last executing test programs: 3m17.845657594s ago: executing program 1 (id=93): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x1000001, 0x4c032, 0xffffffffffffffff, 0x0) move_pages(0x0, 0x1, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], 0x0, &(0x7f0000000000), 0x0) 3m17.670320148s ago: executing program 1 (id=96): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="020e0000180000000000000000000000030005000000000002000000ac1e0001000000000000000003000600000000000200000000000000000000000000000004000400000000000000000000000000000000000000000000000000000000000800120000000200000000000000000006000000000000000000000000000000ff02000000000000000000000000000100000000000000000000000000000000040003"], 0xc0}}, 0x0) 3m17.339485751s ago: executing program 1 (id=100): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x2, 0xfffffdfc, &(0x7f0000000080)={0x77359400}, 0x0) 3m16.322224736s ago: executing program 1 (id=102): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 3m15.816409513s ago: executing program 1 (id=108): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x1000001, 0x4c032, 0xffffffffffffffff, 0x0) move_pages(0x0, 0x1, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], 0x0, &(0x7f0000000000), 0x0) 3m14.635705913s ago: executing program 1 (id=116): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002940)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r7, &(0x7f0000002900)={&(0x7f0000000340)=@xdp={0x2c, 0x8, r5, 0x109}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000280)='k', 0x14}], 0x1}, 0x20000885) 2m58.720384343s ago: executing program 32 (id=116): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002940)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r7, &(0x7f0000002900)={&(0x7f0000000340)=@xdp={0x2c, 0x8, r5, 0x109}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000280)='k', 0x14}], 0x1}, 0x20000885) 2m3.621784317s ago: executing program 5 (id=353): mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x301f, 0x1, 0x11, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x20, 0x10012, r1, 0x0) 2m3.181006705s ago: executing program 5 (id=356): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1ffffc, 0xb66, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r1) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3a}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80, 0x0, 0x1, 0x1}}) r3 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r4 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r3) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000940)={r4, 0x8d}, 0x0, &(0x7f0000000b80)="cb44032c2a3a518de9000000c11a536275a146d65e2988ef1a4992f9a2675b2853d82c107d0fd00990b531004a27f0395fdb7d3b545b60ff5be75bcb1d85878c1cbdb120730ded7b4d10b0612763631dd3db62ddf7f799a4257d4bf67e86244beee88b1e3e5bac3ad4dea44fc08db9f741b76996bf785368bc3b20816471f5254e6e9e7a9ccd90d32ebcf5ea2c", 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', r2, 0x0, 0x0, 0x0, 0x4, 0x8, @remote, @dev={0xfe, 0x80, '\x00', 0xe}, 0x0, 0x1, 0xfffffffe, 0x1}}) r5 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x138, 0x98, 0x138, 0x0, 0x0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x3}}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x9, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xa7ae6000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000900)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@union={0x2, 0x1, 0x0, 0x5, 0x0, 0xffe, [{0x1, 0x1}]}]}, {0x0, [0x2e]}}, &(0x7f0000000640)=""/192, 0x33, 0xc0, 0x1}, 0x28) 2m1.577062654s ago: executing program 5 (id=363): socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000180)={0x40040, 0xd2, 0xf}, 0x18) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000027c0)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xe0}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x40000}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x2, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {0x7, 0x0, 0x0, 0x9}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r2}, {}, {0x46, 0x8, 0xfff1, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) execveat(r1, 0x0, 0x0, 0x0, 0x1000) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) creat(&(0x7f0000000080)='./bus\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x3, 0x5, &(0x7f0000000000)=ANY=[], 0x0, 0x423, 0x0, 0x0, 0x0, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000040), 0xc) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4000011) socket$nl_rdma(0x10, 0x3, 0x14) 1m58.957448227s ago: executing program 5 (id=370): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x10000, &(0x7f0000000100)={[{@grpid}, {@auto_da_alloc}, {@lazytime}, {@journal_dev={'journal_dev', 0x3d, 0x6}}]}, 0x3, 0x4d4, &(0x7f0000000180)="$eJzs3M9vFGUfAPDvbHdpgZfXioiCKAU0Nia2UFA4eMHExIMmRjzIsWkrQRYwtAchREpiuJN4NDEejTdNvOrRePIPwIMHE0NCDBfA05jZnWm3291ttz8p+/kk232e2WfmeZ6ZeWaffZ7OBNCzhrI/ScT/IuJORDxVjy5MMFR/e3j/+sSj+9cnYjZNz/yT1NI9yOK5Yr2deWS4FFH6MmnaYN301WsXxqvVqSt5fHTm4mej01evvX7+4vi5qXNTl8ZOnTpx/NjJN8fe6L5SLfLL6vVg/xeXD+x79+zt9yfKxfKB/L2xHm2VuyvGUIfPXuluU4+9XQ3hZPF+urGhhWHZBvLTupK1/+vVw2c3u0DAhknTNO1v//Fs2uzmoiXAlpXEZpcA2BzFF332+7d4bVDX47Fw73T9B1BW74f5q/5JOUp5mkrT79u1NBQRH8/++032ik7jEH+uUwEAgJ7zy+miJ9jc/yvF3oZ0/8/nUAYj4umI2B0Rz0TEnoh4NqKW9rmIeL45gyQi7ZD/nqb4fP4/5rMIpburrmQHWf/vrXxua2H/r+j9xWBfHtsVUXSYp47m+2Q4Kv2fnK9OHWuz/W1L5N/Y/8teWf5FXzAvx91y0wDd5PjM+Mpqu9i9mxH7y831T8rZgSumcZKI2BcR+7vY7mBD+Pxr3x2Yi1Ty96/rb0vXvyZtMaXX9XxcK+m3Ea/Wj/9sNB7/ZD7HpPP85OhAVKeOjmZnwdGWefz2+60P2uW/ZP1/+qt5lXdO/nxm1fUuZMd/R8P5H8X87fwk6mASkczN105HpH3d5XHrj/YrrPT835Z8VAsX7evz8ZmZK8citiXvLV4+Nr9uES/SZ/UfPtK6/e/O18n2xAsRkZ3EL0bESxFxMC/7oYg4HBFHOtT/17df/nTl9V9fWf0nW17/Fhz/+fn6ZQaKlbMlfRcO3XnU5uKxvON/ohYazpe0vv4lCy4Ryy3p6vYeAAAAbA2lqP3vf2lkLlwqjYzUx4D2xI5S9fL0zMGIuDRZv0dgMCqlYqSrPh5cSYrxz8GG+FhT/Hg+bvxV3/ZafGTicnVysysPPW5nrc0ni9p/5u8ux3mBLWgN5tGALWqp9r/39gYVBNhwvv+hdzW0/9k2SWb9pww8mXz/Q+9q1f5vxPcd711wzYCtL9WWoadp/9C7yvHhXLh223PLu22BJ5Hvf+hJ3d7Xv5xA8biGaxfS/tZpBqLFEwMG1rgYeWB7i7w2JZD1rNZwg5WIWF7i7SvJougCtn/CQ6m7DfbH4o/6otNaSRfPcSgC2V5ZMvG5vWt+8hfPRFnr0+aH+XZaaTgW5aWOzuoDG3oZAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWDf/BQAA//8mic8a") syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0xbe, 0x0, &(0x7f00000007c0)) 1m57.776843825s ago: executing program 5 (id=379): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ptrace$peekuser(0x3, r0, 0x1) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) r3 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) listen(r3, 0x9) r4 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r4, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) readv(r2, &(0x7f0000000b40)=[{&(0x7f0000000cc0)=""/154, 0xfdef}, {0x0}, {0x0}], 0x3) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf2502", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) 1m45.484346651s ago: executing program 5 (id=398): socket$inet_tcp(0x2, 0x1, 0x0) keyctl$reject(0x14, 0x0, 0x5, 0x1, 0x0) gettid() bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="850000006100000054000000000000009500000000000000fde567c245f2427dc193f48934887070cc612b4a9acc173c7740448d9317ff3a0ede53f3834a8b49ec"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x40800) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, &(0x7f0000000080), 0x0, 0xffffffffffffffff) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001640)=@newqdisc={0x78, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfc, {0x60, 0x0, 0x0, r3, {}, {0xffe0, 0xa}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4c, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0x1889}, @TCA_TBF_RATE64={0xc, 0x4, 0xb78fea3163f663ab}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0xfffa, 0x9, 0x9, 0x4}, {0x71, 0x2, 0x4, 0x8, 0x7, 0x101}, 0x0, 0x7, 0x1aa2}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xf0cda79ea301acfa}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0xc5}, 0xc010) 1m44.643811818s ago: executing program 33 (id=398): socket$inet_tcp(0x2, 0x1, 0x0) keyctl$reject(0x14, 0x0, 0x5, 0x1, 0x0) gettid() bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="850000006100000054000000000000009500000000000000fde567c245f2427dc193f48934887070cc612b4a9acc173c7740448d9317ff3a0ede53f3834a8b49ec"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x40800) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, &(0x7f0000000080), 0x0, 0xffffffffffffffff) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001640)=@newqdisc={0x78, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfc, {0x60, 0x0, 0x0, r3, {}, {0xffe0, 0xa}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4c, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0x1889}, @TCA_TBF_RATE64={0xc, 0x4, 0xb78fea3163f663ab}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0xfffa, 0x9, 0x9, 0x4}, {0x71, 0x2, 0x4, 0x8, 0x7, 0x101}, 0x0, 0x7, 0x1aa2}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xf0cda79ea301acfa}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0xc5}, 0xc010) 11.423477157s ago: executing program 0 (id=646): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{}, &(0x7f0000000040)=0x700, 0x0}, 0x20) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 10.53484927s ago: executing program 0 (id=650): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x38, 0x0, 0x8, 0x9, 0x80000001, 0x3, 0x4, 0xffff, 0x0, 0x300000}, 0x0) sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf947b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_rdma(&(0x7f0000000180), &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x1008840, &(0x7f0000000840)={'trans=rdma,', {'port', 0x3d, 0x4e24}}) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setns(0xffffffffffffffff, 0x64000000) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000140)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'lblc\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0xff) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x4, 0x7fff0000}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x2, 0x0) write(r7, &(0x7f0000000340)='hist:', 0x5) 9.402869144s ago: executing program 0 (id=655): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r1 = open(&(0x7f0000000280)='.\x00', 0x10000, 0x0) fcntl$lock(r1, 0x410, &(0x7f0000000200)={0x1, 0x3, 0x1000000000000001, 0x9b}) futimesat(r0, 0x0, 0x0) 9.096406192s ago: executing program 3 (id=656): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r1 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x24c16a82ae8a2de6) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) readv(r1, &(0x7f0000000400)=[{&(0x7f00000000c0)=""/52, 0x34}, {0x0}], 0x2) 8.359063398s ago: executing program 6 (id=658): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101"], 0x40}, 0xfffe) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) 7.535301189s ago: executing program 4 (id=659): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000040)=0x1, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) 7.300661145s ago: executing program 0 (id=660): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000180)={0x0, 0x0, 0xfffffff9, 0x6, 0x16, "0062007d8200f7ffffff00"}) syz_open_pts(r0, 0x20000) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000200)=0x17) 6.206952391s ago: executing program 6 (id=662): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000a40)=@newsa={0x138, 0x10, 0x1, 0x70bc2c, 0x0, {{@in6=@mcast2, @in=@dev={0xac, 0x14, 0x14, 0xd}, 0x0, 0xecdf, 0x0, 0x0, 0xa}, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, {0xfffffffffffffffe, 0xfffffffffffffffe, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x9}, {0x3, 0x400804, 0x9, 0x292}, {0x1cb00000, 0x0, 0xfffffffe}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x48, 0x2, {{'cbc(camellia)\x00'}}}]}, 0x138}}, 0x44050) 6.189171033s ago: executing program 2 (id=663): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x10000}}, 0x0, 0xa, 0x0, 0x0, 0x41100, 0x73, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x24044010) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 6.148216699s ago: executing program 4 (id=664): openat$sndtimer(0xffffffffffffff9c, 0x0, 0xc00) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() socket$nl_generic(0x10, 0x3, 0x10) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000200)=[{0x3, 0x10, 0x800}], 0x1) semget(0x3, 0x4, 0x39c) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) semop(0x0, &(0x7f0000000080)=[{0x1, 0x8001, 0x1000}, {0x1, 0x5b7a, 0x800}], 0x2) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000240)=[0x6, 0x7fff]) 5.982012136s ago: executing program 3 (id=665): socket(0x2, 0x80805, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000180)=0xfffffffffffffff9, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) r1 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000000e8ffffffffffff05000000", @ANYRES32], 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)={r1}) r3 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)={r3}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8936, &(0x7f0000000000)={r3}) 5.700877895s ago: executing program 4 (id=666): socket$key(0xf, 0x3, 0x2) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x5}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dri(0x0, 0x1f, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=ANY=[@ANYRES32, @ANYRES16], 0x58}, 0x1, 0x0, 0x0, 0x40810}, 0x48001) socket$netlink(0x10, 0x3, 0x10) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r2, 0x89e1, &(0x7f00000000c0)='lap') syz_clone3(&(0x7f0000003ac0)={0x20000, 0x0, &(0x7f0000000100), &(0x7f00000003c0), {0x16}, &(0x7f0000000980)=""/4096, 0x1000, &(0x7f0000001980)=""/46, &(0x7f0000003a40)=[0x0, 0x0, 0x0, 0x0], 0x4}, 0x58) socket$inet_udp(0x2, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x1) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000900), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r3, 0xc0145401, &(0x7f0000000940)={0x3, 0x0, 0xffffffff, 0x2, 0xb3}) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r4, &(0x7f0000000240)={0x27, 0x0, 0x0, 0x3, 0x0, 0x4, "e88509de7f1939e8abff005597c8ef039a5be42200", 0x80000000010}, 0x60) listen(r4, 0x0) accept(r4, 0x0, 0x0) 5.607924804s ago: executing program 3 (id=667): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000180)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmsg(r0, &(0x7f0000002940)={&(0x7f00000000c0)=@ieee802154={0x24, @short={0x2, 0x0, 0x555d}}, 0x80, 0x0}, 0x20048051) 5.607714229s ago: executing program 0 (id=668): r0 = io_uring_setup(0x1ab8, &(0x7f0000002240)={0x0, 0x0, 0x0, 0x400002}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080307000000e8fea4a1190015000600142603600e120800110000810401040016000a00104005000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43", 0xd4}], 0x1, 0x0, 0x0, 0x7400}, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x18, &(0x7f0000000000), 0x1) 5.134372459s ago: executing program 0 (id=669): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000a80)=""/188, 0xba) syz_usb_connect$lan78xx(0x3, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect$cdc_ecm(0x1, 0x0, 0x0, 0x0) r2 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000000c0)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0x0}, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x14e040) syz_usb_connect$cdc_ecm(0x0, 0x77, &(0x7f0000000000)=ANY=[], 0x0) read$char_usb(r1, 0x0, 0x0) r3 = syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000240)=ANY=[@ANYRESOCT], 0x0) syz_usb_disconnect(r3) syz_usb_connect(0x0, 0x3c, &(0x7f0000000000)=ANY=[], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$hid(0x4, 0x0, 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000540)={0x14, &(0x7f00000003c0)=ANY=[], &(0x7f0000000440)=ANY=[@ANYBLOB="0003e1000000e10346b9cd505defb9f7b39b6d917b7bfc7678f1261f571a12ffcd196e9d22315f6f944c448e286ec465f3fda936aca0fd8e203d626c4b03b96e2816e3b319b241bb94e862b52c5fc5dd8037595ca6c169bd418bf34453c502db559e5b85ee057b85fb6fec3e8dafd38253a240de703bd3a71f0aeb5333a616a989e89b1175dd87945d228a9d6454ab760d35fe7c0300000000000000f122da23687694000000002e8c27125c18d1a72f3bb7d5e1adfe614b4eb05a76296e689d6256817378c4e809be37fd1b6884863db1799672a08b9937f2cfd82ccd80da24265a967cc1e0dc"]}, 0x0) syz_usb_connect$uac1(0x0, 0x90, &(0x7f0000000b40)=ANY=[@ANYBLOB="1201500bc534a1901700e1ae4db90200000020da0b144040000102030109027e0003010100070904000000010100000a2401050028000201020924060405011e3602000509240302030401040a0c240205000401f73b0deb0909040100000102000009040101010102000009050109000240067f07250100fd8203090402000001020000090402010101020000090582090800080304072501080f09006ff6852c490665ba3df876e3ad5b537bf2fe60a5894d10afae04432f821b548b5202e42ad8710eeab4d3e386d6c64c0efe6dd34f4f3f89ab006048ec8461329e73"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, 0x0) syz_usb_connect$lan78xx(0x6, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_connect(0x0, 0x147, &(0x7f0000000000)=ANY=[], 0x0) 4.522608388s ago: executing program 2 (id=670): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="020e0000180000000000000000000000030005000000000002000000ac1e0001000000000000000003000600000000000200000000000000000000000000000004000400000000000000000000000000000000000000000000000000000000000800120000000200000000000000000006000000000000000000000000000000ff0200000000000000000000000000010000000000000000000000000000000004"], 0xc0}}, 0x0) 4.3519704s ago: executing program 6 (id=671): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r1 = open(&(0x7f0000000280)='.\x00', 0x10000, 0x0) fcntl$lock(r1, 0x410, &(0x7f0000000200)={0x1, 0x3, 0x1000000000000001, 0x9b}) futimesat(r0, 0x0, 0x0) 4.221466679s ago: executing program 3 (id=672): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1ffffc, 0xb66, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r3) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3a}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80, 0x0, 0x1, 0x1}}) r5 = add_key(0x0, &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r6 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r5) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000940)={r6, 0x8d}, 0x0, &(0x7f0000000b80)="cb44032c2a3a518de9000000c11a536275a146d65e2988ef1a4992f9a2675b2853d82c107d0fd00990b531004a27f0395fdb7d3b545b60ff5be75bcb1d85878c1cbdb120730ded7b4d10b0612763631dd3db62ddf7f799a4257d4bf67e86244beee88b1e3e5bac3ad4dea44fc08db9f741b76996bf785368bc3b20816471f5254e6e9e7a9ccd90d32ebcf5ea2c", 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', r4, 0x0, 0x0, 0x0, 0x4, 0x8, @remote, @dev={0xfe, 0x80, '\x00', 0xe}, 0x0, 0x1, 0xfffffffe, 0x1}}) r7 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x138, 0x98, 0x138, 0x0, 0x0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x3}}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x9, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xa7ae6000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000900)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@union={0x2, 0x1, 0x0, 0x5, 0x0, 0xffe, [{0x1, 0x1}]}]}, {0x0, [0x2e]}}, &(0x7f0000000640)=""/192, 0x33, 0xc0, 0x1}, 0x28) 4.212790882s ago: executing program 2 (id=673): r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000700)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000006c0)={&(0x7f00000003c0)={0x2a0, r1, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x48}]}, @TIPC_NLA_BEARER={0x7c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x9}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xd5c}]}, @TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}]}, @TIPC_NLA_SOCK_CON={0x4}]}, @TIPC_NLA_NET={0x28, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x400}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xe83}]}, @TIPC_NLA_NODE={0x1b4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1}, @TIPC_NLA_NODE_ID={0xc4, 0x3, "2a5bb3e489438301feddb1547cc648a178a8f8029c2a61f371c4e330437c9beff1b9d73108679bfe7aa15cfdaa7e5b6056bc450c032c0eba76627ed077b5dc9365089b1762aebd11a637b1e8c9b221e17f7831ee16a0642a48f9133dde5ea2b16ab56f859a352bd029958499fa82728a42d75a8e926e4adbef40d770d18634208991f2d0c60039c3b2b363dd6ea6d426ea3cf7000fe4b2c34e69bc7c390e7d63e33753d9735927a3d696ea0eef5f752b7d4674ebd780e45fa1cfecd0f169d583"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000001}, @TIPC_NLA_NODE_KEY={0x44, 0x4, {'gcm(aes)\x00', 0x1c, "fe4fd6a2809bed2e63a584da9caec7ad41a9d1cae03cb39e1b7025ce"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x48, 0x4, {'gcm(aes)\x00', 0x20, "00c8e74f8a39a7e65a391ff97ea4621630862adf148be977df57cf96480a351e"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "901bf3261b9919132255ddcd1619d236ae24941474930eec791278852a"}}]}]}, 0x2a0}, 0x1, 0x0, 0x0, 0x4c801}, 0x4040040) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="020e0000180000000000000000000000030005000000000002000000ac1e0001000000000000000003000600000000000200000000000000000000000000000004000400000000000000000000000000000000000000000000000000000000000800120000000200000000000000000006000000000000000000000000000000ff02000000000000000000000000000100000000000000000000000000000000040003"], 0xc0}}, 0x0) sendmsg$key(r5, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000001040)={0x2, 0x13, 0x8, 0x0, 0x2, 0x0, 0x70bd2a, 0x25dfdbfe}, 0x10}}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x1f, 0x0, 0x0, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x32, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.111473979s ago: executing program 4 (id=674): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101"], 0x40}, 0xfffe) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) 3.655586435s ago: executing program 6 (id=675): fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x8008551d, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0x2, 0x2}]}]}, {0x0, [0x5f]}}, 0x0, 0x33, 0x0, 0xa}, 0x28) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r2, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5d090936f70e0dd038e7ff7fc6e5539b324c078b089b3934076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b35310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1061}}, 0x1006) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x20042000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206010800000000000000000100000814000780080012400000000505001500090000000500010006000000050005000a00000005000400000000000900020073797a300000000010000300686173683a69702c6d616300"], 0x5c}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, &(0x7f0000000040)={r6, 0x80}, 0x8) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000000406050000000000000000000a000000050001000700ff01000000000000ac75d749b3a47836a7edce6f7a3f6ed82c38a14736ab557b6011da34bffab0482edfd435fa0f3d02a2e10627e2df4c6aec11dab62c274723d0ad4d48177461beda2cb0ef77257a9512fbb3e8e020"], 0x1c}, 0x1, 0x0, 0x0, 0x58010}, 0x800) 2.247813029s ago: executing program 2 (id=676): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r1 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x24c16a82ae8a2de6) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) readv(r1, &(0x7f0000000400)=[{&(0x7f0000000180)=""/203, 0xcb}], 0x1) 1.978954614s ago: executing program 3 (id=677): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x81, 0x0) writev(r0, &(0x7f0000004b00)=[{&(0x7f0000001740)="11", 0x1}], 0x1) 1.229958373s ago: executing program 6 (id=678): socket(0x2, 0x80805, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000180)=0xfffffffffffffff9, 0x4) r1 = socket$kcm(0xa, 0x1, 0x0) r2 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000000e8ffffffffffff05000000", @ANYRES32=r1], 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8916, &(0x7f0000000000)={r2}) r4 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8916, &(0x7f0000000000)={r4}) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8936, &(0x7f0000000000)={r4}) 1.001895643s ago: executing program 2 (id=679): openat$sndtimer(0xffffffffffffff9c, 0x0, 0xc00) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() socket$nl_generic(0x10, 0x3, 0x10) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000200)=[{0x3, 0x10, 0x800}], 0x1) semget(0x3, 0x4, 0x39c) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) semop(0x0, &(0x7f0000000080)=[{0x1, 0x8001, 0x1000}, {0x1, 0x5b7a, 0x800}], 0x2) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000240)=[0x6, 0x7fff]) 993.9696ms ago: executing program 3 (id=680): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f00000029c0)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30000001) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000500)="0f", 0x7fd8}], 0x20}, 0x40040) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x13, 0xa, 0x3, 0x0, 0x0, {0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x2000c040}, 0xc000) 880.102182ms ago: executing program 4 (id=681): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003840)=@newqdisc={0x24, 0x2a, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0x10}, {0xb, 0x7}}}, 0x24}}, 0x4008000) write(r0, &(0x7f0000000000)='3', 0x4e) add_key(0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000280)='setgroups\x00') unshare(0x2040400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) 316.34712ms ago: executing program 6 (id=682): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) 21.397852ms ago: executing program 2 (id=683): r0 = socket(0x2, 0x3, 0xff) setsockopt$inet_int(r0, 0x0, 0x3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) sendmmsg$inet(r0, &(0x7f0000000700)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}], 0x1, 0x2890) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002a40), r5) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r7, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x14, r6, 0x1, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4044080}, 0x1c890) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) prlimit64(r2, 0x3, &(0x7f0000000080)={0x3}, &(0x7f0000000180)) 0s ago: executing program 4 (id=684): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="020e0000180000000000000000000000030005000000000002000000ac1e0001000000000000000003000600000000000200000000000000000000000000000004000400000000000000000000000000000000000000000000000000000000000800120000000200000000000000000006000000000000000000000000000000ff0200000000000000000000000000010000000000000000000000000000000004"], 0xc0}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.123' (ED25519) to the list of known hosts. [ 91.269058][ T30] cfg80211: failed to load regulatory.db [ 93.725345][ T5600] cgroup: Unknown subsys name 'net' [ 93.799734][ T5600] cgroup: Unknown subsys name 'cpuset' [ 93.803963][ T5600] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 95.529847][ T5600] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 100.424947][ T5630] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.426365][ T5630] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 100.427775][ T5630] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 100.431181][ T5630] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 100.436167][ T5630] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 100.436862][ T5630] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 100.437695][ T5630] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.438209][ T5630] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 100.438608][ T5630] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.440523][ T5630] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 100.440902][ T5630] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.442072][ T5630] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 100.442808][ T5630] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 100.447038][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 100.450694][ T5634] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 100.453059][ T5625] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 100.454357][ T5625] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 100.458671][ T5625] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 100.459384][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 100.463067][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 100.473670][ T5637] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 100.484532][ T5638] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 100.487765][ T5638] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 100.488730][ T5638] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 100.489849][ T5638] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 100.490571][ T5638] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 100.515714][ T4928] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 100.521807][ T4928] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 100.542719][ T4928] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 100.557317][ T4928] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 102.465765][ T4928] Bluetooth: hci2: command tx timeout [ 102.465959][ T5631] Bluetooth: hci0: command tx timeout [ 102.546208][ T4928] Bluetooth: hci4: command tx timeout [ 102.546547][ T4928] Bluetooth: hci3: command tx timeout [ 102.546859][ T5631] Bluetooth: hci1: command tx timeout [ 102.625082][ T5631] Bluetooth: hci5: command tx timeout [ 103.190193][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.191047][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.191212][ T5619] bridge_slave_0: entered allmulticast mode [ 103.194135][ T5619] bridge_slave_0: entered promiscuous mode [ 103.258374][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.258485][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.258628][ T5619] bridge_slave_1: entered allmulticast mode [ 103.260688][ T5619] bridge_slave_1: entered promiscuous mode [ 103.403580][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.459741][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.559211][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.559394][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.559526][ T5623] bridge_slave_0: entered allmulticast mode [ 103.561399][ T5623] bridge_slave_0: entered promiscuous mode [ 103.564701][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.564818][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.566206][ T5623] bridge_slave_1: entered allmulticast mode [ 103.569029][ T5623] bridge_slave_1: entered promiscuous mode [ 103.627621][ T5624] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.627803][ T5624] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.627976][ T5624] bridge_slave_0: entered allmulticast mode [ 103.630053][ T5624] bridge_slave_0: entered promiscuous mode [ 103.700741][ T5619] team0: Port device team_slave_0 added [ 103.701628][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.701759][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.701881][ T5621] bridge_slave_0: entered allmulticast mode [ 103.703914][ T5621] bridge_slave_0: entered promiscuous mode [ 103.707561][ T5624] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.707679][ T5624] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.707833][ T5624] bridge_slave_1: entered allmulticast mode [ 103.710843][ T5624] bridge_slave_1: entered promiscuous mode [ 103.729337][ T5622] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.729459][ T5622] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.729620][ T5622] bridge_slave_0: entered allmulticast mode [ 103.732277][ T5622] bridge_slave_0: entered promiscuous mode [ 103.740967][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.766277][ T5619] team0: Port device team_slave_1 added [ 103.766492][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.766899][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.767074][ T5621] bridge_slave_1: entered allmulticast mode [ 103.769620][ T5621] bridge_slave_1: entered promiscuous mode [ 103.787563][ T5622] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.787684][ T5622] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.787867][ T5622] bridge_slave_1: entered allmulticast mode [ 103.792318][ T5622] bridge_slave_1: entered promiscuous mode [ 103.797667][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.797870][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.797988][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.798163][ T5620] bridge_slave_0: entered allmulticast mode [ 103.800592][ T5620] bridge_slave_0: entered promiscuous mode [ 103.852848][ T5624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.889901][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.890023][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.890455][ T5620] bridge_slave_1: entered allmulticast mode [ 103.893501][ T5620] bridge_slave_1: entered promiscuous mode [ 103.933279][ T5624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.977115][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.977140][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.977180][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.982446][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.031545][ T5622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.036630][ T5623] team0: Port device team_slave_0 added [ 104.055411][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.055436][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.055482][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.058677][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.060907][ T5624] team0: Port device team_slave_0 added [ 104.063597][ T5622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.068088][ T5623] team0: Port device team_slave_1 added [ 104.092077][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.147717][ T5624] team0: Port device team_slave_1 added [ 104.191845][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.211444][ T5621] team0: Port device team_slave_0 added [ 104.247178][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.247207][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.247258][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.301105][ T5621] team0: Port device team_slave_1 added [ 104.317317][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.317342][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.317392][ T5624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.338520][ T5622] team0: Port device team_slave_0 added [ 104.343150][ T5622] team0: Port device team_slave_1 added [ 104.361013][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.361037][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.361079][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.365939][ T5620] team0: Port device team_slave_0 added [ 104.383601][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.383624][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.384805][ T5624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.386979][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.387000][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.387043][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.389606][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.389627][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.389671][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.422339][ T5620] team0: Port device team_slave_1 added [ 104.432223][ T5619] hsr_slave_0: entered promiscuous mode [ 104.433571][ T5619] hsr_slave_1: entered promiscuous mode [ 104.459754][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.459779][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.459823][ T5622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.507760][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.507785][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.507830][ T5622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.560940][ T5638] Bluetooth: hci2: command tx timeout [ 104.561040][ T5631] Bluetooth: hci0: command tx timeout [ 104.620258][ T5623] hsr_slave_0: entered promiscuous mode [ 104.621573][ T5623] hsr_slave_1: entered promiscuous mode [ 104.622516][ T5623] debugfs: 'hsr0' already exists in 'hsr' [ 104.622646][ T5623] Cannot create hsr debugfs directory [ 104.632714][ T5631] Bluetooth: hci1: command tx timeout [ 104.632775][ T5631] Bluetooth: hci3: command tx timeout [ 104.632826][ T5631] Bluetooth: hci4: command tx timeout [ 104.698827][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.698852][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.698897][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.710003][ T5638] Bluetooth: hci5: command tx timeout [ 104.748992][ T5624] hsr_slave_0: entered promiscuous mode [ 104.750548][ T5624] hsr_slave_1: entered promiscuous mode [ 104.752828][ T5624] debugfs: 'hsr0' already exists in 'hsr' [ 104.752855][ T5624] Cannot create hsr debugfs directory [ 104.780902][ T5621] hsr_slave_0: entered promiscuous mode [ 104.782109][ T5621] hsr_slave_1: entered promiscuous mode [ 104.782973][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 104.783001][ T5621] Cannot create hsr debugfs directory [ 104.783982][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.784002][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.784046][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.944211][ T5622] hsr_slave_0: entered promiscuous mode [ 104.945923][ T5622] hsr_slave_1: entered promiscuous mode [ 104.946799][ T5622] debugfs: 'hsr0' already exists in 'hsr' [ 104.946904][ T5622] Cannot create hsr debugfs directory [ 105.206560][ T5620] hsr_slave_0: entered promiscuous mode [ 105.207533][ T5620] hsr_slave_1: entered promiscuous mode [ 105.208149][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 105.208178][ T5620] Cannot create hsr debugfs directory [ 105.702763][ T5619] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 105.712867][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.714889][ T5619] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 105.727502][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.755302][ T5619] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 105.759914][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.772929][ T5619] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 105.783672][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.856735][ T5624] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 105.862265][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.876084][ T5624] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 105.884614][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.890114][ T5624] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 105.898314][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.918392][ T5624] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 105.922230][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.003467][ T5621] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 106.010037][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.012922][ T5621] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 106.023957][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.051238][ T5621] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 106.057833][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.060665][ T5621] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 106.067685][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.177723][ T5623] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.184332][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.209849][ T5623] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.214690][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.216801][ T5623] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.227031][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.264444][ T5623] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.271438][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.357088][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.380934][ T5622] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 106.384668][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.407166][ T5622] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 106.411345][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.425104][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.450587][ T5622] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 106.454845][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.466220][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.466391][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.473285][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.473417][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.514613][ T5622] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 106.526473][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.604913][ T5624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.626016][ T5638] Bluetooth: hci0: command tx timeout [ 106.626063][ T5638] Bluetooth: hci2: command tx timeout [ 106.667877][ T5620] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 106.672862][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.698072][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.705309][ T4928] Bluetooth: hci1: command tx timeout [ 106.705409][ T5638] Bluetooth: hci3: command tx timeout [ 106.705499][ T5631] Bluetooth: hci4: command tx timeout [ 106.713537][ T5620] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 106.727414][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.751663][ T5620] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 106.758501][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.780326][ T5624] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.780916][ T5620] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 106.786684][ T5631] Bluetooth: hci5: command tx timeout [ 106.790885][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.852593][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.863049][ T163] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.863285][ T163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.930103][ T163] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.930228][ T163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.933325][ T163] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.933465][ T163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.002642][ T163] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.002776][ T163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.100176][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.261225][ T5623] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.286586][ T5622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.353147][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.353315][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.433291][ T5622] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.442725][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.442848][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.553707][ T3304] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.553835][ T3304] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.612833][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.655048][ T3290] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.655196][ T3290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.813150][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.881418][ T163] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.881565][ T163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.954602][ T163] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.954731][ T163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.994923][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.708116][ T5638] Bluetooth: hci0: command tx timeout [ 108.708181][ T5631] Bluetooth: hci2: command tx timeout [ 108.787129][ T5631] Bluetooth: hci4: command tx timeout [ 108.787180][ T5631] Bluetooth: hci3: command tx timeout [ 108.787218][ T5631] Bluetooth: hci1: command tx timeout [ 108.880801][ T5638] Bluetooth: hci5: command tx timeout [ 109.385754][ T5619] veth0_vlan: entered promiscuous mode [ 109.407945][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.428001][ T5624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.473961][ T5619] veth1_vlan: entered promiscuous mode [ 109.662735][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.711618][ T5619] veth0_macvtap: entered promiscuous mode [ 109.744179][ T5619] veth1_macvtap: entered promiscuous mode [ 109.753072][ T5622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.832954][ T5621] veth0_vlan: entered promiscuous mode [ 109.842531][ T5624] veth0_vlan: entered promiscuous mode [ 109.862220][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.878710][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.894647][ T5624] veth1_vlan: entered promiscuous mode [ 109.920540][ T5621] veth1_vlan: entered promiscuous mode [ 109.942386][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.008225][ T1445] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.009854][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.009920][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.058713][ T1445] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.235066][ T5623] veth0_vlan: entered promiscuous mode [ 110.252830][ T5621] veth0_macvtap: entered promiscuous mode [ 110.258658][ T5624] veth0_macvtap: entered promiscuous mode [ 110.291718][ T5620] veth0_vlan: entered promiscuous mode [ 110.308800][ T5621] veth1_macvtap: entered promiscuous mode [ 110.339084][ T5624] veth1_macvtap: entered promiscuous mode [ 110.352940][ T5623] veth1_vlan: entered promiscuous mode [ 110.363953][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.370788][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.408819][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.408852][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.416650][ T3290] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.416719][ T3290] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.416788][ T3290] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.416849][ T3290] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.444318][ T5620] veth1_vlan: entered promiscuous mode [ 110.525592][ T5622] veth0_vlan: entered promiscuous mode [ 110.534128][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.534159][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.578700][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.595814][ T5622] veth1_vlan: entered promiscuous mode [ 110.658886][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.677815][ T5619] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 110.757224][ T3290] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.757743][ T3290] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.786157][ T5623] veth0_macvtap: entered promiscuous mode [ 110.799947][ T1482] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.800017][ T1482] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.823005][ T1482] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.823042][ T1482] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.830961][ T5620] veth0_macvtap: entered promiscuous mode [ 110.872115][ T5623] veth1_macvtap: entered promiscuous mode [ 110.897460][ T5620] veth1_macvtap: entered promiscuous mode [ 110.930966][ T5622] veth0_macvtap: entered promiscuous mode [ 110.943628][ T5622] veth1_macvtap: entered promiscuous mode [ 110.988261][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.993702][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.066677][ T97] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.066709][ T97] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.091058][ T1445] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.103641][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.103758][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.103825][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.206738][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.212899][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.223747][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.230520][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.239718][ T97] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.810755][ T3304] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.810850][ T3304] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.810911][ T3304] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.016225][ T1482] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.019926][ T1482] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.021016][ T1482] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.021391][ T1482] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.327126][ T5859] loop3: detected capacity change from 0 to 512 [ 112.374767][ T5859] EXT4-fs warning (device loop3): dx_probe:800: inode #2: comm syz.3.8: Unrecognised inode hash code 255 [ 112.374822][ T5859] EXT4-fs warning (device loop3): dx_probe:933: inode #2: comm syz.3.8: Corrupt directory, running e2fsck is recommended [ 112.408354][ T5859] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 112.408484][ T5859] EXT4-fs error (device loop3): ext4_iget_extra_inode:5209: inode #15: comm syz.3.8: corrupted in-inode xattr: invalid ea_ino [ 112.408727][ T5859] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 112.409974][ T5859] EXT4-fs error (device loop3): ext4_orphan_get:1406: comm syz.3.8: couldn't read orphan inode 15 (err -117) [ 112.410132][ T5859] loop3: lost filesystem error report for type 5 error -117 [ 112.425215][ T5859] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 112.507736][ T1482] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.507769][ T1482] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.619823][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.619876][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.733744][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.733786][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.764222][ T5621] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.016426][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.016458][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.163745][ T97] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.163784][ T97] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.198193][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.198225][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.524741][ T5871] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 113.694576][ T97] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.694607][ T97] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.859484][ T3304] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.859517][ T3304] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.175549][ T5879] ieee802154 phy0 wpan0: encryption failed: -22 [ 115.923330][ T5900] loop3: detected capacity change from 0 to 1024 [ 116.779612][ T5893] loop0: detected capacity change from 0 to 4096 [ 116.962242][ T5893] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 117.097749][ T5909] loop5: detected capacity change from 0 to 512 [ 117.108913][ T5909] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 117.108940][ T5909] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 117.168704][ T5909] EXT4-fs (loop5): 1 truncate cleaned up [ 117.196271][ T31] audit: type=1800 audit(1789749098.082:2): pid=5893 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.15" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 117.224031][ T5893] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm syz.0.15: corrupted inode contents [ 117.239644][ T5893] EXT4-fs error (device loop0): ext4_dirty_inode:6736: inode #15: comm syz.0.15: mark_inode_dirty error [ 117.255582][ T5893] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm syz.0.15: corrupted inode contents [ 117.256245][ T5893] EXT4-fs error (device loop0): __ext4_ext_dirty:207: inode #15: comm syz.0.15: mark_inode_dirty error [ 117.259459][ T5893] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm syz.0.15: corrupted inode contents [ 117.263774][ T5909] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 117.265528][ T5893] EXT4-fs error (device loop0): __ext4_ext_dirty:207: inode #15: comm syz.0.15: mark_inode_dirty error [ 117.267410][ T5893] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm syz.0.15: corrupted inode contents [ 117.300562][ T5893] EXT4-fs error (device loop0): ext4_truncate:4721: inode #15: comm syz.0.15: mark_inode_dirty error [ 117.313220][ T5893] EXT4-fs error (device loop0) in ext4_setattr:6247: Corrupt filesystem [ 117.741868][ T5623] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.850355][ T5622] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 118.293022][ T5924] netlink: 12 bytes leftover after parsing attributes in process `syz.1.24'. [ 119.325734][ T5946] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 119.736389][ T5956] loop1: detected capacity change from 0 to 512 [ 119.763442][ T5956] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 119.799246][ T5956] EXT4-fs (loop1): 1 truncate cleaned up [ 119.821247][ T5956] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 119.907441][ T31] audit: type=1800 audit(1789749100.812:3): pid=5956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.37" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 120.178495][ T5620] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.272814][ T5970] Driver unsupported XDP return value 0 on prog (id 3) dev N/A, expect packet loss! [ 120.968105][ T31] audit: type=1326 audit(1789749101.872:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5976 comm="syz.1.44" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f00a419e159 code=0x0 [ 121.041410][ T5987] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 121.502971][ T5983] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 122.739808][ T6004] loop0: detected capacity change from 0 to 512 [ 122.758549][ T6004] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 122.791090][ T6005] syz.2.57 uses obsolete (PF_INET,SOCK_PACKET) [ 122.806771][ T6004] EXT4-fs (loop0): 1 truncate cleaned up [ 122.831011][ T6004] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 122.861753][ T31] audit: type=1326 audit(1789749103.762:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6002 comm="syz.2.57" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe6c19e159 code=0x7ffc0000 [ 122.868060][ T31] audit: type=1326 audit(1789749103.772:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6002 comm="syz.2.57" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe6c19e159 code=0x7ffc0000 [ 122.869248][ T31] audit: type=1326 audit(1789749103.772:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6002 comm="syz.2.57" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe6c19e159 code=0x7ffc0000 [ 122.871262][ T31] audit: type=1326 audit(1789749103.772:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6002 comm="syz.2.57" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe6c19e159 code=0x7ffc0000 [ 122.873031][ T31] audit: type=1326 audit(1789749103.772:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6002 comm="syz.2.57" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7efe6c19e159 code=0x7ffc0000 [ 122.885623][ T31] audit: type=1800 audit(1789749103.782:10): pid=6004 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.56" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 122.966924][ T31] audit: type=1326 audit(1789749103.872:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6002 comm="syz.2.57" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe6c19e159 code=0x7ffc0000 [ 122.967007][ T31] audit: type=1326 audit(1789749103.872:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6002 comm="syz.2.57" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe6c19e159 code=0x7ffc0000 [ 123.005151][ T31] audit: type=1326 audit(1789749103.892:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6002 comm="syz.2.57" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7efe6c19e159 code=0x7ffc0000 [ 123.005237][ T31] audit: type=1326 audit(1789749103.892:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6002 comm="syz.2.57" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe6c19e159 code=0x7ffc0000 [ 123.278013][ T5623] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 125.840552][ T6033] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 127.962503][ T6050] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 128.084901][ T6057] netlink: 20 bytes leftover after parsing attributes in process `syz.3.72'. [ 130.528914][ T6096] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 130.831355][ T6102] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 131.192494][ T6108] netlink: 72 bytes leftover after parsing attributes in process `syz.2.90'. [ 131.501866][ T6120] Zero length message leads to an empty skb [ 132.328340][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.328456][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.563742][ T6148] FAULT_INJECTION: forcing a failure. [ 133.563742][ T6148] name failslab, interval 1, probability 0, space 0, times 1 [ 133.563801][ T6148] CPU: 0 UID: 0 PID: 6148 Comm: syz.4.107 Not tainted syzkaller #0 PREEMPT(full) [ 133.563870][ T6148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 133.563895][ T6148] Call Trace: [ 133.563907][ T6148] [ 133.563922][ T6148] dump_stack_lvl+0x100/0x190 [ 133.563985][ T6148] should_fail_ex.cold+0x5/0xa [ 133.564032][ T6148] ? srso_alias_return_thunk+0x5/0xfbef5 [ 133.564090][ T6148] should_failslab+0xc2/0x120 [ 133.564132][ T6148] kmem_cache_alloc_noprof+0x92/0x6a0 [ 133.564195][ T6148] ? srso_alias_return_thunk+0x5/0xfbef5 [ 133.564246][ T6148] ? security_file_alloc+0x34/0x2c0 [ 133.564324][ T6148] security_file_alloc+0x34/0x2c0 [ 133.564394][ T6148] init_file+0x95/0x480 [ 133.564437][ T6148] alloc_empty_file+0x79/0x1c0 [ 133.564486][ T6148] alloc_file_pseudo+0x183/0x290 [ 133.564554][ T6148] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 133.564604][ T6148] ? srso_alias_return_thunk+0x5/0xfbef5 [ 133.564651][ T6148] ? pidfs_register_pid_gfp+0x72/0x1f0 [ 133.564704][ T6148] sock_alloc_file+0x50/0x210 [ 133.564769][ T6148] __sys_socketpair+0x353/0x5b0 [ 133.564828][ T6148] ? __pfx___sys_socketpair+0x10/0x10 [ 133.564876][ T6148] ? srso_alias_return_thunk+0x5/0xfbef5 [ 133.564928][ T6148] ? srso_alias_return_thunk+0x5/0xfbef5 [ 133.564978][ T6148] ? xfd_validate_state+0x129/0x190 [ 133.565029][ T6148] __x64_sys_socketpair+0x96/0x100 [ 133.565079][ T6148] ? srso_alias_return_thunk+0x5/0xfbef5 [ 133.565129][ T6148] ? lockdep_hardirqs_on+0x7d/0x110 [ 133.565200][ T6148] do_syscall_64+0x123/0x790 [ 133.565247][ T6148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.565290][ T6148] RIP: 0033:0x7f42b719e159 [ 133.565322][ T6148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.565362][ T6148] RSP: 002b:00007f42b7ff3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 133.565401][ T6148] RAX: ffffffffffffffda RBX: 00007f42b7425fa0 RCX: 00007f42b719e159 [ 133.565430][ T6148] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000001 [ 133.565455][ T6148] RBP: 00007f42b723506b R08: 0000000000000000 R09: 0000000000000000 [ 133.565482][ T6148] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 133.565507][ T6148] R13: 00007f42b7426038 R14: 00007f42b7425fa0 R15: 00007ffd81915888 [ 133.565561][ T6148] [ 133.813031][ T6153] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 134.131779][ T6149] syz.5.106 (6149) used greatest stack depth: 18888 bytes left [ 134.437493][ T6167] loop3: detected capacity change from 0 to 1024 [ 137.428304][ T6197] netlink: 8 bytes leftover after parsing attributes in process `syz.0.124'. [ 137.428339][ T6197] netlink: 8 bytes leftover after parsing attributes in process `syz.0.124'. [ 143.672721][ T6237] ======================================================= [ 143.672721][ T6237] WARNING: The mand mount option has been deprecated and [ 143.672721][ T6237] and is ignored by this kernel. Remove the mand [ 143.672721][ T6237] option from the mount to silence this warning. [ 143.672721][ T6237] ======================================================= [ 145.659789][ T6254] loop0: detected capacity change from 0 to 512 [ 145.747086][ T6254] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 145.834891][ T6261] netlink: 40 bytes leftover after parsing attributes in process `syz.3.145'. [ 145.899194][ T5623] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 146.117092][ T6265] FAULT_INJECTION: forcing a failure. [ 146.117092][ T6265] name fail_futex, interval 1, probability 0, space 0, times 1 [ 146.117144][ T6265] CPU: 0 UID: 0 PID: 6265 Comm: syz.3.148 Not tainted syzkaller #0 PREEMPT(full) [ 146.117190][ T6265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 146.117212][ T6265] Call Trace: [ 146.117225][ T6265] [ 146.117239][ T6265] dump_stack_lvl+0x100/0x190 [ 146.117304][ T6265] should_fail_ex.cold+0x5/0xa [ 146.117362][ T6265] get_futex_key+0x1d0/0x14f0 [ 146.117415][ T6265] ? __pfx_get_futex_key+0x10/0x10 [ 146.117465][ T6265] ? srso_alias_return_thunk+0x5/0xfbef5 [ 146.117513][ T6265] ? ___sys_sendmsg+0x127/0x1e0 [ 146.117566][ T6265] futex_wake+0xf4/0x5e0 [ 146.117633][ T6265] ? __pfx_futex_wake+0x10/0x10 [ 146.117698][ T6265] ? srso_alias_return_thunk+0x5/0xfbef5 [ 146.117745][ T6265] ? find_held_lock+0x2b/0x80 [ 146.117809][ T6265] do_futex+0x2b2/0x440 [ 146.117861][ T6265] ? __pfx_do_futex+0x10/0x10 [ 146.117911][ T6265] ? srso_alias_return_thunk+0x5/0xfbef5 [ 146.117961][ T6265] ? srso_alias_return_thunk+0x5/0xfbef5 [ 146.118008][ T6265] ? fput+0x7c/0x100 [ 146.118053][ T6265] __x64_sys_futex+0x34f/0x4d0 [ 146.118111][ T6265] ? __pfx___x64_sys_futex+0x10/0x10 [ 146.118172][ T6265] ? srso_alias_return_thunk+0x5/0xfbef5 [ 146.118227][ T6265] do_syscall_64+0x123/0x790 [ 146.118273][ T6265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.118318][ T6265] RIP: 0033:0x7f25ac19e159 [ 146.118349][ T6265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.118386][ T6265] RSP: 002b:00007f25acfe10e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 146.118424][ T6265] RAX: ffffffffffffffda RBX: 00007f25ac425fa8 RCX: 00007f25ac19e159 [ 146.118450][ T6265] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f25ac425fac [ 146.118474][ T6265] RBP: 00007f25ac425fa0 R08: 0000000000000001 R09: 0000000000000000 [ 146.118498][ T6265] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 146.118523][ T6265] R13: 00007f25ac426038 R14: 00007ffd33231fd0 R15: 00007ffd332320b8 [ 146.118574][ T6265] [ 150.000322][ T97] IPVS: starting estimator thread 0... [ 150.208701][ T6283] IPVS: using max 22 ests per chain, 52800 per kthread [ 150.544902][ T5631] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 150.562677][ T5631] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 150.572903][ T5631] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 150.574003][ T5631] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 150.574702][ T5631] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 150.684346][ T6293] loop0: detected capacity change from 0 to 1024 [ 150.751536][ T6293] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 150.764720][ T6293] JBD2: no valid journal superblock found [ 150.780047][ T6200] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 150.820341][ T6293] EXT4-fs (loop0): Could not load journal inode [ 152.021166][ T6305] netlink: 40 bytes leftover after parsing attributes in process `syz.4.160'. [ 152.625096][ T5631] Bluetooth: hci6: command tx timeout [ 153.038635][ T6317] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 153.770069][ T6323] loop5: detected capacity change from 0 to 512 [ 153.902317][ T6323] FAT-fs (loop5): Directory bread(block 2080) failed [ 153.902364][ T6323] FAT-fs (loop5): Directory bread(block 2081) failed [ 153.902401][ T6323] FAT-fs (loop5): Directory bread(block 2082) failed [ 153.902438][ T6323] FAT-fs (loop5): Directory bread(block 2083) failed [ 153.902474][ T6323] FAT-fs (loop5): Directory bread(block 2084) failed [ 153.902510][ T6323] FAT-fs (loop5): Directory bread(block 2085) failed [ 153.902547][ T6323] FAT-fs (loop5): Directory bread(block 2086) failed [ 153.902583][ T6323] FAT-fs (loop5): Directory bread(block 2087) failed [ 154.705155][ T5631] Bluetooth: hci6: command tx timeout [ 156.785181][ T5631] Bluetooth: hci6: command tx timeout [ 157.036522][ T6343] loop0: detected capacity change from 0 to 512 [ 157.054596][ T6343] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 157.088771][ T6343] EXT4-fs (loop0): 1 truncate cleaned up [ 157.128220][ T6343] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 158.569872][ T6361] loop4: detected capacity change from 0 to 164 [ 158.586746][ T6361] iso9660: Unknown parameter 'ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ017777777777777777777770xffffffffffffffffÿÿÿÿtÛÍÑ* [ 158.586746][ T6361] ¤§' [ 158.594510][ T5623] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 158.867698][ T5631] Bluetooth: hci6: command tx timeout [ 158.948298][ T6361] syzkaller0: entered promiscuous mode [ 158.948334][ T6361] syzkaller0: entered allmulticast mode [ 159.904355][ T6379] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 160.166679][ T6373] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 160.168045][ T6375] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 160.371621][ T6387] netlink: 'syz.5.182': attribute type 10 has an invalid length. [ 160.449206][ T6388] netlink: 'syz.5.182': attribute type 10 has an invalid length. [ 160.467498][ T6387] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 160.481787][ T6387] team0: Port device netdevsim1 added [ 160.539218][ T6388] team0: Port device netdevsim1 removed [ 160.572565][ T6388] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 160.590464][ T6388] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 160.897764][ T6402] size and base must be multiples of 4 kiB [ 160.897792][ T6402] CPU: 0 UID: 0 PID: 6402 Comm: syz.5.188 Not tainted syzkaller #0 PREEMPT(full) [ 160.897843][ T6402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 160.897873][ T6402] Call Trace: [ 160.897885][ T6402] [ 160.897899][ T6402] dump_stack_lvl+0x100/0x190 [ 160.897963][ T6402] mtrr_del.cold+0x72/0x85 [ 160.898005][ T6402] mtrr_ioctl+0xbc8/0xcf0 [ 160.898046][ T6402] ? __pfx_mtrr_ioctl+0x10/0x10 [ 160.898088][ T6402] ? __fget_files+0x34/0x3d0 [ 160.898125][ T6402] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.898173][ T6402] ? find_held_lock+0x2b/0x80 [ 160.898224][ T6402] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.898284][ T6402] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.898330][ T6402] ? __fget_files+0x21f/0x3d0 [ 160.898368][ T6402] ? __pfx_mtrr_ioctl+0x10/0x10 [ 160.898405][ T6402] proc_reg_unlocked_ioctl+0x229/0x320 [ 160.898455][ T6402] ? __pfx_proc_reg_unlocked_ioctl+0x10/0x10 [ 160.898510][ T6402] __x64_sys_ioctl+0x18e/0x210 [ 160.898569][ T6402] do_syscall_64+0x123/0x790 [ 160.898613][ T6402] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.898653][ T6402] RIP: 0033:0x7fb977f9e159 [ 160.898683][ T6402] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 160.898720][ T6402] RSP: 002b:00007fb978e3a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 160.898757][ T6402] RAX: ffffffffffffffda RBX: 00007fb978225fa0 RCX: 00007fb977f9e159 [ 160.898783][ T6402] RDX: 0000200000000200 RSI: 00000000400c4d04 RDI: 0000000000000003 [ 160.898808][ T6402] RBP: 00007fb97803506b R08: 0000000000000000 R09: 0000000000000000 [ 160.898832][ T6402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 160.898863][ T6402] R13: 00007fb978226038 R14: 00007fb978225fa0 R15: 00007ffce13f6d68 [ 160.898913][ T6402] [ 161.129528][ T6406] loop2: detected capacity change from 0 to 512 [ 161.143549][ T6406] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 161.423580][ T6406] EXT4-fs (loop2): 1 truncate cleaned up [ 161.443019][ T6406] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 161.936558][ T31] kauditd_printk_skb: 142 callbacks suppressed [ 161.936586][ T31] audit: type=1800 audit(1789749142.832:157): pid=6406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.190" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 162.109446][ T5624] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 162.389543][ T6420] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 162.457540][ T6425] netlink: 44 bytes leftover after parsing attributes in process `syz.0.196'. [ 162.491731][ T6426] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 162.926971][ T6288] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.927099][ T6288] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.927269][ T6288] bridge_slave_0: entered allmulticast mode [ 162.929531][ T6288] bridge_slave_0: entered promiscuous mode [ 162.949890][ T6288] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.950012][ T6288] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.950180][ T6288] bridge_slave_1: entered allmulticast mode [ 162.970603][ T6288] bridge_slave_1: entered promiscuous mode [ 163.251904][ T6444] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 163.337696][ T6454] loop5: detected capacity change from 0 to 512 [ 163.341481][ T6454] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 163.377787][ T6454] EXT4-fs (loop5): 1 truncate cleaned up [ 163.397748][ T6454] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 163.402512][ T6288] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 163.427588][ T31] audit: type=1800 audit(1789749144.332:158): pid=6454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.205" name="file1" dev="loop5" ino=15 res=0 errno=0 [ 163.458868][ T6288] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 163.549267][ T5622] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 163.626488][ T6288] team0: Port device team_slave_0 added [ 163.648049][ T6288] team0: Port device team_slave_1 added [ 163.829369][ T6460] loop5: detected capacity change from 0 to 512 [ 163.834528][ T6460] EXT4-fs: Ignoring removed nobh option [ 163.862816][ T6460] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 163.904675][ T6460] EXT4-fs (loop5): 1 truncate cleaned up [ 163.920687][ T6288] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 163.920711][ T6288] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 163.920756][ T6288] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 163.973596][ T6460] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 163.998770][ T6288] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 163.998797][ T6288] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 163.998842][ T6288] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 164.142970][ T6288] hsr_slave_0: entered promiscuous mode [ 164.144230][ T6288] hsr_slave_1: entered promiscuous mode [ 164.160941][ T6288] debugfs: 'hsr0' already exists in 'hsr' [ 164.160971][ T6288] Cannot create hsr debugfs directory [ 164.356627][ T6460] EXT4-fs warning (device loop5): ext4_expand_extra_isize_ea:2862: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 165.579459][ T5622] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 165.960919][ T6475] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 166.196541][ T13] IPVS: starting estimator thread 0... [ 166.295268][ T6479] IPVS: using max 23 ests per chain, 55200 per kthread [ 166.427518][ T6483] netlink: 44 bytes leftover after parsing attributes in process `syz.5.212'. [ 166.596313][ T6478] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 167.951483][ T31] audit: type=1326 audit(1789749148.852:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6490 comm="syz.4.219" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f42b719e159 code=0x0 [ 168.161369][ T6499] loop0: detected capacity change from 0 to 128 [ 169.568490][ T6288] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 169.588691][ T6288] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 169.591389][ T6288] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 170.397639][ T6288] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 170.398871][ T6288] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 170.457206][ T6288] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 170.460642][ T6288] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 170.488778][ T6288] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 170.746465][ T6544] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 170.747598][ T6544] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 170.810741][ T6550] loop4: detected capacity change from 0 to 512 [ 170.858503][ T6549] netlink: 44 bytes leftover after parsing attributes in process `syz.5.229'. [ 170.971588][ T6550] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 170.971716][ T6550] ext4 filesystem being mounted at /41/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 170.992128][ T6550] EXT4-fs error (device loop4): ext4_lookup:1787: inode #15: comm syz.4.230: invalid fast symlink length 10 [ 170.997179][ T6550] EXT4-fs (loop4): Remounting filesystem read-only [ 171.064661][ T6288] 8021q: adding VLAN 0 to HW filter on device bond0 [ 171.106842][ T6288] 8021q: adding VLAN 0 to HW filter on device team0 [ 171.140771][ T5890] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.140906][ T5890] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.203265][ T3304] bridge0: port 2(bridge_slave_1) entered blocking state [ 171.203405][ T3304] bridge0: port 2(bridge_slave_1) entered forwarding state [ 171.358235][ T5619] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.972416][ T6565] loop5: detected capacity change from 0 to 512 [ 172.252846][ T31] audit: type=1326 audit(1789749153.052:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6561 comm="syz.2.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7efe6c19e159 code=0x0 [ 174.371388][ T6593] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 174.398332][ T6593] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 174.898666][ T6608] netlink: 44 bytes leftover after parsing attributes in process `syz.5.245'. [ 176.183343][ T6632] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 176.648882][ T31] audit: type=1326 audit(1789749157.382:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6625 comm="syz.3.251" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f25ac19e159 code=0x0 [ 177.324670][ T1550] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 177.527814][ T1550] usb 6-1: Using ep0 maxpacket: 8 [ 177.537457][ T1550] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 177.553506][ T1550] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 177.553565][ T1550] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 177.553628][ T1550] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 177.553680][ T1550] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 177.553728][ T1550] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 177.553778][ T1550] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 177.553829][ T1550] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 177.553882][ T1550] usb 6-1: config 168 interface 0 has no altsetting 0 [ 177.563746][ T1550] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 177.563808][ T1550] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 177.563885][ T1550] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 177.563939][ T1550] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 177.563988][ T1550] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 177.564038][ T1550] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 177.564091][ T1550] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 177.564143][ T1550] usb 6-1: config 168 interface 0 has no altsetting 0 [ 177.566096][ T1550] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 177.566145][ T1550] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 177.566201][ T1550] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 177.566248][ T1550] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 177.566292][ T1550] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 177.566338][ T1550] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 177.566384][ T1550] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 177.566432][ T1550] usb 6-1: config 168 interface 0 has no altsetting 0 [ 177.586331][ T1550] usb 6-1: string descriptor 0 read error: -22 [ 177.586504][ T1550] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.051886][ T6648] geneve2: entered promiscuous mode [ 178.179870][ T1550] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 179.085630][ T6626] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.090684][ T6626] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.117616][ T6649] batman_adv: batadv0: Adding interface: syzkaller0 [ 179.117639][ T6649] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 179.117688][ T6649] batman_adv: batadv0: Interface activated: syzkaller0 [ 179.356703][ T6626] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.358904][ T6626] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.472941][ T6647] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 179.549693][ T6647] batman_adv: batadv0: Removing interface: syzkaller0 [ 179.610917][ T6626] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.611472][ T6626] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.659662][ T6662] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 179.679717][ T5739] usb 6-1: USB disconnect, device number 2 [ 179.716520][ T6288] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 179.716927][ T6663] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 180.198969][ T5739] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 180.228919][ T6677] loop4: detected capacity change from 0 to 128 [ 180.324458][ T6677] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 180.337854][ T5739] usb 6-1: device descriptor read/64, error -71 [ 180.348756][ T6677] ext4 filesystem being mounted at /46/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 180.514938][ T6683] netlink: 44 bytes leftover after parsing attributes in process `syz.2.261'. [ 180.675483][ T5739] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 181.029020][ T5619] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 182.116398][ T6703] loop5: detected capacity change from 0 to 1024 [ 183.982287][ T6288] veth0_vlan: entered promiscuous mode [ 184.513177][ T6717] loop4: detected capacity change from 0 to 128 [ 184.617644][ T6288] veth1_vlan: entered promiscuous mode [ 184.761257][ T6288] veth0_macvtap: entered promiscuous mode [ 184.885827][ T6288] veth1_macvtap: entered promiscuous mode [ 185.027537][ T6288] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 185.097358][ T6288] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 185.180858][ T6725] loop3: detected capacity change from 0 to 128 [ 185.240970][ T6723] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 185.251857][ T6723] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 185.495324][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.495409][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.497624][ T6600] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.520511][ T6135] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.706612][ T571] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 186.706645][ T571] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 186.897219][ T982] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 187.065423][ T982] usb 6-1: Using ep0 maxpacket: 8 [ 187.066356][ T982] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 187.068308][ T982] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 187.068365][ T982] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 187.068429][ T982] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 187.068485][ T982] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 187.068534][ T982] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 187.068586][ T982] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 187.068639][ T982] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 187.068694][ T982] usb 6-1: config 168 interface 0 has no altsetting 0 [ 187.070020][ T982] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 187.070071][ T982] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 187.070129][ T982] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 187.070181][ T982] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 187.070229][ T982] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 187.070279][ T982] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 187.070330][ T982] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 187.070384][ T982] usb 6-1: config 168 interface 0 has no altsetting 0 [ 187.071854][ T982] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 187.071903][ T982] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 187.071956][ T982] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 187.072004][ T982] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 187.072041][ T982] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 187.072079][ T982] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 187.072117][ T982] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 187.072156][ T982] usb 6-1: config 168 interface 0 has no altsetting 0 [ 187.115133][ T5760] page_pool_release_retry() stalled pool shutdown: id 30, 1 inflight 61 sec [ 187.140944][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.140976][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.301475][ T982] usb 6-1: string descriptor 0 read error: -22 [ 187.301668][ T982] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.441821][ T982] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 187.584902][ T6761] netlink: 12 bytes leftover after parsing attributes in process `syz.0.279'. [ 187.586685][ T6761] netlink: 16 bytes leftover after parsing attributes in process `syz.0.279'. [ 187.586718][ T6761] netlink: 12 bytes leftover after parsing attributes in process `syz.0.279'. [ 187.693789][ T6761] netlink: 16 bytes leftover after parsing attributes in process `syz.0.279'. [ 187.693827][ T6761] netlink: 5 bytes leftover after parsing attributes in process `syz.0.279'. [ 188.637504][ T6766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.666924][ T6766] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.697890][ T6766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.752411][ T6766] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.847038][ T6773] FAULT_INJECTION: forcing a failure. [ 188.847038][ T6773] name failslab, interval 1, probability 0, space 0, times 0 [ 188.847088][ T6773] CPU: 0 UID: 0 PID: 6773 Comm: syz.4.282 Not tainted syzkaller #0 PREEMPT(full) [ 188.847133][ T6773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 188.847156][ T6773] Call Trace: [ 188.847168][ T6773] [ 188.847182][ T6773] dump_stack_lvl+0x100/0x190 [ 188.847243][ T6773] should_fail_ex.cold+0x5/0xa [ 188.847287][ T6773] ? srso_alias_return_thunk+0x5/0xfbef5 [ 188.847342][ T6773] should_failslab+0xc2/0x120 [ 188.847382][ T6773] __kmalloc_noprof+0xfc/0x840 [ 188.847442][ T6773] ? __register_sysctl_table+0xac/0x1650 [ 188.847505][ T6773] __register_sysctl_table+0xac/0x1650 [ 188.847555][ T6773] ? trace_kmalloc+0xeb/0x110 [ 188.847591][ T6773] ? srso_alias_return_thunk+0x5/0xfbef5 [ 188.847638][ T6773] ? __kasan_kmalloc+0xaa/0xb0 [ 188.847705][ T6773] ? __kmalloc_node_track_caller_noprof+0x35b/0x870 [ 188.847772][ T6773] ? __pfx___register_sysctl_table+0x10/0x10 [ 188.847823][ T6773] ? setup_mq_sysctls+0x5d/0x240 [ 188.847885][ T6773] ? srso_alias_return_thunk+0x5/0xfbef5 [ 188.847933][ T6773] ? __asan_memcpy+0x3c/0x60 [ 188.847998][ T6773] setup_mq_sysctls+0x124/0x240 [ 188.848066][ T6773] copy_ipcs+0x524/0x7e0 [ 188.848126][ T6773] create_new_namespaces+0x20a/0xac0 [ 188.848169][ T6773] ? security_capable+0x80/0x260 [ 188.848225][ T6773] unshare_nsproxy_namespaces+0xf2/0x220 [ 188.848273][ T6773] ksys_unshare+0x4a2/0xa70 [ 188.848318][ T6773] ? __pfx_ksys_unshare+0x10/0x10 [ 188.848359][ T6773] ? srso_alias_return_thunk+0x5/0xfbef5 [ 188.848426][ T6773] __x64_sys_unshare+0x31/0x40 [ 188.848469][ T6773] do_syscall_64+0x123/0x790 [ 188.848513][ T6773] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 188.848553][ T6773] RIP: 0033:0x7f42b719e159 [ 188.848582][ T6773] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 188.848619][ T6773] RSP: 002b:00007f42b7ff3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 188.848656][ T6773] RAX: ffffffffffffffda RBX: 00007f42b7425fa0 RCX: 00007f42b719e159 [ 188.848683][ T6773] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c000400 [ 188.848706][ T6773] RBP: 00007f42b723506b R08: 0000000000000000 R09: 0000000000000000 [ 188.848730][ T6773] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 188.848754][ T6773] R13: 00007f42b7426038 R14: 00007f42b7425fa0 R15: 00007ffd81915888 [ 188.848805][ T6773] [ 189.105353][ T6772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 189.119349][ T6772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 189.180255][ T5345] usb 6-1: USB disconnect, device number 5 [ 189.224578][ T6781] loop6: detected capacity change from 0 to 128 [ 189.530451][ T6788] loop3: detected capacity change from 0 to 128 [ 189.737411][ T5345] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 189.867171][ T5345] usb 6-1: device descriptor read/64, error -71 [ 190.106138][ T5345] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 190.295883][ T5345] usb 6-1: device descriptor read/64, error -71 [ 190.493354][ T5345] usb usb6-port1: attempt power cycle [ 192.599671][ T6821] loop3: detected capacity change from 0 to 128 [ 192.613697][ T6821] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 193.677787][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.677872][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.352646][ T6833] loop4: detected capacity change from 0 to 512 [ 194.418955][ T6833] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 194.419226][ T6833] ext4 filesystem being mounted at /55/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 194.453057][ T6841] loop2: detected capacity change from 0 to 128 [ 194.534804][ T6842] loop5: detected capacity change from 0 to 128 [ 194.641014][ T31] audit: type=1800 audit(1789749175.542:162): pid=6842 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.300" name="file1" dev="loop5" ino=1048618 res=0 errno=0 [ 194.803417][ T6845] loop6: detected capacity change from 0 to 128 [ 194.864882][ T5619] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 194.992357][ T6842] syz.5.300: attempt to access beyond end of device [ 194.992357][ T6842] loop5: rw=2049, sector=138, nr_sectors = 112 limit=128 [ 197.240700][ T6891] loop0: detected capacity change from 0 to 512 [ 197.251641][ T6891] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 197.288479][ T6891] EXT4-fs (loop0): 1 truncate cleaned up [ 197.315952][ T6891] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 197.532587][ T5623] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 197.680855][ T6906] loop6: detected capacity change from 0 to 128 [ 197.781063][ T6908] loop0: detected capacity change from 0 to 128 [ 197.943215][ T6911] loop3: detected capacity change from 0 to 512 [ 198.016120][ T6911] EXT4-fs error (device loop3): ext4_orphan_get:1403: inode #15: comm syz.3.319: iget: bad i_size value: 38620345925642 [ 198.016173][ T6911] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 198.016661][ T6911] EXT4-fs error (device loop3): ext4_orphan_get:1406: comm syz.3.319: couldn't read orphan inode 15 (err -117) [ 198.016715][ T6911] loop3: lost filesystem error report for type 5 error -117 [ 198.202567][ T6911] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 198.466686][ T6923] EXT4-fs error (device loop3): ext4_validate_block_bitmap:435: comm syz.3.319: bg 0: block 5: invalid block bitmap [ 198.501881][ T6923] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 84 with error 28 [ 198.501932][ T6923] EXT4-fs (loop3): This should not happen!! Data will be lost [ 198.501932][ T6923] [ 198.501958][ T6923] EXT4-fs (loop3): Total free blocks count 0 [ 198.563983][ T6923] EXT4-fs (loop3): Free/Dirty block details [ 198.564038][ T6923] EXT4-fs (loop3): free_blocks=0 [ 198.564080][ T6923] EXT4-fs (loop3): dirty_blocks=84 [ 198.564105][ T6923] EXT4-fs (loop3): Block reservation details [ 198.621562][ T6923] EXT4-fs (loop3): i_reserved_data_blocks=84 [ 198.646164][ T6927] EXT4-fs (loop3): shut down requested (0) [ 200.749310][ T6947] netlink: 8 bytes leftover after parsing attributes in process `syz.0.326'. [ 201.021670][ T6953] loop2: detected capacity change from 0 to 512 [ 201.036619][ T6953] EXT4-fs error (device loop2): ext4_orphan_get:1403: inode #15: comm syz.2.328: iget: bad i_size value: 38620345925642 [ 201.036670][ T6953] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 201.037133][ T6953] EXT4-fs error (device loop2): ext4_orphan_get:1406: comm syz.2.328: couldn't read orphan inode 15 (err -117) [ 201.037179][ T6953] loop2: lost filesystem error report for type 5 error -117 [ 201.039840][ T6953] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 201.681187][ T6957] loop6: detected capacity change from 0 to 512 [ 202.209496][ T6957] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 202.261135][ T6957] EXT4-fs (loop6): 1 truncate cleaned up [ 202.270038][ T6957] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 202.373943][ T6278] EXT4-fs error (device loop2): ext4_validate_block_bitmap:435: comm kworker/u8:17: bg 0: block 5: invalid block bitmap [ 202.411643][ T6278] EXT4-fs (loop2): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 516 with error 28 [ 202.411692][ T6278] EXT4-fs (loop2): This should not happen!! Data will be lost [ 202.411692][ T6278] [ 202.411717][ T6278] EXT4-fs (loop2): Total free blocks count 0 [ 202.411741][ T6278] EXT4-fs (loop2): Free/Dirty block details [ 202.411769][ T6278] EXT4-fs (loop2): free_blocks=0 [ 202.411797][ T6278] EXT4-fs (loop2): dirty_blocks=516 [ 202.411820][ T6278] EXT4-fs (loop2): Block reservation details [ 202.411842][ T6278] EXT4-fs (loop2): i_reserved_data_blocks=516 [ 202.640019][ T5624] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 202.712315][ T6976] sg_write: data in/out 404444/42 bytes for SCSI command 0x0-- guessing data in; [ 202.712315][ T6976] program syz.5.336 not setting count and/or reply_len properly [ 202.868642][ T6980] loop2: detected capacity change from 0 to 128 [ 203.083404][ T6982] geneve2: entered promiscuous mode [ 203.777607][ T6288] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 204.641169][ T7003] netlink: 8 bytes leftover after parsing attributes in process `syz.2.342'. [ 204.966835][ T7005] netlink: 20 bytes leftover after parsing attributes in process `syz.6.338'. [ 204.987202][ T7005] netlink: 8 bytes leftover after parsing attributes in process `syz.6.338'. [ 205.369345][ T7013] loop2: detected capacity change from 0 to 512 [ 205.411709][ T7013] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 205.556470][ T7013] EXT4-fs (loop2): 1 truncate cleaned up [ 205.565059][ T7013] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 205.806665][ T7024] loop4: detected capacity change from 0 to 128 [ 205.924720][ T5624] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 206.039923][ T7028] sctp: [Deprecated]: syz.3.355 (pid 7028) Use of int in max_burst socket option. [ 206.039923][ T7028] Use struct sctp_assoc_value instead [ 206.742500][ T7031] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 208.567758][ T7048] netlink: 8 bytes leftover after parsing attributes in process `syz.4.362'. [ 210.253699][ T7068] loop5: detected capacity change from 0 to 512 [ 210.318345][ T7068] EXT4-fs error (device loop5) in ext4_process_orphan:346: Out of memory [ 210.318383][ T7068] loop5: lost filesystem error report for type 5 error -12 [ 210.325077][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 210.325111][ C0] EXT4-fs (loop5): initial error at time 1789749191: ext4_process_orphan:346 [ 210.325151][ C0] EXT4-fs (loop5): last error at time 1789749191: ext4_process_orphan:346 [ 210.395574][ T7068] EXT4-fs (loop5): 2 truncates cleaned up [ 210.420072][ T7068] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 210.487788][ T7080] loop4: detected capacity change from 0 to 128 [ 211.212113][ T7084] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 214.411380][ T7109] netlink: 20 bytes leftover after parsing attributes in process `syz.0.381'. [ 215.485594][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 215.667226][ T7072] EXT4-fs error (device loop5): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 5: invalid block bitmap [ 218.836351][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 220.402890][ T7136] netlink: 8 bytes leftover after parsing attributes in process `syz.6.391'. [ 220.493665][ T7141] loop4: detected capacity change from 0 to 1024 [ 220.520563][ T7081] EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 6 with error 28 [ 220.520611][ T7081] EXT4-fs (loop5): This should not happen!! Data will be lost [ 220.520611][ T7081] [ 220.520636][ T7081] EXT4-fs (loop5): Total free blocks count 0 [ 220.520660][ T7081] EXT4-fs (loop5): Free/Dirty block details [ 220.520683][ T7081] EXT4-fs (loop5): free_blocks=0 [ 220.520706][ T7081] EXT4-fs (loop5): dirty_blocks=1678 [ 220.520729][ T7081] EXT4-fs (loop5): Block reservation details [ 220.520750][ T7081] EXT4-fs (loop5): i_reserved_data_blocks=1678 [ 220.698420][ T7141] EXT4-fs (loop4): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 220.777229][ T7141] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 220.884338][ T31] audit: type=1800 audit(1789749201.782:163): pid=7141 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.393" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 220.997728][ T7081] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.217120][ T5619] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.835374][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 222.322225][ T7156] netlink: 20 bytes leftover after parsing attributes in process `syz.6.396'. [ 223.165627][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 225.016987][ T5625] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 225.018521][ T5625] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 225.019186][ T5625] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 225.020257][ T5625] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 225.021314][ T5625] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 226.658844][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 226.658904][ T52] Bluetooth: hci5: command 0x0406 tx timeout [ 226.658974][ T52] Bluetooth: hci1: command 0x0406 tx timeout [ 226.659079][ T5625] Bluetooth: hci3: command 0x0406 tx timeout [ 227.118451][ T7194] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 227.140142][ T5625] Bluetooth: hci0: command tx timeout [ 228.462658][ T7206] netlink: 20 bytes leftover after parsing attributes in process `syz.3.411'. [ 229.105656][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 230.842079][ T7214] Config c/1 of g1 needs at least one function. [ 230.842917][ T7214] udc dummy_udc.0: failed to start g1: -22 [ 230.849863][ T7214] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 230.876739][ T7214] UDC core: g1: couldn't find an available UDC or it's busy [ 232.276951][ T7247] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 232.951950][ T7252] loop6: detected capacity change from 0 to 256 [ 232.986889][ T7252] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 233.051863][ T7252] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 233.825037][ T7259] netlink: 20 bytes leftover after parsing attributes in process `syz.0.426'. [ 234.225573][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 234.638336][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 235.350083][ T7262] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 235.463015][ T7267] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 235.612213][ T7275] loop3: detected capacity change from 0 to 128 [ 236.949090][ T7284] smpboot: CPU 1 is now offline [ 239.580492][ T7296] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 239.924588][ T7289] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 240.593186][ T7305] loop0: detected capacity change from 0 to 1024 [ 241.344939][ T7313] netlink: 20 bytes leftover after parsing attributes in process `syz.2.442'. [ 242.037276][ T7179] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.037466][ T7179] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.037655][ T7179] bridge_slave_0: entered allmulticast mode [ 242.040019][ T7179] bridge_slave_0: entered promiscuous mode [ 242.046006][ T7179] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.046129][ T7179] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.046298][ T7179] bridge_slave_1: entered allmulticast mode [ 242.048588][ T7179] bridge_slave_1: entered promiscuous mode [ 242.237945][ T7324] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 242.286483][ T7179] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 242.287699][ T7324] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 242.303665][ T7179] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 242.376082][ T7330] loop3: detected capacity change from 0 to 128 [ 242.393919][ T7330] EXT4-fs (loop3): Test dummy encryption mode enabled [ 242.425978][ T7330] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 242.428761][ T7330] ext4 filesystem being mounted at /93/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 242.719400][ T7179] team0: Port device team_slave_0 added [ 243.219936][ T7338] fscrypt: AES-256-XTS using blk-crypto-fallback [ 243.387217][ T7179] team0: Port device team_slave_1 added [ 244.832454][ T5621] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 245.020385][ T7179] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 245.020411][ T7179] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 245.020457][ T7179] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 246.160026][ T7355] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 246.232665][ T1482] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.279685][ T7179] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 246.279706][ T7179] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 246.279741][ T7179] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 247.183348][ T7363] netlink: 20 bytes leftover after parsing attributes in process `syz.0.457'. [ 248.931112][ T7179] hsr_slave_0: entered promiscuous mode [ 248.951978][ T7369] loop3: detected capacity change from 0 to 1024 [ 248.973804][ T7179] hsr_slave_1: entered promiscuous mode [ 249.024245][ T7179] debugfs: 'hsr0' already exists in 'hsr' [ 249.024295][ T7179] Cannot create hsr debugfs directory [ 250.286921][ T1482] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.268440][ T31] audit: type=1800 audit(1789749232.172:164): pid=7390 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.470" name=08 dev="sda1" ino=2054 res=0 errno=0 [ 253.173007][ T1482] bond0: (slave netdevsim1): Releasing backup interface [ 253.252916][ T1482] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 253.786121][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 254.264475][ T7410] netlink: 20 bytes leftover after parsing attributes in process `syz.4.471'. [ 255.380702][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.380778][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.731779][ T1482] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.017417][ T7416] loop3: detected capacity change from 0 to 1024 [ 256.733669][ T7419] loop0: detected capacity change from 0 to 512 [ 258.207446][ T7431] loop6: detected capacity change from 0 to 512 [ 258.232219][ T7431] EXT4-fs: Ignoring removed bh option [ 258.232324][ T7431] ext4: Unknown parameter 'uid>00000000000000000000' [ 258.284864][ T7431] netlink: 4768 bytes leftover after parsing attributes in process `syz.6.482'. [ 258.586078][ T7436] FAULT_INJECTION: forcing a failure. [ 258.586078][ T7436] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 258.586131][ T7436] CPU: 1 UID: 0 PID: 7436 Comm: syz.3.484 Not tainted syzkaller #0 PREEMPT(full) [ 258.586175][ T7436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 258.586198][ T7436] Call Trace: [ 258.586210][ T7436] [ 258.586225][ T7436] dump_stack_lvl+0x100/0x190 [ 258.586286][ T7436] should_fail_ex.cold+0x5/0xa [ 258.586338][ T7436] strncpy_from_user+0x3b/0x2d0 [ 258.586399][ T7436] __do_sys_add_key+0xd4/0x460 [ 258.586449][ T7436] ? __pfx___do_sys_add_key+0x10/0x10 [ 258.586503][ T7436] ? srso_alias_return_thunk+0x5/0xfbef5 [ 258.586559][ T7436] do_syscall_64+0x123/0x790 [ 258.586602][ T7436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.586643][ T7436] RIP: 0033:0x7f25ac19e159 [ 258.586672][ T7436] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 258.586708][ T7436] RSP: 002b:00007f25acfe1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 258.586750][ T7436] RAX: ffffffffffffffda RBX: 00007f25ac425fa0 RCX: 00007f25ac19e159 [ 258.586775][ T7436] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 258.586798][ T7436] RBP: 00007f25ac23506b R08: 0000000000000000 R09: 0000000000000000 [ 258.586822][ T7436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 258.586845][ T7436] R13: 00007f25ac426038 R14: 00007f25ac425fa0 R15: 00007ffd332320b8 [ 258.586896][ T7436] [ 259.197623][ T7443] loop3: detected capacity change from 0 to 128 [ 259.845634][ T7446] netlink: 20 bytes leftover after parsing attributes in process `syz.6.488'. [ 261.097028][ T1482] bridge_slave_1: left allmulticast mode [ 261.097100][ T1482] bridge_slave_1: left promiscuous mode [ 261.099315][ T1482] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.189571][ T1482] bridge_slave_0: left allmulticast mode [ 261.189609][ T1482] bridge_slave_0: left promiscuous mode [ 261.189863][ T1482] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.989774][ T7462] loop0: detected capacity change from 0 to 1024 [ 264.039746][ T1482] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 264.074874][ T1482] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 264.119858][ T1482] bond0 (unregistering): Released all slaves [ 264.200229][ T7179] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 264.228809][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 264.238247][ T7451] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 264.239614][ T7179] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 264.365873][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 264.383195][ T7453] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 264.912517][ T5274] 8021q: adding VLAN 0 to HW filter on device eth1 [ 265.013588][ T7179] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 265.376103][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 265.489776][ T7495] FAULT_INJECTION: forcing a failure. [ 265.489776][ T7495] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 265.489833][ T7495] CPU: 0 UID: 0 PID: 7495 Comm: syz.3.497 Not tainted syzkaller #0 PREEMPT(full) [ 265.489881][ T7495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 265.489905][ T7495] Call Trace: [ 265.489919][ T7495] [ 265.489934][ T7495] dump_stack_lvl+0x100/0x190 [ 265.489998][ T7495] should_fail_ex.cold+0x5/0xa [ 265.490054][ T7495] strncpy_from_user+0x3b/0x2d0 [ 265.490122][ T7495] __do_sys_add_key+0xd4/0x460 [ 265.490177][ T7495] ? __pfx___do_sys_add_key+0x10/0x10 [ 265.490238][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 265.490300][ T7495] do_syscall_64+0x123/0x790 [ 265.490349][ T7495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.490393][ T7495] RIP: 0033:0x7f25ac19e159 [ 265.490425][ T7495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 265.490465][ T7495] RSP: 002b:00007f25acfe1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 265.490508][ T7495] RAX: ffffffffffffffda RBX: 00007f25ac425fa0 RCX: 00007f25ac19e159 [ 265.490534][ T7495] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 265.490556][ T7495] RBP: 00007f25ac23506b R08: 0000000000000000 R09: 0000000000000000 [ 265.490580][ T7495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 265.490603][ T7495] R13: 00007f25ac426038 R14: 00007f25ac425fa0 R15: 00007ffd332320b8 [ 265.490653][ T7495] [ 266.218643][ T7179] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 266.394094][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 266.924637][ T7514] sctp: [Deprecated]: syz.6.490 (pid 7514) Use of int in max_burst socket option. [ 266.924637][ T7514] Use struct sctp_assoc_value instead [ 268.161436][ T7524] netlink: 20 bytes leftover after parsing attributes in process `syz.0.501'. [ 269.556588][ T7528] loop6: detected capacity change from 0 to 128 [ 270.146220][ T1482] hsr_slave_0: left promiscuous mode [ 270.153453][ T1482] hsr_slave_1: left promiscuous mode [ 270.154692][ T1482] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 270.154753][ T1482] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 270.194061][ T1482] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 270.200880][ T1482] batman_adv: batadv0: Removing interface: batadv_slave_1 ^}@‘Æ] *$%(*^:.[} devtmpfs[ 270.428356][ T1482] veth1_macvtap: left promiscuous mode [ 270.428438][ T1482] veth0_macvtap: left promiscuous mode [ 270.440227][ T1482] veth1_vlan: left promiscuous mode [ 270.440365][ T1482] veth0_vlan: left promiscuous mode [ 270.866817][ T7554] FAULT_INJECTION: forcing a failure. [ 270.866817][ T7554] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 270.866869][ T7554] CPU: 0 UID: 0 PID: 7554 Comm: syz.3.511 Not tainted syzkaller #0 PREEMPT(full) [ 270.866913][ T7554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 270.866940][ T7554] Call Trace: [ 270.866952][ T7554] [ 270.866966][ T7554] dump_stack_lvl+0x100/0x190 [ 270.867033][ T7554] should_fail_ex.cold+0x5/0xa [ 270.867084][ T7554] strncpy_from_user+0x3b/0x2d0 [ 270.867145][ T7554] __do_sys_add_key+0xd4/0x460 [ 270.867195][ T7554] ? __pfx___do_sys_add_key+0x10/0x10 [ 270.867250][ T7554] ? srso_alias_return_thunk+0x5/0xfbef5 [ 270.867306][ T7554] do_syscall_64+0x123/0x790 [ 270.867350][ T7554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 270.867390][ T7554] RIP: 0033:0x7f25ac19e159 [ 270.867420][ T7554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 270.867457][ T7554] RSP: 002b:00007f25acfe1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 270.867493][ T7554] RAX: ffffffffffffffda RBX: 00007f25ac425fa0 RCX: 00007f25ac19e159 [ 270.867519][ T7554] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 270.867542][ T7554] RBP: 00007f25ac23506b R08: 0000000000000000 R09: 0000000000000000 [ 270.867566][ T7554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 270.867590][ T7554] R13: 00007f25ac426038 R14: 00007f25ac425fa0 R15: 00007ffd332320b8 [ 270.867640][ T7554] [ 271.482579][ T7565] sctp: [Deprecated]: syz.3.513 (pid 7565) Use of int in max_burst socket option. [ 271.482579][ T7565] Use struct sctp_assoc_value instead [ 272.625985][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 273.150506][ T7582] netlink: 20 bytes leftover after parsing attributes in process `syz.2.517'. [ 274.749214][ T1482] team0 (unregistering): Port device team_slave_1 removed [ 274.804575][ T1482] team0 (unregistering): Port device team_slave_0 removed [ 275.106259][ T7550] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 275.107222][ T7553] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 275.201624][ T5274] 8021q: adding VLAN 0 to HW filter on device eth3 [ 275.537769][ T7179] 8021q: adding VLAN 0 to HW filter on device bond0 [ 275.611074][ T7179] 8021q: adding VLAN 0 to HW filter on device team0 [ 275.653635][ T6134] bridge0: port 1(bridge_slave_0) entered blocking state [ 275.653768][ T6134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 275.719014][ T6600] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.719161][ T6600] bridge0: port 2(bridge_slave_1) entered forwarding state [ 276.715811][ T571] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 277.235264][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 277.894756][ T7633] netlink: 20 bytes leftover after parsing attributes in process `syz.0.530'. [ 278.964014][ T4928] Bluetooth: hci6: command 0x0406 tx timeout [ 279.007807][ T571] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.490004][ T7641] loop2: detected capacity change from 0 to 128 [ 279.644369][ T571] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.728738][ T7645] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 279.747475][ T7646] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 280.009230][ T571] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 281.304390][ T5274] 8021q: adding VLAN 0 to HW filter on device eth2 [ 281.399843][ T7662] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 282.762347][ T7674] ieee802154 phy0 wpan0: encryption failed: -22 [ 283.016479][ T571] bridge_slave_1: left allmulticast mode [ 283.016517][ T571] bridge_slave_1: left promiscuous mode [ 283.016780][ T571] bridge0: port 2(bridge_slave_1) entered disabled state [ 283.083395][ T571] bridge_slave_0: left allmulticast mode [ 283.083454][ T571] bridge_slave_0: left promiscuous mode [ 283.098864][ T571] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.168855][ T7684] loop2: detected capacity change from 0 to 128 [ 283.227070][ T7684] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 283.229770][ T7684] ext4 filesystem being mounted at /94/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 283.936149][ T7694] netlink: 20 bytes leftover after parsing attributes in process `syz.6.544'. [ 285.521596][ T5624] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 286.099712][ T571] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 286.150725][ T571] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 286.237694][ T571] bond0 (unregistering): Released all slaves [ 286.264139][ T4928] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 286.273553][ T4928] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 286.276091][ T4928] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 286.277195][ T4928] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 286.277910][ T4928] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 288.315164][ T5631] Bluetooth: hci4: command tx timeout [ 288.377266][ T7732] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 288.602417][ T7737] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 289.582792][ T571] hsr_slave_0: left promiscuous mode [ 289.608999][ T571] hsr_slave_1: left promiscuous mode [ 289.613294][ T571] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 289.613324][ T571] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 289.646314][ T571] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 289.646351][ T571] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 289.729241][ T571] veth1_macvtap: left promiscuous mode [ 289.729297][ T571] veth0_macvtap: left promiscuous mode [ 289.729551][ T571] veth1_vlan: left promiscuous mode [ 289.729644][ T571] veth0_vlan: left promiscuous mode [ 289.910646][ T7750] loop0: detected capacity change from 0 to 128 [ 290.038643][ T7750] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 290.068733][ T7750] ext4 filesystem being mounted at /103/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 290.385601][ T5631] Bluetooth: hci4: command tx timeout [ 290.656937][ T5623] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 290.831564][ T7764] loop6: detected capacity change from 0 to 128 [ 291.389621][ T571] team0 (unregistering): Port device team_slave_1 removed [ 291.440270][ T571] team0 (unregistering): Port device team_slave_0 removed [ 292.467019][ T5631] Bluetooth: hci4: command tx timeout [ 293.205381][ T7794] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 293.364767][ T7795] netlink: 20 bytes leftover after parsing attributes in process `syz.3.567'. [ 293.857621][ T5274] 8021q: adding VLAN 0 to HW filter on device eth4 [ 294.545156][ T5631] Bluetooth: hci4: command tx timeout [ 294.957201][ T1550] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 295.232973][ T7814] loop4: detected capacity change from 0 to 128 [ 295.296847][ T1550] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 295.298246][ T1550] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 295.298295][ T1550] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 295.298340][ T1550] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 295.298404][ T1550] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.307932][ T7806] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 295.791045][ T1550] aiptek 3-1:17.0: Aiptek using 400 ms programming speed [ 295.840675][ T1550] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.0/input/input5 [ 296.003070][ T7833] loop4: detected capacity change from 0 to 512 [ 296.024129][ T7833] EXT4-fs warning (device loop4): read_mmp_block:109: Error -117 while reading MMP block 12 [ 296.337789][ T1550] usb 3-1: USB disconnect, device number 2 [ 296.337876][ C0] aiptek 3-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 299.271675][ T5274] 8021q: adding VLAN 0 to HW filter on device eth5 [ 300.065210][ T7875] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 302.710595][ T7897] capability: warning: `syz.3.594' uses deprecated v2 capabilities in a way that may be insecure [ 304.323859][ T7708] bridge0: port 1(bridge_slave_0) entered blocking state [ 304.323984][ T7708] bridge0: port 1(bridge_slave_0) entered disabled state [ 304.324172][ T7708] bridge_slave_0: entered allmulticast mode [ 304.379278][ T7708] bridge_slave_0: entered promiscuous mode [ 304.781947][ T7934] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 304.850108][ T7708] bridge0: port 2(bridge_slave_1) entered blocking state [ 304.850327][ T7708] bridge0: port 2(bridge_slave_1) entered disabled state [ 304.850518][ T7708] bridge_slave_1: entered allmulticast mode [ 304.856032][ T7708] bridge_slave_1: entered promiscuous mode [ 306.249031][ T7708] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 306.516168][ T7708] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 307.546297][ T571] bridge_slave_1: left allmulticast mode [ 307.546335][ T571] bridge_slave_1: left promiscuous mode [ 307.546600][ T571] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.575221][ T571] bridge_slave_0: left allmulticast mode [ 307.575257][ T571] bridge_slave_0: left promiscuous mode [ 307.581921][ T571] bridge0: port 1(bridge_slave_0) entered disabled state [ 308.850688][ T7979] loop3: detected capacity change from 0 to 128 [ 309.047166][ T7979] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 309.207847][ T7979] ext4 filesystem being mounted at /134/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 309.739198][ T7993] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 310.464613][ T8006] sctp: [Deprecated]: syz.4.620 (pid 8006) Use of int in max_burst socket option. [ 310.464613][ T8006] Use struct sctp_assoc_value instead [ 310.692103][ T5621] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 310.960881][ T571] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 310.989428][ T571] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 311.012111][ T571] bond0 (unregistering): Released all slaves [ 311.076225][ T7708] team0: Port device team_slave_0 added [ 311.228171][ T5274] 8021q: adding VLAN 0 to HW filter on device eth6 [ 311.237697][ T7708] team0: Port device team_slave_1 added [ 311.611955][ T571] hsr_slave_0: left promiscuous mode [ 311.624124][ T571] hsr_slave_1: left promiscuous mode [ 311.630433][ T571] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 311.644545][ T571] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 313.234406][ T31] audit: type=1800 audit(1789749294.132:165): pid=8031 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.628" name=08 dev="sda1" ino=2054 res=0 errno=0 [ 313.561740][ T8037] netlink: 20 bytes leftover after parsing attributes in process `syz.4.631'. [ 313.608939][ T8040] loop2: detected capacity change from 0 to 128 [ 313.699564][ T8040] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 313.703348][ T8040] ext4 filesystem being mounted at /114/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 313.900410][ T8048] sctp: [Deprecated]: syz.0.633 (pid 8048) Use of int in max_burst socket option. [ 313.900410][ T8048] Use struct sctp_assoc_value instead [ 314.467003][ T571] team0 (unregistering): Port device team_slave_1 removed [ 314.501431][ T5624] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 314.601936][ T571] team0 (unregistering): Port device team_slave_0 removed [ 314.884389][ T8052] usb usb7: check_ctrlrecip: process 8052 (syz.6.634) requesting ep 01 but needs 81 [ 314.884442][ T8052] usb usb7: usbfs: process 8052 (syz.6.634) did not claim interface 0 before use [ 315.936046][ T8060] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 316.240787][ T7708] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 316.240814][ T7708] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 316.240860][ T7708] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 316.243169][ T7708] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 316.243191][ T7708] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 316.243236][ T7708] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 316.555632][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.555715][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.699628][ T7708] hsr_slave_0: entered promiscuous mode [ 316.704560][ T7708] hsr_slave_1: entered promiscuous mode [ 316.719858][ T7708] debugfs: 'hsr0' already exists in 'hsr' [ 316.719889][ T7708] Cannot create hsr debugfs directory [ 316.776757][ T1550] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 316.931852][ T1550] usb 7-1: Using ep0 maxpacket: 8 [ 316.935183][ T1550] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 316.938112][ T1550] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 316.938162][ T1550] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 316.938222][ T1550] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 316.938270][ T1550] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 316.938314][ T1550] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 316.938359][ T1550] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 316.938406][ T1550] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 316.938455][ T1550] usb 7-1: config 168 interface 0 has no altsetting 0 [ 316.940504][ T1550] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 316.940553][ T1550] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 316.940608][ T1550] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 316.940656][ T1550] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 316.940700][ T1550] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 316.940745][ T1550] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 316.940792][ T1550] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 316.940840][ T1550] usb 7-1: config 168 interface 0 has no altsetting 0 [ 316.943584][ T1550] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 316.943632][ T1550] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 316.943688][ T1550] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 316.943735][ T1550] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 316.943779][ T1550] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 316.943824][ T1550] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 316.943871][ T1550] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 316.943918][ T1550] usb 7-1: config 168 interface 0 has no altsetting 0 [ 316.961747][ T1550] usb 7-1: string descriptor 0 read error: -22 [ 316.961904][ T1550] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.043896][ T1550] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 317.690074][ T8084] netlink: 'syz.4.645': attribute type 10 has an invalid length. [ 317.720710][ T8066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 317.723351][ T8066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 317.747510][ T8066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 317.756901][ T8066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 317.872602][ T8091] sctp: [Deprecated]: syz.3.647 (pid 8091) Use of int in max_burst socket option. [ 317.872602][ T8091] Use struct sctp_assoc_value instead [ 318.209862][ T8066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 318.220896][ T8066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 318.232193][ T982] usb 7-1: USB disconnect, device number 2 [ 318.250089][ T8084] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 318.279486][ T8084] team0: Port device netdevsim1 added [ 318.787542][ T8099] loop2: detected capacity change from 0 to 128 [ 318.825460][ T982] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 318.849642][ T8099] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 318.851599][ T8099] ext4 filesystem being mounted at /118/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 318.955649][ T6278] IPVS: starting estimator thread 0... [ 318.972328][ T982] usb 7-1: device descriptor read/64, error -71 [ 319.045461][ T8107] IPVS: using max 22 ests per chain, 52800 per kthread [ 319.092352][ T5624] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 319.226737][ T982] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 319.355192][ T982] usb 7-1: device descriptor read/64, error -71 [ 319.644707][ T8119] loop4: detected capacity change from 0 to 1024 [ 319.790119][ T982] usb usb7-port1: attempt power cycle [ 320.624352][ T982] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 320.856542][ T982] usb 7-1: device not accepting address 5, error -71 [ 321.381651][ T8134] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 321.851454][ T5274] 8021q: adding VLAN 0 to HW filter on device eth7 [ 322.285879][ T8153] sctp: [Deprecated]: syz.2.661 (pid 8153) Use of int in max_burst socket option. [ 322.285879][ T8153] Use struct sctp_assoc_value instead [ 322.814177][ T7708] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 322.848349][ T7708] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 322.851793][ T7708] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 322.904518][ T7708] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 322.913113][ T7708] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 322.973244][ T7708] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 322.990218][ T7708] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 323.078529][ T7708] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 323.654749][ T7708] 8021q: adding VLAN 0 to HW filter on device bond0 [ 323.795782][ T7708] 8021q: adding VLAN 0 to HW filter on device team0 [ 323.863305][ T3290] bridge0: port 1(bridge_slave_0) entered blocking state [ 323.863459][ T3290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 324.068160][ T3290] bridge0: port 2(bridge_slave_1) entered blocking state [ 324.068332][ T3290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 324.942650][ T5740] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 325.301107][ T5740] usb 1-1: Using ep0 maxpacket: 8 [ 325.301816][ T5740] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 325.312892][ T5740] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 325.312941][ T5740] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 325.312998][ T5740] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 325.313046][ T5740] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 325.313089][ T5740] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 325.313135][ T5740] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 325.313184][ T5740] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 325.313232][ T5740] usb 1-1: config 168 interface 0 has no altsetting 0 [ 325.314532][ T5740] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 325.314580][ T5740] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 325.314646][ T5740] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 325.314691][ T5740] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 325.314735][ T5740] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 325.314781][ T5740] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 325.314828][ T5740] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 325.314876][ T5740] usb 1-1: config 168 interface 0 has no altsetting 0 [ 325.974311][ T8211] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 326.753895][ T5740] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 326.753951][ T5740] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 326.754012][ T5740] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 326.754061][ T5740] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 326.754113][ T5740] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 326.754160][ T5740] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 326.754208][ T5740] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 326.754257][ T5740] usb 1-1: config 168 interface 0 has no altsetting 0 [ 327.014134][ T5740] usb 1-1: string descriptor 0 read error: -22 [ 327.014302][ T5740] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.074409][ T5740] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 327.290234][ T8221] sctp: [Deprecated]: syz.6.675 (pid 8221) Use of int in max_burst socket option. [ 327.290234][ T8221] Use struct sctp_assoc_value instead [ 327.821043][ T8227]  [ 328.177712][ T8192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.183341][ T8192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.285911][ T8192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.302978][ T8192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.712873][ T8192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.731876][ T8192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.864431][ T982] usb 1-1: USB disconnect, device number 2 [ 328.993436][ T5274] 8021q: adding VLAN 0 to HW filter on device eth8 [ 329.205791][ T8250] FAULT_INJECTION: forcing a failure. [ 329.205791][ T8250] name failslab, interval 1, probability 0, space 0, times 0 [ 329.205840][ T8250] CPU: 0 UID: 0 PID: 8250 Comm: syz.2.683 Not tainted syzkaller #0 PREEMPT(full) [ 329.205884][ T8250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 329.205908][ T8250] Call Trace: [ 329.205920][ T8250] [ 329.205932][ T8250] dump_stack_lvl+0x100/0x190 [ 329.205989][ T8250] should_fail_ex.cold+0x5/0xa [ 329.206030][ T8250] ? srso_alias_return_thunk+0x5/0xfbef5 [ 329.206081][ ** replaying previous printk message ** [ 329.206081][ T8250] should_failslab+0xc2/0x120 [ 329.206126][ T8250] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 329.206191][ T8250] ? kstrdup_const+0x63/0x80 [ 329.206250][ T8250] kstrdup+0x51/0xe0 [ 329.206301][ T8250] kstrdup_const+0x63/0x80 [ 329.206360][ T8250] __kernfs_new_node+0x9b/0xa10 [ 329.206424][ T8250] ? __pfx___kernfs_new_node+0x10/0x10 [ 329.206488][ T8250] ? srso_alias_return_thunk+0x5/0xfbef5 [ 329.206542][ T8250] ? lock_acquire+0x1d1/0x380 [ 329.206577][ T8250] ? kernfs_root+0x23/0x2a0 [ 329.206617][ T8250] ? srso_alias_return_thunk+0x5/0xfbef5 [ 329.206663][ T8250] ? find_held_lock+0x2b/0x80 [ 329.206714][ T8250] ? kernfs_root+0xee/0x2a0 [ 329.206755][ T8250] ? kernfs_root+0xee/0x2a0 [ 329.206794][ T8250] ? srso_alias_return_thunk+0x5/0xfbef5 [ 329.206853][ T8250] kernfs_new_node+0x117/0x150 [ 329.206911][ T8250] __kernfs_create_file+0x53/0x350 [ 329.206978][ T8250] cgroup_addrm_files+0x4ef/0xdb0 [ 329.207043][ T8250] ? srso_alias_return_thunk+0x5/0xfbef5 [ 329.207101][ T8250] ? __pfx_cgroup_addrm_files+0x10/0x10 [ 329.207165][ T8250] ? srso_alias_return_thunk+0x5/0xfbef5 [ 329.207212][ T8250] ? idr_replace+0xfa/0x170 [ 329.207263][ T8250] css_populate_dir+0x161/0x590 [ 329.207317][ T8250] cgroup_apply_control_enable+0x441/0xdd0 [ 329.207399][ T8250] cgroup_mkdir+0x57f/0x1330 [ 329.207445][ T8250] ? __pfx_cgroup_mkdir+0x10/0x10 [ 329.207497][ T8250] kernfs_iop_mkdir+0x111/0x190 [ 329.207545][ T8250] ? srso_alias_return_thunk+0x5/0xfbef5 [ 329.207596][ T8250] vfs_mkdir+0x364/0x850 [ 329.207654][ T8250] filename_mkdirat+0x48b/0x5e0 [ 329.207701][ T8250] ? __pfx_filename_mkdirat+0x10/0x10 [ 329.207742][ T8250] ? strncpy_from_user+0x19d/0x2d0 [ 329.207800][ T8250] ? srso_alias_return_thunk+0x5/0xfbef5 [ 329.207846][ T8250] ? do_getname+0x191/0x390 [ 329.207891][ T8250] __x64_sys_mkdirat+0x89/0xc0 [ 329.207934][ T8250] do_syscall_64+0x123/0x790 [ 329.207974][ T8250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.208011][ T8250] RIP: 0033:0x7efe6c19e159 [ 329.208041][ T8250] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 329.208072][ T8250] RSP: 002b:00007efe6d01f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 329.208113][ T8250] RAX: ffffffffffffffda RBX: 00007efe6c425fa0 RCX: 00007efe6c19e159 [ 329.208134][ T8250] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 329.208156][ T8250] RBP: 00007efe6c23506b R08: 0000000000000000 R09: 0000000000000000 [ 329.208178][ T8250] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 329.208203][ T8250] R13: 00007efe6c426038 R14: 00007efe6c425fa0 R15: 00007ffece797298 [ 329.208249][ T8250] [ 329.249034][ T8250] cgroup: cgroup_addrm_files: failed to add throttle.write_bps_device, err=-12 [ 329.277148][ T8244] [ 329.553052][ T8244] ====================================================== [ 329.560070][ T8244] WARNING: possible circular locking dependency detected [ 329.567093][ T8244] syzkaller #0 Not tainted [ 329.571510][ T8244] ------------------------------------------------------ [ 329.578532][ T8244] syz.6.682/8244 is trying to acquire lock: [ 329.584434][ T8244] ffffffff90481ec0 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x20/0x440 [ 329.593415][ T8244] [ 329.593415][ T8244] but task is already holding lock: [ 329.600787][ T8244] ffff8880772de390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 329.609883][ T8244] [ 329.609883][ T8244] which lock already depends on the new lock. [ 329.609883][ T8244] [ 329.620304][ T8244] [ 329.620304][ T8244] the existing dependency chain (in reverse order) is: [ 329.629354][ T8244] [ 329.629354][ T8244] -> #2 (&gi->lock){+.+.}-{4:4}: [ 329.636511][ T8244] lock_acquire+0x1d1/0x380 [ 329.641562][ T8244] __mutex_lock+0x1a4/0x1bd0 [ 329.646697][ T8244] config_usb_cfg_link+0x57/0x3a0 [ 329.652290][ T8244] configfs_symlink+0x695/0x1340 [ 329.657870][ T8244] vfs_symlink+0x178/0x4d0 [ 329.662835][ T8244] filename_symlinkat+0x2a6/0x560 [ 329.668491][ T8244] __x64_sys_symlinkat+0x9c/0xe0 [ 329.673973][ T8244] do_syscall_64+0x123/0x790 [ 329.679100][ T8244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.685612][ T8244] [ 329.685612][ T8244] -> #1 (&sb->s_type->i_mutex_key#29){++++}-{4:4}: [ 329.694407][ T8244] lock_acquire+0x1d1/0x380 [ 329.699444][ T8244] down_write+0x8b/0x1f0 [ 329.704224][ T8244] configfs_depend_item_unlocked+0xf3/0x6a0 [ 329.710675][ T8244] usbg_make_tpg+0x251/0x610 [ 329.715819][ T8244] target_fabric_make_tpg+0xab/0x8c0 [ 329.721673][ T8244] configfs_mkdir+0x525/0xd40 [ 329.726927][ T8244] vfs_mkdir+0x364/0x850 [ 329.731816][ T8244] filename_mkdirat+0x48b/0x5e0 [ 329.737218][ T8244] __x64_sys_mkdirat+0x89/0xc0 [ 329.742543][ T8244] do_syscall_64+0x123/0x790 [ 329.747684][ T8244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.754131][ T8244] [ 329.754131][ T8244] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 329.762084][ T8244] check_prev_add+0xeb/0xe60 [ 329.767259][ T8244] __lock_acquire+0x1528/0x1f40 [ 329.772669][ T8244] lock_acquire+0x1d1/0x380 [ 329.777715][ T8244] __mutex_lock+0x1a4/0x1bd0 [ 329.782855][ T8244] tcm_alloc+0x20/0x440 [ 329.787584][ T8244] usb_get_function+0x5e/0xd0 [ 329.792808][ T8244] config_usb_cfg_link+0x1ed/0x3a0 [ 329.798582][ T8244] configfs_symlink+0x695/0x1340 [ 329.804092][ T8244] vfs_symlink+0x178/0x4d0 [ 329.809081][ T8244] filename_symlinkat+0x2a6/0x560 [ 329.814668][ T8244] __x64_sys_symlinkat+0x9c/0xe0 [ 329.820159][ T8244] do_syscall_64+0x123/0x790 [ 329.825300][ T8244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.831745][ T8244] [ 329.831745][ T8244] other info that might help us debug this: [ 329.831745][ T8244] [ 329.841979][ T8244] Chain exists of: [ 329.841979][ T8244] tpg_instances_lock --> &sb->s_type->i_mutex_key#29 --> &gi->lock [ 329.841979][ T8244] [ 329.855964][ T8244] Possible unsafe locking scenario: [ 329.855964][ T8244] [ 329.863507][ T8244] CPU0 CPU1 [ 329.868885][ T8244] ---- ---- [ 329.874255][ T8244] lock(&gi->lock); [ 329.878173][ T8244] lock(&sb->s_type->i_mutex_key#29); [ 329.886190][ T8244] lock(&gi->lock); [ 329.892627][ T8244] lock(tpg_instances_lock); [ 329.897325][ T8244] [ 329.897325][ T8244] *** DEADLOCK *** [ 329.897325][ T8244] [ 329.905473][ T8244] locks held by syz.6.682/8244: 3, last CPU#1: [ 329.911635][ T8244] #0: ffff88801e732460 (sb_writers#18){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 329.921203][ T8244] #1: ffff8880521a7a40 (&sb->s_type->i_mutex_key#29){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 329.932249][ T8244] #2: ffff8880772de390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 329.941724][ T8244] [ 329.941724][ T8244] stack backtrace: [ 329.947618][ T8244] CPU: 1 UID: 0 PID: 8244 Comm: syz.6.682 Not tainted syzkaller #0 PREEMPT(full) [ 329.956847][ T8244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 329.966925][ T8244] Call Trace: [ 329.970218][ T8244] [ 329.973165][ T8244] dump_stack_lvl+0x100/0x190 [ 329.977887][ T8244] print_circular_bug.cold+0x178/0x1be [ 329.983393][ T8244] check_noncircular+0x146/0x160 [ 329.988391][ T8244] check_prev_add+0xeb/0xe60 [ 329.993034][ T8244] __lock_acquire+0x1528/0x1f40 [ 329.997929][ T8244] lock_acquire+0x1d1/0x380 [ 330.002449][ T8244] ? tcm_alloc+0x20/0x440 [ 330.006832][ T8244] ? __pfx___might_resched+0x10/0x10 [ 330.012156][ T8244] ? config_usb_cfg_link+0x57/0x3a0 [ 330.017411][ T8244] __mutex_lock+0x1a4/0x1bd0 [ 330.022023][ T8244] ? tcm_alloc+0x20/0x440 [ 330.026411][ T8244] ? tcm_alloc+0x20/0x440 [ 330.030789][ T8244] ? srso_alias_return_thunk+0x5/0xfbef5 [ 330.036463][ T8244] ? __mutex_lock+0x26c/0x1bd0 [ 330.041247][ T8244] ? config_usb_cfg_link+0x57/0x3a0 [ 330.046494][ T8244] ? __pfx___mutex_lock+0x10/0x10 [ 330.051562][ T8244] ? srso_alias_return_thunk+0x5/0xfbef5 [ 330.057385][ T8244] ? __lock_acquire+0x5c0/0x1f40 [ 330.062396][ T8244] ? tcm_alloc+0x20/0x440 [ 330.066768][ T8244] tcm_alloc+0x20/0x440 [ 330.070967][ T8244] usb_get_function+0x5e/0xd0 [ 330.075687][ T8244] config_usb_cfg_link+0x1ed/0x3a0 [ 330.080841][ T8244] ? mntput_no_expire+0xe7/0x220 [ 330.085818][ T8244] configfs_symlink+0x695/0x1340 [ 330.090791][ T8244] ? srso_alias_return_thunk+0x5/0xfbef5 [ 330.096452][ T8244] ? srso_alias_return_thunk+0x5/0xfbef5 [ 330.102112][ T8244] ? security_inode_permission+0xbf/0x250 [ 330.107867][ T8244] ? __pfx_configfs_symlink+0x10/0x10 [ 330.113277][ T8244] ? srso_alias_return_thunk+0x5/0xfbef5 [ 330.118938][ T8244] vfs_symlink+0x178/0x4d0 [ 330.123383][ T8244] ? srso_alias_return_thunk+0x5/0xfbef5 [ 330.129042][ T8244] filename_symlinkat+0x2a6/0x560 [ 330.134094][ T8244] ? __pfx_filename_symlinkat+0x10/0x10 [ 330.139660][ T8244] ? strncpy_from_user+0x19d/0x2d0 [ 330.144802][ T8244] ? srso_alias_return_thunk+0x5/0xfbef5 [ 330.150456][ T8244] ? do_getname+0x191/0x390 [ 330.154988][ T8244] __x64_sys_symlinkat+0x9c/0xe0 [ 330.159956][ T8244] do_syscall_64+0x123/0x790 [ 330.164563][ T8244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.170473][ T8244] RIP: 0033:0x7f5d2879e159 [ 330.174893][ T8244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 330.194698][ T8244] RSP: 002b:00007f5d29670028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 330.203141][ T8244] RAX: ffffffffffffffda RBX: 00007f5d28a25fa0 RCX: 00007f5d2879e159 [ 330.211142][ T8244] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 330.219225][ T8244] RBP: 00007f5d2883506b R08: 0000000000000000 R09: 0000000000000000 [ 330.227244][ T8244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 330.235237][ T8244] R13: 00007f5d28a26038 R14: 00007f5d28a25fa0 R15: 00007ffd493db658 [ 330.243240][ T8244] SYZFAIL: failed to send rpc fd=3 want=1832 sent=0 n=-1 (errno 32: Broken pipe) [ 330.301005][ T8248] UDC core: g1: couldn't find an available UDC or it's busy [ 330.426164][ T982] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 331.247557][ T3290] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.406264][ T3290] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.718472][ T3290] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.884216][ T3290] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.106143][ T3290] bridge_slave_1: left allmulticast mode [ 332.106171][ T3290] bridge_slave_1: left promiscuous mode [ 332.106300][ T3290] bridge0: port 2(bridge_slave_1) entered disabled state [ 332.108647][ T3290] bridge_slave_0: left allmulticast mode [ 332.108676][ T3290] bridge_slave_0: left promiscuous mode [ 332.110289][ T3290] bridge0: port 1(bridge_slave_0) entered disabled state [ 332.372052][ T3290] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 332.373702][ T3290] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 332.374724][ T3290] bond0 (unregistering): Released all slaves [ 332.598481][ T3290] hsr_slave_0: left promiscuous mode [ 332.599026][ T3290] hsr_slave_1: left promiscuous mode [ 332.599640][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 332.599666][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 332.600361][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 332.600386][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 332.604495][ T3290] veth1_macvtap: left promiscuous mode [ 332.604533][ T3290] veth0_macvtap: left promiscuous mode [ 332.604623][ T3290] veth1_vlan: left promiscuous mode [ 332.604685][ T3290] veth0_vlan: left promiscuous mode [ 332.803635][ T3290] team0 (unregistering): Port device team_slave_1 removed [ 332.830408][ T3290] team0 (unregistering): Port device team_slave_0 removed [ 332.923359][ T5274] 8021q: adding VLAN 0 to HW filter on device eth9 [ 333.219134][ T3290] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.264296][ T3290] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.311179][ T3290] team0: Port device netdevsim1 removed [ 333.312563][ T3290] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.353841][ T3290] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.457662][ T3290] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.504660][ T3290] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.550954][ T3290] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.598454][ T3290] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.950380][ T3290] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.992055][ T3290] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.054849][ T3290] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.115614][ T3290] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.217880][ T3290] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.264074][ T3290] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.302633][ T3290] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.343166][ T3290] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.461337][ T3290] bridge_slave_1: left allmulticast mode [ 334.461373][ T3290] bridge_slave_1: left promiscuous mode [ 334.461535][ T3290] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.464625][ T3290] bridge_slave_0: left allmulticast mode [ 334.464653][ T3290] bridge_slave_0: left promiscuous mode [ 334.464815][ T3290] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.511174][ T3290] bridge_slave_1: left allmulticast mode [ 334.511200][ T3290] bridge_slave_1: left promiscuous mode [ 334.511316][ T3290] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.512574][ T3290] bridge_slave_0: left allmulticast mode [ 334.512596][ T3290] bridge_slave_0: left promiscuous mode [ 334.512702][ T3290] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.541311][ T3290] bridge_slave_1: left allmulticast mode [ 334.541344][ T3290] bridge_slave_1: left promiscuous mode [ 334.541504][ T3290] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.553139][ T3290] bridge_slave_0: left allmulticast mode [ 334.553168][ T3290] bridge_slave_0: left promiscuous mode [ 334.553328][ T3290] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.578179][ T3290] bridge_slave_1: left allmulticast mode [ 334.578213][ T3290] bridge_slave_1: left promiscuous mode [ 334.578380][ T3290] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.591400][ T3290] bridge_slave_0: left allmulticast mode [ 334.591439][ T3290] bridge_slave_0: left promiscuous mode [ 334.591641][ T3290] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.632501][ T3290] bridge_slave_1: left allmulticast mode [ 334.632529][ T3290] bridge_slave_1: left promiscuous mode [ 334.633070][ T3290] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.644746][ T3290] bridge_slave_0: left allmulticast mode [ 334.644776][ T3290] bridge_slave_0: left promiscuous mode [ 334.644930][ T3290] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.804829][ T3290] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 334.816278][ T3290] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 334.817700][ T3290] bond0 (unregistering): Released all slaves [ 334.865107][ T3290] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 334.867188][ T3290] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 334.868453][ T3290] bond0 (unregistering): Released all slaves [ 334.918259][ T3290] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 334.919715][ T3290] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 334.920662][ T3290] bond0 (unregistering): Released all slaves [ 334.982070][ T3290] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 334.984031][ T3290] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 334.993734][ T3290] bond0 (unregistering): Released all slaves [ 335.053165][ T3290] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 335.054759][ T3290] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 335.057073][ T3290] bond0 (unregistering): Released all slaves [ 335.080415][ T5274] 8021q: adding VLAN 0 to HW filter on device eth10 [ 335.661579][ T3290] hsr_slave_0: left promiscuous mode [ 335.663532][ T3290] hsr_slave_1: left promiscuous mode [ 335.664119][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 335.664146][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 335.664707][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 335.664731][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 335.691695][ T3290] hsr_slave_0: left promiscuous mode [ 335.692220][ T3290] hsr_slave_1: left promiscuous mode [ 335.692793][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 335.692833][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 335.700188][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 335.700213][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 335.733009][ T3290] hsr_slave_0: left promiscuous mode [ 335.740433][ T3290] hsr_slave_1: left promiscuous mode [ 335.741052][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 335.748190][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 335.773327][ T3290] hsr_slave_0: left promiscuous mode [ 335.773850][ T3290] hsr_slave_1: left promiscuous mode [ 335.774471][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 335.774498][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 335.776337][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 335.776362][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 335.794768][ T3290] hsr_slave_0: left promiscuous mode [ 335.801993][ T3290] hsr_slave_1: left promiscuous mode [ 335.802592][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 335.802617][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 335.809909][ T3290] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 335.809934][ T3290] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 335.858131][ T3290] veth1_macvtap: left promiscuous mode [ 335.858165][ T3290] veth0_macvtap: left promiscuous mode [ 335.858237][ T3290] veth1_vlan: left promiscuous mode [ 335.858283][ T3290] veth0_vlan: left promiscuous mode [ 335.859217][ T3290] veth1_macvtap: left promiscuous mode [ 335.859256][ T3290] veth0_macvtap: left promiscuous mode [ 335.859345][ T3290] veth1_vlan: left promiscuous mode [ 335.859411][ T3290] veth0_vlan: left promiscuous mode [ 335.860897][ T3290] veth1_macvtap: left promiscuous mode [ 335.860935][ T3290] veth0_macvtap: left promiscuous mode [ 335.861022][ T3290] veth1_vlan: left promiscuous mode [ 335.861086][ T3290] veth0_vlan: left promiscuous mode [ 335.862099][ T3290] veth1_macvtap: left promiscuous mode [ 335.862151][ T3290] veth0_macvtap: left promiscuous mode [ 335.862235][ T3290] veth1_vlan: left promiscuous mode [ 335.862298][ T3290] veth0_vlan: left promiscuous mode [ 336.236866][ T3290] team0 (unregistering): Port device team_slave_1 removed [ 336.242487][ T3290] team0 (unregistering): Port device team_slave_0 removed [ 336.391258][ T3290] team0 (unregistering): Port device team_slave_1 removed [ 336.404610][ T3290] team0 (unregistering): Port device team_slave_0 removed [ 336.532805][ T3290] team0 (unregistering): Port device team_slave_1 removed [ 336.542666][ T3290] team0 (unregistering): Port device team_slave_0 removed [ 336.673432][ T3290] team0 (unregistering): Port device team_slave_1 removed [ 336.682900][ T3290] team0 (unregistering): Port device team_slave_0 removed [ 336.826018][ T3290] team0 (unregistering): Port device team_slave_1 removed [ 336.830536][ T3290] team0 (unregistering): Port device team_slave_0 removed [ 336.903782][ T5274] 8021q: adding VLAN 0 to HW filter on device eth11 [ 337.364134][ T5274] 8021q: adding VLAN 0 to HW filter on device eth12 [ 337.790209][ T5274] 8021q: adding VLAN 0 to HW filter on device eth13 [ 337.939851][ T3290] IPVS: stop unused estimator thread 0... [ 337.940878][ T3290] IPVS: stop unused estimator thread 0... [ 337.941424][ T3290] IPVS: stop unused estimator thread 0... [ 338.157727][ T5274] 8021q: adding VLAN 0 to HW filter on device eth14 [ 338.492130][ T5274] 8021q: adding VLAN 0 to HW filter on device eth15 [ 338.824446][ T5274] 8021q: adding VLAN 0 to HW filter on device eth16 [ 339.167109][ T5274] 8021q: adding VLAN 0 to HW filter on device eth17