475][ T4331] CPU: 1 PID: 4331 Comm: kworker/u4:6 Not tainted syzkaller #0 [ 910.500067][ T4331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 910.510161][ T4331] Workqueue: netns cleanup_net [ 910.514970][ T4331] Call Trace: [ 910.518272][ T4331] [ 910.521228][ T4331] dump_stack_lvl+0x188/0x24e [ 910.525957][ T4331] ? memcpy+0x3c/0x60 [ 910.529962][ T4331] ? show_regs_print_info+0x12/0x12 [ 910.535204][ T4331] ? load_image+0x410/0x410 [ 910.539745][ T4331] panic+0x2d3/0x710 [ 910.543757][ T4331] ? bpf_jit_dump+0xd0/0xd0 [ 910.548302][ T4331] ? ret_from_fork+0x1f/0x30 [ 910.553030][ T4331] __warn+0x2f8/0x4f0 [ 910.557036][ T4331] ? ieee80211_link_release_channel+0x150/0x180 [ 910.563304][ T4331] ? ieee80211_link_release_channel+0x150/0x180 [ 910.569653][ T4331] report_bug+0x2ba/0x4f0 [ 910.574011][ T4331] ? ieee80211_link_release_channel+0x150/0x180 [ 910.580369][ T4331] handle_bug+0x3a/0x70 [ 910.584549][ T4331] exc_invalid_op+0x16/0x40 [ 910.589084][ T4331] asm_exc_invalid_op+0x16/0x20 [ 910.593963][ T4331] RIP: 0010:ieee80211_link_release_channel+0x150/0x180 [ 910.600844][ T4331] Code: 7c 2d 00 00 74 08 48 89 df e8 0c 17 19 f8 bf 18 1e 00 00 48 03 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 15 19 81 00 e8 30 d2 c7 f7 <0f> 0b eb c5 48 c7 c1 24 e9 20 8e 80 e1 07 80 c1 03 38 c1 0f 8c 51 [ 910.620472][ T4331] RSP: 0018:ffffc900040776e8 EFLAGS: 00010293 [ 910.626568][ T4331] RAX: ffffffff89ba60b0 RBX: ffff8880632a95a8 RCX: ffff88802d39da00 [ 910.634669][ T4331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 910.642926][ T4331] RBP: 0000000000000000 R08: ffffffff8e20b46f R09: 1ffffffff1c4168d [ 910.650937][ T4331] R10: dffffc0000000000 R11: fffffbfff1c4168e R12: ffff8880632aaab0 [ 910.658933][ T4331] R13: 1ffff1100c6552b5 R14: ffff8880632aa228 R15: dffffc0000000000 [ 910.666940][ T4331] ? ieee80211_link_release_channel+0x150/0x180 [ 910.673216][ T4331] ? ieee80211_link_release_channel+0x150/0x180 [ 910.679477][ T4331] ? trace_drv_return_void+0x240/0x240 [ 910.684963][ T4331] unregister_netdevice_many_notify+0x13c4/0x1990 [ 910.691428][ T4331] ? unregister_netdevice_many+0x20/0x20 [ 910.697104][ T4331] ? mutex_unlock+0x10/0x10 [ 910.701641][ T4331] ? unregister_netdevice_queue+0x17c/0x330 [ 910.707573][ T4331] ? list_netdevice+0x640/0x640 [ 910.712453][ T4331] ? ieee80211_txq_teardown_flows+0x15c/0x220 [ 910.718656][ T4331] ? cfg80211_shutdown_all_interfaces+0x173/0x1c0 [ 910.725105][ T4331] ieee80211_remove_interfaces+0x44b/0x700 [ 910.730933][ T4331] ? ieee80211_unregister_hw+0x51/0x290 [ 910.736529][ T4331] ? ieee80211_do_stop+0x2020/0x2020 [ 910.741838][ T4331] ? atomic_notifier_chain_unregister+0xf1/0x100 [ 910.748542][ T4331] ieee80211_unregister_hw+0x59/0x290 [ 910.753944][ T4331] mac80211_hwsim_del_radio+0x285/0x480 [ 910.759535][ T4331] ? rhashtable_remove_fast+0xc50/0xc50 [ 910.765113][ T4331] hwsim_exit_net+0x589/0x650 [ 910.769839][ T4331] ? hwsim_init_net+0x80/0x80 [ 910.774553][ T4331] ? __ip_vs_dev_cleanup_batch+0x234/0x250 [ 910.780389][ T4331] cleanup_net+0x703/0xba0 [ 910.784841][ T4331] ? ops_free_list+0x3b0/0x3b0 [ 910.789637][ T4331] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 910.795575][ T4331] ? _raw_spin_unlock+0x40/0x40 [ 910.800466][ T4331] ? _raw_spin_unlock_irq+0x1f/0x40 [ 910.805696][ T4331] ? process_one_work+0x7b4/0x1160 [ 910.810834][ T4331] process_one_work+0x8ab/0x1160 [ 910.815815][ T4331] ? worker_detach_from_pool+0x240/0x240 [ 910.821483][ T4331] ? _raw_spin_lock_irq+0xb7/0xf0 [ 910.826538][ T4331] ? _raw_spin_lock_irqsave+0x100/0x100 [ 910.832128][ T4331] ? wq_worker_running+0x97/0x190 [ 910.837179][ T4331] worker_thread+0xaf5/0x12a0 [ 910.841893][ T4331] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 910.847819][ T4331] kthread+0x29d/0x330 [ 910.851912][ T4331] ? worker_clr_flags+0x1a0/0x1a0 [ 910.856954][ T4331] ? kthread_blkcg+0xd0/0xd0 [ 910.861563][ T4331] ret_from_fork+0x1f/0x30 [ 910.866119][ T4331] [ 910.869718][ T4331] Kernel Offset: disabled [ 910.874195][ T4331] Rebooting in 86400 seconds..