last executing test programs: 18.089640446s ago: executing program 1 (id=601): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x200200d4}, 0x0) io_setup(0x6, &(0x7f0000000d80)=0x0) r1 = eventfd2(0x4, 0x800) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff010}]}, 0x10) io_submit(r0, 0x1, &(0x7f0000000900)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x7, 0x80, r1, &(0x7f0000000000)='1', 0x1, 0xfbe, 0x0, 0x1, r1}]) socket(0x25, 0x6, 0x40) ioctl$PTP_SYS_OFFSET(0xffffffffffffffff, 0x43403d05, 0x0) 16.346723905s ago: executing program 1 (id=606): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000580)=@deltclass={0x24, 0x29, 0x4, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x4, 0x2}, {0x7, 0xffff}, {0x4, 0xf}}}, 0x24}}, 0x0) socket(0x10, 0x6, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x0, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) listen(r2, 0xc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x8) 14.955923986s ago: executing program 1 (id=610): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x5a6, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 14.265159652s ago: executing program 1 (id=614): socket$nl_route(0x10, 0x3, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000300), 0x1, 0x4b7, &(0x7f0000000640)="$eJzs3M9vFFUcAPDvzPYHv1sRf/BDqaKxEW1pQeVgYjSacDEx0YMea6kEKWBoTYQQocbg0fgXqEcT/wJPejHqSeNV49WYEMMF9GDWzO5MO+1uy3bLtsB+Pslu35t5M++9efM6b+ftbABdayh7SyK2RcRvETFQj5YSVCtZoizdjWsXJ/+5dnEyiWr19b/7a+muX7s4WSQtttuaR4bTiPTjJPY2yXfm/IVTE9PTU+fy+Ojs6fdGZ85fePrk6YkTUyemzowfPXrk8Nhzz44/01a9Ni2JZ/W6vufDs/t2H3vrs1cnq/H2j19n5d2Wry/Xo26wrXzLhmIoqtVqNV20tK/2/via93572R4Rc3k46dngwtCySkRkzdVb6/8DUYmFxhuIVz7a0MIBHZVdn/obllbyvz1Jtj6/lm4ubQLcFeZ0aOhSxRU/+/xbvNZl4HGbuPpi9j5Vq/+N/FVf0xPZ5/ZksP6JvdKh/LdFxJuX//08e0XT+xAAALfWt9n456lm47807i+l25HPoQxGxMGI2BkR90bEroi4L6KW9oGIeHCV+dfmn+YW4o3jn182t125FmTjv+fzua3F47/5WZvBSh7bXqt/b/LOyempQ/kxGY7e/iw+tkIe373866fLrRsqjf+yV5Z/MRbMy/FXz5IbdMcnZifWUueyq3MRe3qa1T+ZnwlIImJ3ROxpY//ZMTv55Ff7svCOrY3rb17/lVxuo0SLVb+MeKLe/pdjSf0LSX2KZLn5ydFNMT11aLQ4Kxr99POV18rx3lJ4bfVfu6z9tzQ9//P6F92gmK+daXHHfQvBK79/ku+zsSu3e/73JW8syuaDidnZc2MRfX3RuHx8YdsiXqTP6j98IOJKPhFc7v87I/77It9ub0RkJ/FDEfFwROzPy/5IRDwaEQdWOBQ/vPTYuysfrI1t/+MrtX/EYFKer88DmyJi8ZLlA5VT339T7Gy+KfN/Lq21/5FaaDhf0sr/v1bKtYqzGQAAAO5oaW0OOklH5sNpOjJS/w7/rtiSTp+dmT04FO+fOV6fqx6M3rS40zVQuh86lt8bLuLjS+KHI+Ke2jeNNtfiI5Nnp7dvdOWhy21dpv9n/uzUl16A28ei57Vu9rxd0tmyAOurp8nELNAdWn5eu7ez5QDWn99rgO6l/0P3atb/L0Xc2ICiAOtsVdf/FzpXDmD9rdT/3fKDu5vP/9C99H/oSo2PxBdfBWrt+fnlAjuPrWnzLgpUOrTnKP9ox80DxTWg5Swi3fBD134gbX/zP25ZMfbngf6IaHWrS6tp0zWfPwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHe+/wMAAP//MEfO7A==") syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000340)='./file0\x00', 0x2800400, &(0x7f0000000300)={[{@jqfmt_vfsv1}]}, 0x1, 0xbd9, &(0x7f0000000400)="$eJzs3M1rHOcZAPBnRp+25a5cSql7sUopNpSuZReZ2hRqF5deeii014CFvDJC6w8kBUeyIKvkHwhJzoFcAklMgg/x2ZcEcs0lca4xOQRMUKwEQkgUZj8kWdqVLGtXo8i/H7ya92Nm3ufRSDvzwu4G8Mwayn6kEUcj4lISUaj3pxHRW631R1Rq+y0tzo99tzg/lsTy8v++TiKJiEeL82ONcyX17aF6oz8iPvlnEr9+eeO807Nzk6Plcmmq3j45c/XGyenZub9MXB29UrpSunbqzN9GTo+cGT470rZcv//i/N1v//DvLys/vPPj7W9eeyuJ8zFQH1ubRz3rHRuKoZXfyVrdETHahvPvBV31fNbmmXRvcVDa4aAAAGgpXfMM99soRFesPrwV4sNPcw0OAAAAaIvlrohlAAAAYJ9LrP8BAABgn2u8D+DR4vxYo+T7joTd9fBCRAzW8l+ql9pId1Sq2/7oiYiDj5JY+7HWpHbYjg1FxIPPz76flWjyOeROqyxExO+aXf+kmv9g/ZPQ6/NPI2K4DfMPrWv/kvI/34b5884fgGfTvQu1G9nG+1+68vwTTe5/3U3uXU8j7/tf4/lvacPz32r+XS2e//77hHPcevuNm63Gsvz/fvdf7zVKNn+23VFS2/BwIeL33c3yT1byT1rkf2mLcydRO0Xhp5ulVvvknf/ymxHHo3n+Dcnm3090cnyiXBqu/Ww6x8LHI++2mj/v/LPrf7BF/ptc//6s78ZjZ2r9pT7PXbx4Z0Nnffet80+/6k3+X6311nteGJ2ZmToV0Zv8Z2P/6c3zbezTOEeW/4k/bv7/3+zvP3tNqNT/NrJUFurbrP3Sujn/cfvWB63iaaz/8rz+l7d//at9rzzhHH/66NUT6/sa36+1dv2blWz+B0ltLQwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADWlEDESSFiMiqdbTtFiMOBQRv4mDafn69Myfx68/f+1yNhYxGD3p+ES5NBwRhVo7ydqnqvXV9ul17b9GxJGIeL1woNoujl0vX847eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFYcioiBSNJiRKQRsVRI02Ix76gAAACAthvMOwAAAACg46z/AQAAYP+z/gcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDDjhy7dz+JiMq5A9WS6a2P9eQaGdBpad4BALnpyjsAIDfdeQcA5Gaba3yPC7APJVuM9zftzV49+joSDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB70/Gj9+4nEVE5d6BaMr31sZ6mRxzbxeiATkrzDgDITddmg927Fwew+576X/xwe+MAdl/zNT7wLEm2GO9f3afy+Ehfx2ICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYO8ZqJYkLUZEWq2nabEYcTgiBqMnGZ8ol4Yj4lcR8Vmhpy9r9+UdNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG03PTs3OVoul6aeppLs7HAVlVaVF/dGGLtbSfZGGLVK3q9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADkYXp2bnK0XC5NTecdCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJC36dm5ydFyuTT1BJU729l5TSXvHAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyM/PAQAA///E/w3d") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0xb00000000000014, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x1b, 0xe, &(0x7f0000001880)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x5, 0x1}, 0x10}, 0x94) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0xc, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r3, 0x0, 0x24040080) 13.834412361s ago: executing program 3 (id=616): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000012c0)=ANY=[@ANYBLOB="2c0000002600090122bd7008f9ffffff1000000008003d80040022800800030047"], 0x2c}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) 13.646017415s ago: executing program 4 (id=617): r0 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x1, 0x2, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x0, 0x144}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x785, 0x40, 0x0, 0x1f0, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) syz_usb_control_io$uac3(r1, 0x0, &(0x7f0000000540)={0x44, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f0000000700)={0x2c, &(0x7f0000000440)={0x0, 0x30, 0x3, "aae249"}, 0x0, 0x0, 0x0, 0x0}) 11.256705969s ago: executing program 3 (id=618): shutdown(0xffffffffffffffff, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) io_setup(0x5, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000640)={'syz1\x00', {0x5, 0xdc, 0x2, 0x2}, 0x4, [0x6e, 0xa, 0x0, 0x3b7, 0x3, 0x9, 0x3, 0x0, 0x3, 0x4, 0x7fff, 0x8001, 0xf0b, 0xa, 0x1, 0x1, 0x9, 0x9, 0x811, 0x100, 0x2, 0x0, 0x6, 0x4, 0x2, 0x8, 0x6, 0x108cd13, 0x6f, 0x1, 0x8, 0x1, 0x3ff, 0x8, 0x6, 0x10001, 0xffff, 0xd, 0x7, 0x4c, 0x5, 0x7, 0x2, 0xfffffffa, 0xfffffe00, 0x9, 0x4, 0x1, 0x0, 0x2, 0x4, 0x6, 0x9b, 0x9, 0x2, 0x3c9d, 0xfffff000, 0x7, 0x9, 0x4, 0x7, 0x8, 0x0, 0x290c], [0x7f, 0x6, 0xff000000, 0x2, 0x4, 0x6, 0x5, 0x1, 0x1ff, 0x5, 0x9, 0xfffffff7, 0x58, 0x0, 0x7fff, 0x8, 0x701707bb, 0xd72, 0x4, 0x724, 0x80, 0x6, 0xca4, 0x5, 0x7fffffff, 0x1ff, 0x1000, 0xfffffffd, 0x646, 0x1, 0x100, 0x6bf2, 0x4be6, 0x40, 0x9, 0x53e3, 0xe, 0xfffff801, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x4, 0x1, 0x8, 0x81, 0xadb27a9, 0x6, 0x2, 0x4, 0x1bf, 0xf28, 0x5, 0x5, 0x6, 0x80000001, 0x94, 0x0, 0xff, 0x9, 0x4c, 0x9, 0x2], [0x2034ebeb, 0x8f3b, 0x501, 0x3, 0x8, 0x1ff, 0x9, 0x9, 0xd80, 0x6, 0x48858c77, 0x3, 0x2, 0x5, 0xfffff996, 0x3, 0x573, 0x13, 0x5, 0x5, 0x7ff, 0xdd, 0xacaa, 0x6, 0xffff, 0x9, 0x9, 0x8, 0x2d5a, 0x1, 0xd2, 0x7, 0x8, 0x5, 0xfff, 0x117, 0xffffff00, 0xe4, 0x3686, 0x4, 0x0, 0x61f, 0x2, 0x1, 0x1, 0x7, 0x3a1, 0x3, 0xc, 0x7fff, 0x2, 0xd, 0x8, 0x80, 0x4, 0x80000001, 0x9, 0x5, 0x6, 0xfffffffc, 0x0, 0xffff0000, 0x4, 0x8], [0x400, 0x80000001, 0xaddf, 0x2, 0x0, 0x10001, 0x76c, 0x1, 0x9, 0x2, 0x2, 0x8001, 0x0, 0xc, 0x390a614d, 0x86, 0x200, 0x6, 0x0, 0x8000, 0x7, 0x9, 0x9, 0x3, 0xfffffff8, 0x8, 0x9, 0x3, 0x32, 0x3f, 0x6, 0x81, 0xffffffff, 0x7, 0x5, 0x94, 0x0, 0x1306, 0x5, 0xa73, 0x1, 0x9, 0x40, 0xd5, 0x9, 0x4, 0xdfc, 0x4a6, 0x0, 0x9, 0x10000, 0x5, 0x2, 0xfffff800, 0x0, 0x8, 0x12, 0xffff, 0x0, 0x19, 0x100, 0x8, 0x101, 0x1ff]}, 0x45c) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=ANY=[@ANYBLOB="940100001e00ff0225bd700000000000010000007c0106"], 0x194}, 0x1, 0x0, 0x0, 0x81}, 0x4004000) 10.842679818s ago: executing program 3 (id=620): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000580)=@deltclass={0x24, 0x29, 0x4, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x4, 0x2}, {0x7, 0xffff}, {0x4, 0xf}}}, 0x24}}, 0x0) socket(0x10, 0x6, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x0, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) listen(r2, 0xc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x8) 9.463989499s ago: executing program 2 (id=621): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)={0x74, 0x0, 0x2516fe2a6eac4bfd}) 9.40057432s ago: executing program 1 (id=622): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) timer_settime(r2, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r4, 0x40047438, 0x0) write(r4, 0x0, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x3}}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2, 0xf5ff}, 0x10) sendmsg$tipc(r5, &(0x7f0000000540)={&(0x7f00000001c0)=@name={0x1e, 0x2, 0x0, {{0x40, 0x3}, 0x2}}, 0x10, 0x0}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r5, 0x10f, 0x88) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="18000000", @ANYRES16=r7, @ANYBLOB="51135213ee3593aa002004"], 0x18}, 0x1, 0x0, 0x0, 0x8c0}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r8 = gettid() memfd_create(0x0, 0x0) r9 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$BINDER_GET_FROZEN_INFO(r9, 0xc00c620f, &(0x7f0000000080)={r8}) 9.304523412s ago: executing program 4 (id=623): syz_emit_ethernet(0x47, &(0x7f0000000100)={@multicast, @remote, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "250500", 0x11, 0x11, 0x0, @local, @mcast2, {[], {0x4000, 0xe22, 0x11, 0x0, @opaque="b85aa09fcdc4a22a55"}}}}}}, 0x0) 9.257230434s ago: executing program 0 (id=624): mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB=',rootmode=00000000000000000040000,u', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002840)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x20}, 0x1c, 0x0}}], 0x1, 0x14018891) openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x40880, 0x0) sendmmsg$alg(r0, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d98", 0xd9}], 0x1, &(0x7f00000008c0)=ANY=[@ANYBLOB="b800000000d983fd49e32f4399000000a0000000bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4a0342bed8a3c79acd4bb1f9f46ef28a63b329e09a86c62f907539c9af6f1b0bc00510c3b27f64245b6f4f00e00bca3c91538839a52c3c393aada6ed6155fa03c988b6658e106d043cc8652373dd8e2a7"], 0xb8, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd7", 0x3e}, {&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233e0e3853e4a118a5a2bcc52eeea6b2dc4fc32c3f81f9b1d", 0x30}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e7ade15", 0xad}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52d9dbd9e0fae7a4", 0xcc}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b", 0x50}], 0x6, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 9.209255195s ago: executing program 4 (id=625): bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0x3fe3aa0262d8c583, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xfffa}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102384, 0x18ff0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x4000000) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000040)={0x80, 0x20a0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, {0x7f, 0x8}, {0x8, 0x8}, {0x0, 0x6, 0x2}, {0x4, 0x7, 0xfffffffd}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffc, 0x400009, 0x6, 0x6, 0x17, 0x0, 0x1, 0x6}) r4 = socket$inet6_udp(0xa, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) connect$pppl2tp(r3, &(0x7f0000001140)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000340)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r6, 0x9}}, 0x10) 9.138185516s ago: executing program 3 (id=626): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xfa0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r0, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x22) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) openat$rfkill(0xffffffffffffff9c, 0x0, 0x60c01, 0x0) connect$802154_dgram(r0, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xfffe}}, 0x14) sendmmsg(r0, &(0x7f00000196c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xd, 0x0}}], 0x4000050, 0x400c010) 8.942139201s ago: executing program 2 (id=627): sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)={0x1c, 0x0, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x8c0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de", 0x9b}, {&(0x7f0000000780)}, {&(0x7f0000000800)}, {&(0x7f00000000c0)}], 0x5}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)}, {&(0x7f0000000580)}], 0x3, &(0x7f0000000cc0)=[@timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}], 0x30}}], 0x2, 0x20000044) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) 8.433222842s ago: executing program 0 (id=628): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x7, 0x106) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='stat\x00') sendmsg$AUDIT_USER_AVC(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x20000080) r2 = io_uring_setup(0x7625, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r2, 0x1, 0x7000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) r4 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r4, 0x0, 0x8041) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d0002847ea3d985f74500004e23e3f58e76110165f450e71b0075e30025002d8d459e37000f0000000000bf9367b47e51f60a64c9f4d4938037e7109980d6d6f23a9b00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 7.001472204s ago: executing program 4 (id=629): bpf$PROG_LOAD(0x5, 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, &(0x7f0000000280)) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 6.969829295s ago: executing program 0 (id=630): openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) openat$6lowpan_control(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000001000000e27f000001"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x121, &(0x7f0000000500)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa348100000086dd6091010000e711fffe8000000000000000000000000000bbfe8000000000000000000000000000aa00000e2200e7907804000000050000000080000000000000f42bd1cd547264429b9625c1d01c18dc0b5e8c14fadcf67b110c19df49c9680d73b336d57d02df9558078a8725ab9adc445df4b2bd888dc9f8f4e0198b0a78"], 0x0) openat(0xffffffffffffffff, 0x0, 0x420801, 0x103) openat$fb0(0xffffffffffffff9c, &(0x7f0000000100), 0x8402, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000013c0)=@mangle={'mangle\x00', 0x2, 0x6, 0x740, 0x370, 0x440, 0x0, 0x288, 0x288, 0x670, 0x670, 0x670, 0x670, 0x670, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x21}, 0x0, 0x180, 0x1a8, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x5e, 0x0, 0x0, 0x0, 0x0, @local, @ipv4={'\x00', '\xff\xff', @remote}, @private2, [], [0x0, 0x0, 0xffffffff]}}, @common=@unspec=@ipvs={{0x48}, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xffffff00, 0x0, 0xffffffff, 0xff000000], 0x4e20, 0x2f, 0x6, 0x4e22, 0x20, 0x20}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@mcast2, @empty, [], [], 'veth1_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, [], [], '\x00', 'bond_slave_0\x00', {}, {}, 0x0, 0x0, 0x2, 0x9}, 0x0, 0xa8, 0xe8, 0x48000000}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x0, 0xffffffff, 0x9, 0x5, 0x2, 0x8000, 0xc, 0x4]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}, @common=@rt={{0x138}, {0x0, [0x2], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @remote}, @mcast2, @private1, @private1, @empty, @loopback, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7a0) 6.854200437s ago: executing program 2 (id=631): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000786c6c2500000000002020207b0af8ff00000000bda100000000000057010000f8ffffffb702000008000000b703000000000000850000001900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, &(0x7f0000000200)='\x00\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800001bc81a000000000000000001851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000101180000000000000000000000000000119500000000000000360a000000000000180900002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222}, 0x94) 5.730901982s ago: executing program 2 (id=632): socket$nl_route(0x10, 0x3, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000300), 0x1, 0x4b7, &(0x7f0000000640)="$eJzs3M9vFFUcAPDvzPYHv1sRf/BDqaKxEW1pQeVgYjSacDEx0YMea6kEKWBoTYQQocbg0fgXqEcT/wJPejHqSeNV49WYEMMF9GDWzO5MO+1uy3bLtsB+Pslu35t5M++9efM6b+ftbABdayh7SyK2RcRvETFQj5YSVCtZoizdjWsXJ/+5dnEyiWr19b/7a+muX7s4WSQtttuaR4bTiPTjJPY2yXfm/IVTE9PTU+fy+Ojs6fdGZ85fePrk6YkTUyemzowfPXrk8Nhzz44/01a9Ni2JZ/W6vufDs/t2H3vrs1cnq/H2j19n5d2Wry/Xo26wrXzLhmIoqtVqNV20tK/2/via93572R4Rc3k46dngwtCySkRkzdVb6/8DUYmFxhuIVz7a0MIBHZVdn/obllbyvz1Jtj6/lm4ubQLcFeZ0aOhSxRU/+/xbvNZl4HGbuPpi9j5Vq/+N/FVf0xPZ5/ZksP6JvdKh/LdFxJuX//08e0XT+xAAALfWt9n456lm47807i+l25HPoQxGxMGI2BkR90bEroi4L6KW9oGIeHCV+dfmn+YW4o3jn182t125FmTjv+fzua3F47/5WZvBSh7bXqt/b/LOyempQ/kxGY7e/iw+tkIe373866fLrRsqjf+yV5Z/MRbMy/FXz5IbdMcnZifWUueyq3MRe3qa1T+ZnwlIImJ3ROxpY//ZMTv55Ff7svCOrY3rb17/lVxuo0SLVb+MeKLe/pdjSf0LSX2KZLn5ydFNMT11aLQ4Kxr99POV18rx3lJ4bfVfu6z9tzQ9//P6F92gmK+daXHHfQvBK79/ku+zsSu3e/73JW8syuaDidnZc2MRfX3RuHx8YdsiXqTP6j98IOJKPhFc7v87I/77It9ub0RkJ/FDEfFwROzPy/5IRDwaEQdWOBQ/vPTYuysfrI1t/+MrtX/EYFKer88DmyJi8ZLlA5VT339T7Gy+KfN/Lq21/5FaaDhf0sr/v1bKtYqzGQAAAO5oaW0OOklH5sNpOjJS/w7/rtiSTp+dmT04FO+fOV6fqx6M3rS40zVQuh86lt8bLuLjS+KHI+Ke2jeNNtfiI5Nnp7dvdOWhy21dpv9n/uzUl16A28ei57Vu9rxd0tmyAOurp8nELNAdWn5eu7ez5QDWn99rgO6l/0P3atb/L0Xc2ICiAOtsVdf/FzpXDmD9rdT/3fKDu5vP/9C99H/oSo2PxBdfBWrt+fnlAjuPrWnzLgpUOrTnKP9ox80DxTWg5Swi3fBD134gbX/zP25ZMfbngf6IaHWrS6tp0zWfPwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHe+/wMAAP//MEfO7A==") syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000340)='./file0\x00', 0x2800400, &(0x7f0000000300)={[{@jqfmt_vfsv1}]}, 0x1, 0xbd9, &(0x7f0000000400)="$eJzs3M1rHOcZAPBnRp+25a5cSql7sUopNpSuZReZ2hRqF5deeii014CFvDJC6w8kBUeyIKvkHwhJzoFcAklMgg/x2ZcEcs0lca4xOQRMUKwEQkgUZj8kWdqVLGtXo8i/H7ya92Nm3ufRSDvzwu4G8Mwayn6kEUcj4lISUaj3pxHRW631R1Rq+y0tzo99tzg/lsTy8v++TiKJiEeL82ONcyX17aF6oz8iPvlnEr9+eeO807Nzk6Plcmmq3j45c/XGyenZub9MXB29UrpSunbqzN9GTo+cGT470rZcv//i/N1v//DvLys/vPPj7W9eeyuJ8zFQH1ubRz3rHRuKoZXfyVrdETHahvPvBV31fNbmmXRvcVDa4aAAAGgpXfMM99soRFesPrwV4sNPcw0OAAAAaIvlrohlAAAAYJ9LrP8BAABgn2u8D+DR4vxYo+T7joTd9fBCRAzW8l+ql9pId1Sq2/7oiYiDj5JY+7HWpHbYjg1FxIPPz76flWjyOeROqyxExO+aXf+kmv9g/ZPQ6/NPI2K4DfMPrWv/kvI/34b5884fgGfTvQu1G9nG+1+68vwTTe5/3U3uXU8j7/tf4/lvacPz32r+XS2e//77hHPcevuNm63Gsvz/fvdf7zVKNn+23VFS2/BwIeL33c3yT1byT1rkf2mLcydRO0Xhp5ulVvvknf/ymxHHo3n+Dcnm3090cnyiXBqu/Ww6x8LHI++2mj/v/LPrf7BF/ptc//6s78ZjZ2r9pT7PXbx4Z0Nnffet80+/6k3+X6311nteGJ2ZmToV0Zv8Z2P/6c3zbezTOEeW/4k/bv7/3+zvP3tNqNT/NrJUFurbrP3Sujn/cfvWB63iaaz/8rz+l7d//at9rzzhHH/66NUT6/sa36+1dv2blWz+B0ltLQwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADWlEDESSFiMiqdbTtFiMOBQRv4mDafn69Myfx68/f+1yNhYxGD3p+ES5NBwRhVo7ydqnqvXV9ul17b9GxJGIeL1woNoujl0vX847eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFYcioiBSNJiRKQRsVRI02Ix76gAAACAthvMOwAAAACg46z/AQAAYP+z/gcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDDjhy7dz+JiMq5A9WS6a2P9eQaGdBpad4BALnpyjsAIDfdeQcA5Gaba3yPC7APJVuM9zftzV49+joSDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB70/Gj9+4nEVE5d6BaMr31sZ6mRxzbxeiATkrzDgDITddmg927Fwew+576X/xwe+MAdl/zNT7wLEm2GO9f3afy+Ehfx2ICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYO8ZqJYkLUZEWq2nabEYcTgiBqMnGZ8ol4Yj4lcR8Vmhpy9r9+UdNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG03PTs3OVoul6aeppLs7HAVlVaVF/dGGLtbSfZGGLVK3q9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADkYXp2bnK0XC5NTecdCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJC36dm5ydFyuTT1BJU729l5TSXvHAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyM/PAQAA///E/w3d") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0xb00000000000014, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x1b, 0xe, &(0x7f0000001880)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x5, 0x1}, 0x10}, 0x94) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0xc, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004884}, 0x24040080) 5.273892142s ago: executing program 0 (id=633): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@newtaction={0x18, 0x1e, 0x109, 0x2, 0x25dfdbfc, {}, [{0x4}]}, 0x18}, 0x1, 0x2b1e, 0x0, 0x20044000}, 0x2000c000) 5.272463252s ago: executing program 1 (id=634): r0 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x1, 0x2, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x0, 0x144}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x785, 0x40, 0x0, 0x1f0, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) 5.189034394s ago: executing program 3 (id=635): syz_emit_ethernet(0x47, &(0x7f0000000100)={@multicast, @remote, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "250500", 0x11, 0x11, 0x0, @local, @mcast2, {[], {0x4000, 0xe22, 0x11, 0x0, @opaque="b85aa09fcdc4a22a55"}}}}}}, 0x0) 5.175456865s ago: executing program 0 (id=636): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000580)=@deltclass={0x24, 0x29, 0x4, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x4, 0x2}, {0x7, 0xffff}, {0x4, 0xf}}}, 0x24}}, 0x0) socket(0x10, 0x6, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x0, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) listen(r2, 0xc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x8) 5.085802657s ago: executing program 4 (id=637): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)={0x74, 0x0, 0x2516fe2a6eac4bfd}) 2.323250258s ago: executing program 3 (id=638): socket$netlink(0x10, 0x3, 0x0) socket(0x23, 0x2, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1a, &(0x7f0000000300)=""/20, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x6}) r0 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r0, 0xe) 1.536781746s ago: executing program 4 (id=639): r0 = socket$kcm(0x29, 0x2, 0x0) write$cgroup_pressure(r0, &(0x7f0000000140)={'full'}, 0xfffffdef) ioctl$int_in(r0, 0x5452, &(0x7f0000000240)=0x3) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x20040011) 1.470577847s ago: executing program 2 (id=640): symlink(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f0000000000)='./file0\x00') r0 = semget$private(0x0, 0x6, 0x0) semop(r0, &(0x7f0000000040)=[{0x4, 0x7fff, 0x800}, {0x4, 0x70, 0x800}], 0x2) chmod(&(0x7f0000003040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x2) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2b80, 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffffc) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_usbip_server_init(0x5) r2 = openat$sw_sync_info(0xffffffffffffff9c, 0x0, 0x88400, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB="1000"/20, @ANYRES32, @ANYBLOB], 0x50) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), 0xffffffffffffffff) syz_80211_inject_frame(&(0x7f00000000c0), 0x0, 0x36) dup(0xffffffffffffffff) lstat(&(0x7f0000000180)='./file0\x00', 0x0) chown(&(0x7f00000003c0)='./file0\x00', 0x0, 0xee01) read(0xffffffffffffffff, &(0x7f0000001180)=""/4096, 0x1000) 43.464539ms ago: executing program 0 (id=641): sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)={0x1c, 0x0, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x8c0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de", 0x9b}, {&(0x7f0000000780)}, {&(0x7f0000000800)}, {&(0x7f00000000c0)}], 0x5}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)}, {&(0x7f0000000580)}], 0x3, &(0x7f0000000cc0)=[@timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}], 0x30}}], 0x2, 0x20000044) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 0s ago: executing program 2 (id=642): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000786c6c2500000000002020207b0af8ff00000000bda100000000000057010000f8ffffffb702000008000000b703000000000000850000001900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, &(0x7f0000000200)='\x00\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800001bc81a000000000000000001851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000101180000000000000000000000000000119500000000000000360a000000000000180900002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222}, 0x94) kernel console output (not intermixed with test programs): 327] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.173039][ T4281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.193487][ T4281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.203708][ T4281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.217958][ T4281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.229892][ T4281] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.239836][ T4281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.250834][ T4281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.261926][ T4281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.273667][ T4281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.284800][ T4281] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.292384][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 80.302507][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 80.310974][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 80.320869][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 80.329304][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 80.344050][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 80.353035][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 80.361821][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 80.387240][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.402500][ T4280] device veth0_macvtap entered promiscuous mode [ 80.410477][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.423248][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 80.432669][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 80.442181][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 80.451816][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 80.462960][ T4281] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.474306][ T4281] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.483737][ T4281] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.492894][ T4281] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.513283][ T4280] device veth1_macvtap entered promiscuous mode [ 80.546639][ T4344] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.559155][ T4344] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.567355][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 80.575482][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 80.596094][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.607599][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.618314][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.629004][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.639544][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.651577][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.663797][ T4280] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.702136][ T4328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.712006][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 80.724293][ T4328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.733143][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 80.745181][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 80.754338][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 80.765482][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 80.780740][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.792117][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.802184][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.814027][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.825317][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.837031][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.850355][ T4280] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.863853][ T4282] device veth0_macvtap entered promiscuous mode [ 80.884854][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 80.923389][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 80.953349][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 80.970177][ T4280] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.986660][ T4280] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.997862][ T4280] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.006703][ T4280] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.025894][ T4282] device veth1_macvtap entered promiscuous mode [ 81.057560][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.083545][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.143963][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.156362][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.166873][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.180651][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.190878][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.202132][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.212961][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.224092][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.238054][ T4282] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.254650][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 81.273049][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 81.281924][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 81.299420][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 81.317444][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.329276][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.339660][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.351635][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.397647][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.430590][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.445193][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.467615][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.503322][ T4282] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.687938][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 81.698065][ T4344] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.706023][ T4344] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.715706][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 81.725586][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 81.748039][ T4282] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.763545][ T4282] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.783143][ T4282] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.822089][ T4282] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.857433][ T48] Bluetooth: hci1: command 0x0419 tx timeout [ 81.859992][ T4290] Bluetooth: hci4: command 0x0419 tx timeout [ 81.863483][ T48] Bluetooth: hci0: command 0x0419 tx timeout [ 81.869496][ T4290] Bluetooth: hci3: command 0x0419 tx timeout [ 81.869526][ T4290] Bluetooth: hci2: command 0x0419 tx timeout [ 82.048665][ T4328] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.056548][ T4328] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.108508][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 82.162495][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.193548][ T4327] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.223610][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.236893][ T4327] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.268468][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 82.290388][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 82.367097][ T4327] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.375413][ T4327] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.404121][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 83.506382][ T4410] loop3: detected capacity change from 0 to 256 [ 83.773233][ T4410] FAT-fs (loop3): Directory bread(block 64) failed [ 83.827151][ T4410] FAT-fs (loop3): Directory bread(block 65) failed [ 83.873633][ T4410] FAT-fs (loop3): Directory bread(block 66) failed [ 83.910818][ T4410] FAT-fs (loop3): Directory bread(block 67) failed [ 83.987816][ T4410] FAT-fs (loop3): Directory bread(block 68) failed [ 83.995295][ T4410] FAT-fs (loop3): Directory bread(block 69) failed [ 84.002277][ T4410] FAT-fs (loop3): Directory bread(block 70) failed [ 84.009109][ T4410] FAT-fs (loop3): Directory bread(block 71) failed [ 84.015744][ T4410] FAT-fs (loop3): Directory bread(block 72) failed [ 84.037645][ T4410] FAT-fs (loop3): Directory bread(block 73) failed [ 84.175560][ T4419] process 'syz.2.20' launched './file0' with NULL argv: empty string added [ 84.469475][ T4423] syz.3.18: attempt to access beyond end of device [ 84.469475][ T4423] loop3: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 84.485570][ T4423] syz.3.18: attempt to access beyond end of device [ 84.485570][ T4423] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 84.505871][ T26] audit: type=1800 audit(1782950401.837:2): pid=4423 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.18" name="file0" dev="loop3" ino=1048616 res=0 errno=0 [ 84.536619][ T4423] syz.3.18: attempt to access beyond end of device [ 84.536619][ T4423] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 84.551154][ T4423] syz.3.18: attempt to access beyond end of device [ 84.551154][ T4423] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 84.565339][ T4423] Buffer I/O error on dev loop3, logical block 290, async page read [ 84.761620][ T4423] syz.3.18 (4423) used greatest stack depth: 20720 bytes left [ 84.923708][ T4427] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 85.132949][ T4433] Zero length message leads to an empty skb [ 87.317980][ T14] cfg80211: failed to load regulatory.db [ 88.699250][ T4359] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 88.946825][ T4359] usb 3-1: Using ep0 maxpacket: 16 [ 88.971777][ T4359] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 89.009257][ T4359] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 89.019446][ T4359] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 89.032524][ T4359] usb 3-1: config 0 interface 0 has no altsetting 0 [ 89.041697][ T4359] usb 3-1: New USB device found, idVendor=0757, idProduct=0a00, bcdDevice= 0.00 [ 89.050946][ T4359] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.147330][ T4359] usb 3-1: config 0 descriptor?? [ 89.155116][ T4470] tmpfs: Unknown parameter 'quota' [ 90.241531][ T4479] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 90.249107][ T4479] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 90.934369][ T4359] usbhid 3-1:0.0: can't add hid device: -71 [ 90.946946][ T4359] usbhid: probe of 3-1:0.0 failed with error -71 [ 90.963721][ T4359] usb 3-1: USB disconnect, device number 2 [ 91.001693][ T4323] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 91.266975][ T4323] usb 5-1: Using ep0 maxpacket: 16 [ 91.302382][ T4323] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 91.356867][ T4323] usb 5-1: config 0 has no interface number 0 [ 91.941079][ T4323] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 91.978617][ T4323] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 91.987788][ T4323] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 91.995900][ T4323] usb 5-1: Product: syz [ 92.000566][ T4323] usb 5-1: SerialNumber: syz [ 92.014061][ T4323] usb 5-1: config 0 descriptor?? [ 92.049796][ T4323] usbhid 5-1:0.8: couldn't find an input interrupt endpoint [ 92.400817][ T4323] usb 5-1: USB disconnect, device number 2 [ 92.888576][ T4510] tmpfs: Unknown parameter 'quota' [ 94.436752][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 94.456743][ T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!! [ 94.728433][ T4323] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 94.746753][ T0] NOHZ tick-stop error: local softirq work is pending, handler #302!!! [ 94.766763][ T0] NOHZ tick-stop error: local softirq work is pending, handler #302!!! [ 94.776757][ T0] NOHZ tick-stop error: local softirq work is pending, handler #302!!! [ 94.786757][ T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!! [ 94.796756][ T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!! [ 94.806761][ T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!! [ 94.816772][ T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!! [ 95.108996][ T4323] usb 4-1: Using ep0 maxpacket: 16 [ 95.119952][ T4323] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.776777][ T0] NOHZ tick-stop error: local softirq work is pending, handler #182!!! [ 95.836846][ T4323] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 95.853650][ T4323] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 95.866902][ T4323] usb 4-1: config 0 interface 0 has no altsetting 0 [ 95.874037][ T4323] usb 4-1: New USB device found, idVendor=0757, idProduct=0a00, bcdDevice= 0.00 [ 95.884185][ T4323] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.934721][ T4323] usb 4-1: config 0 descriptor?? [ 96.184900][ T4550] netlink: 'syz.2.60': attribute type 2 has an invalid length. [ 96.258441][ T4359] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 96.487294][ T4359] usb 1-1: Using ep0 maxpacket: 16 [ 96.521693][ T4359] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 96.626129][ T4359] usb 1-1: config 0 has no interface number 0 [ 96.662674][ T4323] usbhid 4-1:0.0: can't add hid device: -71 [ 96.722359][ T4323] usbhid: probe of 4-1:0.0 failed with error -71 [ 96.760610][ T4359] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 96.850359][ T4323] usb 4-1: USB disconnect, device number 2 [ 96.964656][ T4359] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 97.007147][ T4359] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 97.042774][ T4359] usb 1-1: Product: syz [ 97.053558][ T4359] usb 1-1: SerialNumber: syz [ 97.112404][ T4560] tmpfs: Unknown parameter 'quota' [ 97.880482][ T4359] usb 1-1: config 0 descriptor?? [ 97.890783][ T4359] usbhid 1-1:0.8: couldn't find an input interrupt endpoint [ 98.418858][ T4569] xt_hashlimit: size too large, truncated to 1048576 [ 99.828954][ T4319] usb 1-1: USB disconnect, device number 2 [ 101.348549][ T4608] netlink: 'syz.4.73': attribute type 2 has an invalid length. [ 102.827720][ T48] Bluetooth: hci1: Unknown advertising packet type: 0x20 [ 102.827894][ T48] Bluetooth: hci1: Malformed LE Event: 0x0d [ 103.216266][ T4619] tmpfs: Unknown parameter 'quota' [ 104.807804][ T4637] loop4: detected capacity change from 0 to 256 [ 104.873171][ T4637] FAT-fs (loop4): Directory bread(block 64) failed [ 104.895142][ T4637] FAT-fs (loop4): Directory bread(block 65) failed [ 104.924128][ T4637] FAT-fs (loop4): Directory bread(block 66) failed [ 104.940546][ T4637] FAT-fs (loop4): Directory bread(block 67) failed [ 104.956911][ T4637] FAT-fs (loop4): Directory bread(block 68) failed [ 104.963882][ T4637] FAT-fs (loop4): Directory bread(block 69) failed [ 105.018162][ T4637] FAT-fs (loop4): Directory bread(block 70) failed [ 105.045591][ T4637] FAT-fs (loop4): Directory bread(block 71) failed [ 105.072969][ T4637] FAT-fs (loop4): Directory bread(block 72) failed [ 105.101072][ T4637] FAT-fs (loop4): Directory bread(block 73) failed [ 105.364937][ T4637] syz.4.83: attempt to access beyond end of device [ 105.364937][ T4637] loop4: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 105.378534][ T4637] syz.4.83: attempt to access beyond end of device [ 105.378534][ T4637] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 105.392275][ T26] audit: type=1800 audit(1782950422.727:3): pid=4637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.83" name="file0" dev="loop4" ino=1048638 res=0 errno=0 [ 105.393296][ T4637] syz.4.83: attempt to access beyond end of device [ 105.393296][ T4637] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 105.428326][ T4637] syz.4.83: attempt to access beyond end of device [ 105.428326][ T4637] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 105.441498][ T4637] Buffer I/O error on dev loop4, logical block 290, async page read [ 106.756288][ T4667] tmpfs: Unknown parameter 'quota' [ 108.005748][ T4675] mmap: syz.4.93 (4675) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 108.715101][ T4684] loop2: detected capacity change from 0 to 256 [ 108.793666][ T4684] FAT-fs (loop2): Directory bread(block 64) failed [ 108.810326][ T4684] FAT-fs (loop2): Directory bread(block 65) failed [ 108.831316][ T4684] FAT-fs (loop2): Directory bread(block 66) failed [ 108.853320][ T4684] FAT-fs (loop2): Directory bread(block 67) failed [ 108.866953][ T4684] FAT-fs (loop2): Directory bread(block 68) failed [ 108.896342][ T4684] FAT-fs (loop2): Directory bread(block 69) failed [ 108.917091][ T4684] FAT-fs (loop2): Directory bread(block 70) failed [ 108.934819][ T4684] FAT-fs (loop2): Directory bread(block 71) failed [ 108.952843][ T4684] FAT-fs (loop2): Directory bread(block 72) failed [ 108.976346][ T4684] FAT-fs (loop2): Directory bread(block 73) failed [ 110.497989][ T4684] syz.2.96: attempt to access beyond end of device [ 110.497989][ T4684] loop2: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 110.511615][ T4684] syz.2.96: attempt to access beyond end of device [ 110.511615][ T4684] loop2: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 110.525825][ T4684] syz.2.96: attempt to access beyond end of device [ 110.525825][ T4684] loop2: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 110.539543][ T4684] syz.2.96: attempt to access beyond end of device [ 110.539543][ T4684] loop2: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 110.552663][ T4684] Buffer I/O error on dev loop2, logical block 290, async page read [ 110.557082][ T26] audit: type=1800 audit(1782950427.857:4): pid=4684 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.96" name="file0" dev="loop2" ino=1048660 res=0 errno=0 [ 110.913252][ T4710] loop3: detected capacity change from 0 to 512 [ 110.969031][ T4710] EXT4-fs (loop3): #blocks per group too big: 67051520 [ 111.153940][ T4710] loop3: detected capacity change from 0 to 4096 [ 111.195266][ T4710] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 111.292831][ T4710] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 111.631549][ T4719] overlayfs: missing 'lowerdir' [ 112.255330][ T4280] EXT4-fs (loop3): unmounting filesystem. [ 112.764539][ T4740] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 112.772138][ T4740] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 113.699884][ T4744] loop2: detected capacity change from 0 to 256 [ 113.758540][ T4747] loop3: detected capacity change from 0 to 256 [ 113.830393][ T4747] FAT-fs (loop3): Directory bread(block 64) failed [ 113.877060][ T4747] FAT-fs (loop3): Directory bread(block 65) failed [ 113.896862][ T4747] FAT-fs (loop3): Directory bread(block 66) failed [ 113.903801][ T4744] FAT-fs (loop2): Directory bread(block 64) failed [ 113.934079][ T4744] FAT-fs (loop2): Directory bread(block 65) failed [ 113.963399][ T4744] FAT-fs (loop2): Directory bread(block 66) failed [ 113.977707][ T4747] FAT-fs (loop3): Directory bread(block 67) failed [ 114.002371][ T4744] FAT-fs (loop2): Directory bread(block 67) failed [ 114.017766][ T4744] FAT-fs (loop2): Directory bread(block 68) failed [ 114.034801][ T4744] FAT-fs (loop2): Directory bread(block 69) failed [ 114.046013][ T4744] FAT-fs (loop2): Directory bread(block 70) failed [ 114.063114][ T4744] FAT-fs (loop2): Directory bread(block 71) failed [ 114.107294][ T4747] FAT-fs (loop3): Directory bread(block 68) failed [ 114.114381][ T4747] FAT-fs (loop3): Directory bread(block 69) failed [ 114.124351][ T4744] FAT-fs (loop2): Directory bread(block 72) failed [ 114.161094][ T4744] FAT-fs (loop2): Directory bread(block 73) failed [ 114.227359][ T4747] FAT-fs (loop3): Directory bread(block 70) failed [ 114.415925][ T4747] FAT-fs (loop3): Directory bread(block 71) failed [ 114.436495][ T4747] FAT-fs (loop3): Directory bread(block 72) failed [ 115.643363][ T4747] FAT-fs (loop3): Directory bread(block 73) failed [ 116.177705][ T4747] syz.3.112: attempt to access beyond end of device [ 116.177705][ T4747] loop3: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 116.192057][ T4747] syz.3.112: attempt to access beyond end of device [ 116.192057][ T4747] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 116.206679][ T4747] syz.3.112: attempt to access beyond end of device [ 116.206679][ T4747] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 116.222082][ T4747] syz.3.112: attempt to access beyond end of device [ 116.222082][ T4747] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 116.227198][ T26] audit: type=1800 audit(1782950433.537:5): pid=4747 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.112" name="file0" dev="loop3" ino=1048703 res=0 errno=0 [ 116.235912][ T4747] Buffer I/O error on dev loop3, logical block 290, async page read [ 116.540153][ T4755] loop2: detected capacity change from 0 to 4096 [ 116.648574][ T4755] EXT4-fs: Ignoring removed nomblk_io_submit option [ 116.746941][ T4755] EXT4-fs: inline encryption not supported [ 116.755538][ T4755] EXT4-fs: quotafile must be on filesystem root [ 119.810289][ T4765] netlink: 28 bytes leftover after parsing attributes in process `syz.3.115'. [ 120.452667][ T4778] loop4: detected capacity change from 0 to 256 [ 120.642477][ T4788] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 120.651306][ T4788] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 121.444047][ T4778] FAT-fs (loop4): Directory bread(block 64) failed [ 121.514879][ T4778] FAT-fs (loop4): Directory bread(block 65) failed [ 121.589379][ T4778] FAT-fs (loop4): Directory bread(block 66) failed [ 121.666642][ T4778] FAT-fs (loop4): Directory bread(block 67) failed [ 121.732202][ T4797] loop0: detected capacity change from 0 to 256 [ 121.740113][ T4778] FAT-fs (loop4): Directory bread(block 68) failed [ 121.748389][ T4796] loop3: detected capacity change from 0 to 4096 [ 121.809087][ T4796] EXT4-fs: Ignoring removed nomblk_io_submit option [ 121.815848][ T4796] EXT4-fs: inline encryption not supported [ 121.816906][ T4778] FAT-fs (loop4): Directory bread(block 69) failed [ 122.027618][ T4796] EXT4-fs: quotafile must be on filesystem root [ 122.129998][ T4778] FAT-fs (loop4): Directory bread(block 70) failed [ 122.422583][ T4778] FAT-fs (loop4): Directory bread(block 71) failed [ 122.577423][ T4778] FAT-fs (loop4): Directory bread(block 72) failed [ 122.584116][ T4778] FAT-fs (loop4): Directory bread(block 73) failed [ 122.591850][ T4797] FAT-fs (loop0): Directory bread(block 64) failed [ 122.637315][ T4797] FAT-fs (loop0): Directory bread(block 65) failed [ 122.644129][ T4797] FAT-fs (loop0): Directory bread(block 66) failed [ 122.659444][ T4797] FAT-fs (loop0): Directory bread(block 67) failed [ 122.762672][ T4797] FAT-fs (loop0): Directory bread(block 68) failed [ 122.817038][ T4797] FAT-fs (loop0): Directory bread(block 69) failed [ 122.824264][ T4797] FAT-fs (loop0): Directory bread(block 70) failed [ 122.864381][ T4797] FAT-fs (loop0): Directory bread(block 71) failed [ 122.903503][ T4797] FAT-fs (loop0): Directory bread(block 72) failed [ 122.946365][ T4797] FAT-fs (loop0): Directory bread(block 73) failed [ 123.668666][ T4797] syz.0.124: attempt to access beyond end of device [ 123.668666][ T4797] loop0: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 123.681262][ T4812] netlink: 28 bytes leftover after parsing attributes in process `syz.3.130'. [ 123.682565][ T4797] syz.0.124: attempt to access beyond end of device [ 123.682565][ T4797] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 123.709873][ T4797] syz.0.124: attempt to access beyond end of device [ 123.709873][ T4797] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 123.724477][ T26] audit: type=1800 audit(1782950441.037:6): pid=4797 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.124" name="file0" dev="loop0" ino=1048746 res=0 errno=0 [ 123.746334][ T4797] syz.0.124: attempt to access beyond end of device [ 123.746334][ T4797] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 123.763602][ T4797] Buffer I/O error on dev loop0, logical block 290, async page read [ 124.436471][ T4826] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.135'. [ 124.473286][ T4826] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.135'. [ 124.571220][ T4830] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 124.581989][ T4830] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 126.936336][ T4837] netlink: 'syz.3.137': attribute type 2 has an invalid length. [ 126.973550][ T4843] sctp: [Deprecated]: syz.1.140 (pid 4843) Use of struct sctp_assoc_value in delayed_ack socket option. [ 126.973550][ T4843] Use struct sctp_sack_info instead [ 127.335878][ T48] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 127.345798][ T48] CPU: 1 PID: 48 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 127.353196][ T48] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 127.363271][ T48] Workqueue: hci1 hci_rx_work [ 127.368025][ T48] Call Trace: [ 127.371315][ T48] [ 127.374264][ T48] dump_stack_lvl+0x188/0x24e [ 127.378975][ T48] ? show_regs_print_info+0x12/0x12 [ 127.384201][ T48] ? load_image+0x410/0x410 [ 127.388744][ T48] sysfs_create_dir_ns+0x26a/0x290 [ 127.393885][ T48] ? __lock_acquire+0x7bd0/0x7bd0 [ 127.398969][ T48] ? sysfs_warn_dup+0xa0/0xa0 [ 127.403692][ T48] ? do_raw_spin_unlock+0x11d/0x230 [ 127.408928][ T48] kobject_add_internal+0x617/0xca0 [ 127.414181][ T48] kobject_add+0x160/0x230 [ 127.418721][ T48] ? kobject_init+0x1c0/0x1c0 [ 127.423425][ T48] ? __raw_spin_lock_init+0x41/0x100 [ 127.428760][ T48] ? klist_children_get+0x50/0x50 [ 127.433811][ T48] ? get_device_parent+0x121/0x3e0 [ 127.438949][ T48] device_add+0x470/0x1050 [ 127.443477][ T48] hci_conn_add_sysfs+0xd1/0x1e0 [ 127.448794][ T48] le_conn_complete_evt+0xf69/0x1560 [ 127.454162][ T48] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 127.460633][ T48] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 127.466589][ T48] ? mutex_unlock+0x10/0x10 [ 127.473806][ T48] ? skb_pull_data+0xec/0x1f0 [ 127.480014][ T48] hci_le_conn_complete_evt+0x183/0x440 [ 127.485830][ T48] ? hci_remote_host_features_evt+0x230/0x230 [ 127.492642][ T48] hci_event_packet+0x7b3/0x1290 [ 127.497632][ T48] ? __lock_acquire+0x7bd0/0x7bd0 [ 127.502694][ T48] ? bis_list+0x280/0x280 [ 127.507065][ T48] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 127.513088][ T48] ? kcov_remote_start+0x4b0/0x7e0 [ 127.518336][ T48] ? nf_ct_resolve_clash+0x572/0x68f [ 127.523661][ T48] ? hci_send_to_monitor+0x9c/0x4a0 [ 127.528907][ T48] hci_rx_work+0x3eb/0xd40 [ 127.533369][ T48] ? _raw_spin_unlock+0x40/0x40 [ 127.538250][ T48] ? process_one_work+0x7b4/0x1160 [ 127.543366][ T48] process_one_work+0x8ab/0x1160 [ 127.548485][ T48] ? worker_detach_from_pool+0x240/0x240 [ 127.554138][ T48] ? _raw_spin_lock_irq+0xb7/0xf0 [ 127.559187][ T48] ? _raw_spin_lock_irqsave+0x100/0x100 [ 127.564739][ T48] ? wq_worker_running+0x97/0x190 [ 127.569758][ T48] worker_thread+0xaf5/0x12a0 [ 127.574491][ T48] kthread+0x29d/0x330 [ 127.578563][ T48] ? worker_clr_flags+0x1a0/0x1a0 [ 127.583625][ T48] ? kthread_blkcg+0xd0/0xd0 [ 127.588214][ T48] ret_from_fork+0x1f/0x30 [ 127.592646][ T48] [ 127.608474][ T48] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 127.624531][ T48] Bluetooth: hci1: failed to register connection device [ 128.010769][ T4860] loop1: detected capacity change from 0 to 256 [ 128.200544][ T4860] FAT-fs (loop1): Directory bread(block 64) failed [ 128.232324][ T4860] FAT-fs (loop1): Directory bread(block 65) failed [ 128.260873][ T4860] FAT-fs (loop1): Directory bread(block 66) failed [ 128.313401][ T4863] loop3: detected capacity change from 0 to 4096 [ 128.320781][ T4860] FAT-fs (loop1): Directory bread(block 67) failed [ 128.346249][ T4860] FAT-fs (loop1): Directory bread(block 68) failed [ 128.356347][ T4860] FAT-fs (loop1): Directory bread(block 69) failed [ 128.375446][ T4863] EXT4-fs: Ignoring removed nomblk_io_submit option [ 128.410778][ T4860] FAT-fs (loop1): Directory bread(block 70) failed [ 128.424203][ T4863] EXT4-fs: inline encryption not supported [ 128.446011][ T4863] EXT4-fs: quotafile must be on filesystem root [ 128.452910][ T4860] FAT-fs (loop1): Directory bread(block 71) failed [ 128.470593][ T4860] FAT-fs (loop1): Directory bread(block 72) failed [ 128.490659][ T4860] FAT-fs (loop1): Directory bread(block 73) failed [ 130.502366][ T4873] loop4: detected capacity change from 0 to 256 [ 130.687459][ T4873] FAT-fs (loop4): Directory bread(block 64) failed [ 130.694145][ T4873] FAT-fs (loop4): Directory bread(block 65) failed [ 130.706996][ T4873] FAT-fs (loop4): Directory bread(block 66) failed [ 130.713607][ T4873] FAT-fs (loop4): Directory bread(block 67) failed [ 130.736939][ T4873] FAT-fs (loop4): Directory bread(block 68) failed [ 130.755845][ T4873] FAT-fs (loop4): Directory bread(block 69) failed [ 130.763725][ T4873] FAT-fs (loop4): Directory bread(block 70) failed [ 130.770732][ T4873] FAT-fs (loop4): Directory bread(block 71) failed [ 130.777928][ T4873] FAT-fs (loop4): Directory bread(block 72) failed [ 130.784494][ T4873] FAT-fs (loop4): Directory bread(block 73) failed [ 131.292411][ T4886] syz.4.149: attempt to access beyond end of device [ 131.292411][ T4886] loop4: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 131.310255][ T4886] syz.4.149: attempt to access beyond end of device [ 131.310255][ T4886] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 131.336197][ T4886] syz.4.149: attempt to access beyond end of device [ 131.336197][ T4886] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 131.355356][ T4886] syz.4.149: attempt to access beyond end of device [ 131.355356][ T4886] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 131.368876][ T4886] Buffer I/O error on dev loop4, logical block 290, async page read [ 131.435831][ T26] audit: type=1800 audit(1782950448.657:7): pid=4886 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.149" name="file0" dev="loop4" ino=1048789 res=0 errno=0 [ 132.763982][ T48] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 132.846174][ T4343] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 132.854090][ T1278] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.860463][ T1278] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.036851][ T4343] usb 4-1: device descriptor read/64, error -71 [ 133.049584][ T4902] loop1: detected capacity change from 0 to 4096 [ 133.114185][ T4902] EXT4-fs: Ignoring removed nomblk_io_submit option [ 133.130671][ T4902] EXT4-fs: inline encryption not supported [ 133.140435][ T4909] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.159'. [ 133.193042][ T4902] EXT4-fs: quotafile must be on filesystem root [ 133.211875][ T48] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 133.222025][ T48] CPU: 1 PID: 48 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 133.229444][ T48] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 133.239526][ T48] Workqueue: hci0 hci_rx_work [ 133.244243][ T48] Call Trace: [ 133.247542][ T48] [ 133.250492][ T48] dump_stack_lvl+0x188/0x24e [ 133.255197][ T48] ? show_regs_print_info+0x12/0x12 [ 133.260424][ T48] ? load_image+0x410/0x410 [ 133.264978][ T48] sysfs_create_dir_ns+0x26a/0x290 [ 133.270122][ T48] ? __lock_acquire+0x7bd0/0x7bd0 [ 133.275179][ T48] ? sysfs_warn_dup+0xa0/0xa0 [ 133.279893][ T48] ? do_raw_spin_unlock+0x11d/0x230 [ 133.285131][ T48] kobject_add_internal+0x617/0xca0 [ 133.290369][ T48] kobject_add+0x160/0x230 [ 133.294923][ T48] ? kobject_init+0x1c0/0x1c0 [ 133.299650][ T48] ? __raw_spin_lock_init+0x41/0x100 [ 133.304960][ T48] ? klist_children_get+0x50/0x50 [ 133.310014][ T48] ? get_device_parent+0x121/0x3e0 [ 133.315164][ T48] device_add+0x470/0x1050 [ 133.319617][ T48] hci_conn_add_sysfs+0xd1/0x1e0 [ 133.324581][ T48] le_conn_complete_evt+0xf69/0x1560 [ 133.329911][ T48] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 133.336222][ T48] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 133.341891][ T48] ? mutex_unlock+0x10/0x10 [ 133.346425][ T48] ? skb_pull_data+0xec/0x1f0 [ 133.351135][ T48] hci_le_conn_complete_evt+0x183/0x440 [ 133.356717][ T48] ? hci_remote_host_features_evt+0x230/0x230 [ 133.362810][ T48] hci_event_packet+0x7b3/0x1290 [ 133.367784][ T48] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 133.373457][ T48] ? bis_list+0x280/0x280 [ 133.377907][ T48] ? kcov_remote_start+0x1b1/0x7e0 [ 133.383049][ T48] ? hci_send_to_monitor+0x9c/0x4a0 [ 133.388286][ T48] hci_rx_work+0x3eb/0xd40 [ 133.392734][ T48] ? _raw_spin_unlock+0x40/0x40 [ 133.397618][ T48] ? process_one_work+0x7b4/0x1160 [ 133.402756][ T48] process_one_work+0x8ab/0x1160 [ 133.407734][ T48] ? worker_detach_from_pool+0x240/0x240 [ 133.413413][ T48] ? _raw_spin_lock_irq+0xb7/0xf0 [ 133.418464][ T48] ? _raw_spin_lock_irqsave+0x100/0x100 [ 133.424141][ T48] ? wq_worker_running+0x97/0x190 [ 133.429201][ T48] worker_thread+0xaf5/0x12a0 [ 133.433948][ T48] kthread+0x29d/0x330 [ 133.438047][ T48] ? worker_clr_flags+0x1a0/0x1a0 [ 133.443097][ T48] ? kthread_blkcg+0xd0/0xd0 [ 133.447709][ T48] ret_from_fork+0x1f/0x30 [ 133.452173][ T48] [ 133.465033][ T4912] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 133.472559][ T4912] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 133.515017][ T48] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 133.530034][ T48] Bluetooth: hci0: failed to register connection device [ 133.630042][ T4909] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.159'. [ 133.827398][ T4343] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 134.916738][ C0] sched: RT throttling activated [ 135.177895][ T4921] loop3: detected capacity change from 0 to 256 [ 136.193614][ T4921] FAT-fs (loop3): Directory bread(block 64) failed [ 136.206837][ T4921] FAT-fs (loop3): Directory bread(block 65) failed [ 136.259983][ T4921] FAT-fs (loop3): Directory bread(block 66) failed [ 136.306572][ T4928] loop0: detected capacity change from 0 to 256 [ 136.321032][ T4921] FAT-fs (loop3): Directory bread(block 67) failed [ 136.328033][ T4921] FAT-fs (loop3): Directory bread(block 68) failed [ 136.334602][ T4921] FAT-fs (loop3): Directory bread(block 69) failed [ 136.344112][ T4921] FAT-fs (loop3): Directory bread(block 70) failed [ 136.351179][ T4921] FAT-fs (loop3): Directory bread(block 71) failed [ 136.358601][ T4921] FAT-fs (loop3): Directory bread(block 72) failed [ 136.365509][ T4921] FAT-fs (loop3): Directory bread(block 73) failed [ 136.623180][ T4928] FAT-fs (loop0): Directory bread(block 64) failed [ 136.697266][ T4928] FAT-fs (loop0): Directory bread(block 65) failed [ 136.727791][ T4928] FAT-fs (loop0): Directory bread(block 66) failed [ 136.807511][ T4928] FAT-fs (loop0): Directory bread(block 67) failed [ 137.851223][ T4928] FAT-fs (loop0): Directory bread(block 68) failed [ 137.907844][ T4928] FAT-fs (loop0): Directory bread(block 69) failed [ 137.914638][ T4928] FAT-fs (loop0): Directory bread(block 70) failed [ 137.921257][ T4928] FAT-fs (loop0): Directory bread(block 71) failed [ 137.928150][ T4928] FAT-fs (loop0): Directory bread(block 72) failed [ 137.934711][ T4928] FAT-fs (loop0): Directory bread(block 73) failed [ 138.447608][ T4945] syz.0.165: attempt to access beyond end of device [ 138.447608][ T4945] loop0: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 138.461366][ T4945] syz.0.165: attempt to access beyond end of device [ 138.461366][ T4945] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 138.476445][ T4945] syz.0.165: attempt to access beyond end of device [ 138.476445][ T4945] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 138.490288][ T4945] syz.0.165: attempt to access beyond end of device [ 138.490288][ T4945] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 138.503489][ T4945] Buffer I/O error on dev loop0, logical block 290, async page read [ 138.520475][ T26] audit: type=1800 audit(1782950455.807:8): pid=4945 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.165" name="file0" dev="loop0" ino=1048832 res=0 errno=0 [ 138.902073][ T4952] tmpfs: Unknown parameter 'quota' [ 139.157174][ T4343] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 139.347292][ T4343] usb 5-1: device descriptor read/64, error -71 [ 139.380156][ T4954] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.173'. [ 139.500201][ T4954] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.173'. [ 139.627249][ T4343] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 139.811214][ T4343] usb 5-1: device descriptor read/64, error -71 [ 139.971981][ T4290] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 140.016864][ T4290] Bluetooth: hci0: command 0x0406 tx timeout [ 140.047829][ T4343] usb usb5-port1: attempt power cycle [ 140.576969][ T4343] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 140.627792][ T4343] usb 5-1: device descriptor read/8, error -71 [ 141.235057][ T4343] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 141.598824][ T4343] usb 5-1: device descriptor read/8, error -71 [ 141.712743][ T4981] loop2: detected capacity change from 0 to 512 [ 141.727079][ T4343] usb usb5-port1: unable to enumerate USB device [ 141.748475][ T4981] EXT4-fs (loop2): #blocks per group too big: 67051520 [ 141.989120][ T4986] loop3: detected capacity change from 0 to 256 [ 145.419662][ T4995] tmpfs: Unknown parameter 'quota' [ 146.258501][ T4290] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 146.321084][ T5005] netlink: 'syz.2.189': attribute type 2 has an invalid length. [ 146.927441][ T48] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 148.500755][ T5041] loop3: detected capacity change from 0 to 256 [ 148.796283][ T5041] FAT-fs (loop3): Directory bread(block 64) failed [ 148.923664][ T5041] FAT-fs (loop3): Directory bread(block 65) failed [ 149.069792][ T5041] FAT-fs (loop3): Directory bread(block 66) failed [ 149.194066][ T5041] FAT-fs (loop3): Directory bread(block 67) failed [ 149.319613][ T5041] FAT-fs (loop3): Directory bread(block 68) failed [ 149.389750][ T5041] FAT-fs (loop3): Directory bread(block 69) failed [ 149.424902][ T5041] FAT-fs (loop3): Directory bread(block 70) failed [ 149.452204][ T5041] FAT-fs (loop3): Directory bread(block 71) failed [ 149.482625][ T5041] FAT-fs (loop3): Directory bread(block 72) failed [ 149.493485][ T5045] loop1: detected capacity change from 0 to 512 [ 149.509008][ T5041] FAT-fs (loop3): Directory bread(block 73) failed [ 149.569428][ T5045] EXT4-fs (loop1): #blocks per group too big: 67051520 [ 150.167558][ T5047] syz.3.198: attempt to access beyond end of device [ 150.167558][ T5047] loop3: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 150.181377][ T5047] syz.3.198: attempt to access beyond end of device [ 150.181377][ T5047] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 150.296971][ T5047] syz.3.198: attempt to access beyond end of device [ 150.296971][ T5047] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 150.431346][ T5047] syz.3.198: attempt to access beyond end of device [ 150.431346][ T5047] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 150.444682][ T5047] Buffer I/O error on dev loop3, logical block 290, async page read [ 150.461369][ T26] audit: type=1800 audit(1782950467.527:9): pid=5047 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.198" name="file0" dev="loop3" ino=1048854 res=0 errno=0 [ 150.963060][ T5050] tmpfs: Unknown parameter 'quota' [ 151.792722][ T4290] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 151.802689][ T4290] CPU: 0 PID: 4290 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 151.806933][ T5045] loop1: detected capacity change from 0 to 4096 [ 151.810249][ T4290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 151.810289][ T4290] Workqueue: hci2 hci_rx_work [ 151.810322][ T4290] Call Trace: [ 151.824899][ T5045] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 151.826694][ T4290] [ 151.826706][ T4290] dump_stack_lvl+0x188/0x24e [ 151.826735][ T4290] ? show_regs_print_info+0x12/0x12 [ 151.826756][ T4290] ? load_image+0x410/0x410 [ 151.826794][ T4290] sysfs_create_dir_ns+0x26a/0x290 [ 151.865763][ T4290] ? __lock_acquire+0x7bd0/0x7bd0 [ 151.870817][ T4290] ? sysfs_warn_dup+0xa0/0xa0 [ 151.875547][ T4290] ? do_raw_spin_unlock+0x11d/0x230 [ 151.880753][ T4290] kobject_add_internal+0x617/0xca0 [ 151.885976][ T4290] kobject_add+0x160/0x230 [ 151.890409][ T4290] ? kobject_init+0x1c0/0x1c0 [ 151.895091][ T4290] ? __raw_spin_lock_init+0x41/0x100 [ 151.900382][ T4290] ? klist_children_get+0x50/0x50 [ 151.905427][ T4290] ? get_device_parent+0x121/0x3e0 [ 151.910612][ T4290] device_add+0x470/0x1050 [ 151.915039][ T4290] hci_conn_add_sysfs+0xd1/0x1e0 [ 151.919980][ T4290] le_conn_complete_evt+0xf69/0x1560 [ 151.925306][ T4290] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 151.931561][ T4290] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 151.937199][ T4290] ? mutex_unlock+0x10/0x10 [ 151.941703][ T4290] ? skb_pull_data+0xec/0x1f0 [ 151.946576][ T4290] hci_le_conn_complete_evt+0x183/0x440 [ 151.952166][ T4290] ? hci_remote_host_features_evt+0x230/0x230 [ 151.958238][ T4290] hci_event_packet+0x7b3/0x1290 [ 151.963188][ T4290] ? __lock_acquire+0x7bd0/0x7bd0 [ 151.968214][ T4290] ? bis_list+0x280/0x280 [ 151.972547][ T4290] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 151.978469][ T4290] ? kcov_remote_start+0x4b0/0x7e0 [ 151.983596][ T4290] ? nf_ct_resolve_clash+0x572/0x68f [ 151.988910][ T4290] ? hci_send_to_monitor+0x9c/0x4a0 [ 151.994112][ T4290] hci_rx_work+0x3eb/0xd40 [ 151.998579][ T4290] ? _raw_spin_unlock+0x40/0x40 [ 152.003531][ T4290] ? process_one_work+0x7b4/0x1160 [ 152.008659][ T4290] process_one_work+0x8ab/0x1160 [ 152.013638][ T4290] ? worker_detach_from_pool+0x240/0x240 [ 152.019283][ T4290] ? _raw_spin_lock_irq+0xb7/0xf0 [ 152.024400][ T4290] ? _raw_spin_lock_irqsave+0x100/0x100 [ 152.029951][ T4290] ? wq_worker_running+0x97/0x190 [ 152.034974][ T4290] worker_thread+0xaf5/0x12a0 [ 152.039695][ T4290] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 152.045633][ T4290] kthread+0x29d/0x330 [ 152.049720][ T4290] ? worker_clr_flags+0x1a0/0x1a0 [ 152.054760][ T4290] ? kthread_blkcg+0xd0/0xd0 [ 152.059359][ T4290] ret_from_fork+0x1f/0x30 [ 152.063796][ T4290] [ 152.069233][ T4290] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 152.083250][ T4290] Bluetooth: hci2: failed to register connection device [ 152.100974][ T5052] netlink: 'syz.0.202': attribute type 2 has an invalid length. [ 152.183386][ T5045] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 152.587253][ T5065] overlayfs: missing 'lowerdir' [ 153.369087][ T4273] EXT4-fs (loop1): unmounting filesystem. [ 154.665432][ T4290] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 154.785441][ T5088] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.209'. [ 154.797165][ T5088] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.209'. [ 155.073229][ T5093] loop1: detected capacity change from 0 to 256 [ 155.593481][ T5093] FAT-fs (loop1): Directory bread(block 64) failed [ 155.786927][ T5093] FAT-fs (loop1): Directory bread(block 65) failed [ 155.824980][ T5093] FAT-fs (loop1): Directory bread(block 66) failed [ 155.864801][ T5093] FAT-fs (loop1): Directory bread(block 67) failed [ 155.929504][ T5093] FAT-fs (loop1): Directory bread(block 68) failed [ 155.978567][ T5093] FAT-fs (loop1): Directory bread(block 69) failed [ 155.985249][ T5093] FAT-fs (loop1): Directory bread(block 70) failed [ 156.032887][ T5093] FAT-fs (loop1): Directory bread(block 71) failed [ 156.076528][ T5093] FAT-fs (loop1): Directory bread(block 72) failed [ 156.634370][ T5093] FAT-fs (loop1): Directory bread(block 73) failed [ 156.703876][ T5099] tmpfs: Unknown parameter 'quota' [ 157.022585][ T5101] netlink: 'syz.3.214': attribute type 2 has an invalid length. [ 157.068887][ T5103] loop0: detected capacity change from 0 to 512 [ 157.195492][ T5103] EXT4-fs (loop0): #blocks per group too big: 67051520 [ 157.290854][ T5106] syz.1.211: attempt to access beyond end of device [ 157.290854][ T5106] loop1: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 157.304790][ T5106] syz.1.211: attempt to access beyond end of device [ 157.304790][ T5106] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 157.319926][ T5106] syz.1.211: attempt to access beyond end of device [ 157.319926][ T5106] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 157.333800][ T5106] syz.1.211: attempt to access beyond end of device [ 157.333800][ T5106] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 157.347206][ T5106] Buffer I/O error on dev loop1, logical block 290, async page read [ 157.364584][ T26] audit: type=1800 audit(1782950474.657:10): pid=5106 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.211" name="file0" dev="loop1" ino=1048876 res=0 errno=0 [ 157.849653][ T5103] loop0: detected capacity change from 0 to 4096 [ 157.952928][ T5103] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 158.025807][ T5121] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.220'. [ 158.047308][ T5121] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.220'. [ 158.082038][ T5103] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 158.399011][ T5129] overlayfs: missing 'lowerdir' [ 158.894681][ T4272] EXT4-fs (loop0): unmounting filesystem. [ 159.137025][ T48] Bluetooth: hci2: command 0x0406 tx timeout [ 160.948532][ T5151] tmpfs: Unknown parameter 'quota' [ 161.748326][ T5150] loop0: detected capacity change from 0 to 256 [ 161.802522][ T5148] netlink: 'syz.4.227': attribute type 2 has an invalid length. [ 161.854309][ T5150] FAT-fs (loop0): Directory bread(block 64) failed [ 161.957277][ T5150] FAT-fs (loop0): Directory bread(block 65) failed [ 161.984539][ T5158] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.231'. [ 161.990371][ T5150] FAT-fs (loop0): Directory bread(block 66) failed [ 162.005748][ T5158] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.231'. [ 162.082193][ T5150] FAT-fs (loop0): Directory bread(block 67) failed [ 162.154370][ T5150] FAT-fs (loop0): Directory bread(block 68) failed [ 162.212075][ T5150] FAT-fs (loop0): Directory bread(block 69) failed [ 162.227924][ T5162] loop3: detected capacity change from 0 to 512 [ 162.257529][ T5150] FAT-fs (loop0): Directory bread(block 70) failed [ 162.264147][ T5150] FAT-fs (loop0): Directory bread(block 71) failed [ 162.286981][ T5150] FAT-fs (loop0): Directory bread(block 72) failed [ 162.290183][ T5162] EXT4-fs (loop3): #blocks per group too big: 67051520 [ 162.308676][ T5150] FAT-fs (loop0): Directory bread(block 73) failed [ 162.493081][ T5162] loop3: detected capacity change from 0 to 4096 [ 162.619106][ T5162] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 162.755310][ T5174] syz.0.229: attempt to access beyond end of device [ 162.755310][ T5174] loop0: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 162.769380][ T5174] syz.0.229: attempt to access beyond end of device [ 162.769380][ T5174] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 162.789483][ T5174] syz.0.229: attempt to access beyond end of device [ 162.789483][ T5174] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 162.806100][ T5174] syz.0.229: attempt to access beyond end of device [ 162.806100][ T5174] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 162.819647][ T5174] Buffer I/O error on dev loop0, logical block 290, async page read [ 162.870696][ T26] audit: type=1800 audit(1782950480.117:11): pid=5174 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.229" name="file0" dev="loop0" ino=1048898 res=0 errno=0 [ 163.070352][ T5162] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 163.428326][ T5179] overlayfs: missing 'lowerdir' [ 164.050186][ T4280] EXT4-fs (loop3): unmounting filesystem. [ 166.052321][ T5203] tmpfs: Unknown parameter 'quota' [ 166.930656][ T5207] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.243'. [ 166.941697][ T5207] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.243'. [ 167.261870][ T5208] netlink: 'syz.0.244': attribute type 2 has an invalid length. [ 167.578188][ T5222] loop3: detected capacity change from 0 to 256 [ 168.488387][ T5225] loop2: detected capacity change from 0 to 512 [ 168.546462][ T5220] virtio-fs: tag not found [ 168.571023][ T26] audit: type=1326 audit(1782950485.907:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 168.602546][ T5222] FAT-fs (loop3): Directory bread(block 64) failed [ 168.651682][ T5225] EXT4-fs (loop2): #blocks per group too big: 67051520 [ 168.676881][ T5222] FAT-fs (loop3): Directory bread(block 65) failed [ 168.683621][ T5222] FAT-fs (loop3): Directory bread(block 66) failed [ 168.750708][ T26] audit: type=1326 audit(1782950485.907:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 168.757022][ T5222] FAT-fs (loop3): Directory bread(block 67) failed [ 168.862960][ T26] audit: type=1326 audit(1782950485.927:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 168.897095][ T5222] FAT-fs (loop3): Directory bread(block 68) failed [ 168.903688][ T5222] FAT-fs (loop3): Directory bread(block 69) failed [ 168.936702][ T5225] loop2: detected capacity change from 0 to 4096 [ 168.957221][ T5222] FAT-fs (loop3): Directory bread(block 70) failed [ 168.981293][ T5225] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 169.013286][ T5222] FAT-fs (loop3): Directory bread(block 71) failed [ 169.045714][ T5225] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 169.067969][ T5222] FAT-fs (loop3): Directory bread(block 72) failed [ 169.074558][ T5222] FAT-fs (loop3): Directory bread(block 73) failed [ 169.102069][ T26] audit: type=1326 audit(1782950485.927:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 169.384559][ T5229] overlayfs: missing 'lowerdir' [ 169.770728][ T26] audit: type=1326 audit(1782950485.927:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 169.851397][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 170.010813][ T5222] syz.3.247: attempt to access beyond end of device [ 170.010813][ T5222] loop3: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 170.024487][ T5222] syz.3.247: attempt to access beyond end of device [ 170.024487][ T5222] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 170.039098][ T5222] syz.3.247: attempt to access beyond end of device [ 170.039098][ T5222] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 170.052635][ T5222] syz.3.247: attempt to access beyond end of device [ 170.052635][ T5222] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 170.065875][ T5222] Buffer I/O error on dev loop3, logical block 290, async page read [ 170.292506][ T26] audit: type=1326 audit(1782950485.937:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 170.435577][ T26] audit: type=1326 audit(1782950485.937:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 170.460209][ T26] audit: type=1326 audit(1782950485.937:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 171.106957][ T26] audit: type=1326 audit(1782950485.957:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 171.838916][ T48] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 171.935239][ T26] audit: type=1326 audit(1782950485.957:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5219 comm="syz.0.248" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f5a19de59 code=0x7ffc0000 [ 172.196526][ T5251] tmpfs: Unknown parameter 'quota' [ 173.228949][ T5257] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.257'. [ 173.262287][ T5257] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.257'. [ 173.652144][ T5264] virtio-fs: tag not found [ 173.664623][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 173.664661][ T26] audit: type=1326 audit(1782950490.997:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5261 comm="syz.3.260" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ffe19de59 code=0x7ffc0000 [ 173.713470][ T5266] netlink: 'syz.0.259': attribute type 2 has an invalid length. [ 174.164304][ T5272] loop2: detected capacity change from 0 to 512 [ 174.249050][ T5272] EXT4-fs (loop2): #blocks per group too big: 67051520 [ 174.276388][ T26] audit: type=1326 audit(1782950490.997:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5261 comm="syz.3.260" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f8ffe19de59 code=0x7ffc0000 [ 174.386817][ T26] audit: type=1326 audit(1782950490.997:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5261 comm="syz.3.260" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ffe19de59 code=0x7ffc0000 [ 174.468507][ T5272] loop2: detected capacity change from 0 to 4096 [ 174.546223][ T26] audit: type=1326 audit(1782950490.997:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5261 comm="syz.3.260" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f8ffe19de59 code=0x7ffc0000 [ 174.586470][ T5272] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 174.606679][ T5274] loop0: detected capacity change from 0 to 256 [ 174.692341][ T5272] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 174.720620][ T26] audit: type=1326 audit(1782950490.997:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5261 comm="syz.3.260" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ffe19de59 code=0x7ffc0000 [ 174.770873][ T5274] FAT-fs (loop0): Directory bread(block 64) failed [ 174.914609][ T5274] FAT-fs (loop0): Directory bread(block 65) failed [ 174.936946][ T5274] FAT-fs (loop0): Directory bread(block 66) failed [ 175.007148][ T5284] overlayfs: missing 'lowerdir' [ 175.069297][ T5274] FAT-fs (loop0): Directory bread(block 67) failed [ 175.076865][ T5274] FAT-fs (loop0): Directory bread(block 68) failed [ 175.083806][ T5274] FAT-fs (loop0): Directory bread(block 69) failed [ 175.091164][ T5274] FAT-fs (loop0): Directory bread(block 70) failed [ 175.098070][ T5274] FAT-fs (loop0): Directory bread(block 71) failed [ 175.105369][ T5274] FAT-fs (loop0): Directory bread(block 72) failed [ 175.112231][ T5274] FAT-fs (loop0): Directory bread(block 73) failed [ 175.326967][ T26] audit: type=1326 audit(1782950490.997:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5261 comm="syz.3.260" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f8ffe19de59 code=0x7ffc0000 [ 175.545294][ T5274] syz.0.262: attempt to access beyond end of device [ 175.545294][ T5274] loop0: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 175.566853][ T26] audit: type=1326 audit(1782950490.997:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5261 comm="syz.3.260" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ffe19de59 code=0x7ffc0000 [ 175.591561][ T5274] syz.0.262: attempt to access beyond end of device [ 175.591561][ T5274] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 175.674466][ T5286] syz.0.262: attempt to access beyond end of device [ 175.674466][ T5286] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 175.730679][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 175.734338][ T26] audit: type=1326 audit(1782950490.997:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5261 comm="syz.3.260" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ffe19de59 code=0x7ffc0000 [ 175.768511][ T26] audit: type=1800 audit(1782950493.037:32): pid=5274 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.262" name="file0" dev="loop0" ino=1048942 res=0 errno=0 [ 177.114454][ T5312] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.271'. [ 177.202535][ T5312] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.271'. [ 177.457076][ T5320] netlink: 'syz.1.273': attribute type 2 has an invalid length. [ 178.253215][ T5324] loop4: detected capacity change from 0 to 512 [ 178.275594][ T5324] EXT4-fs (loop4): #blocks per group too big: 67051520 [ 178.614741][ T5328] overlayfs: missing 'lowerdir' [ 179.603852][ T5333] virtio-fs: tag not found [ 179.654676][ T26] audit: type=1326 audit(1782950496.987:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.2.277" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 180.055511][ T26] audit: type=1326 audit(1782950496.987:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.2.277" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 180.221362][ T26] audit: type=1326 audit(1782950496.987:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.2.277" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 181.046811][ T26] audit: type=1326 audit(1782950496.987:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.2.277" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 181.070645][ C0] vkms_vblank_simulate: vblank timer overrun [ 181.191338][ T26] audit: type=1326 audit(1782950496.987:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.2.277" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 181.215212][ C0] vkms_vblank_simulate: vblank timer overrun [ 181.354579][ T26] audit: type=1326 audit(1782950496.987:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.2.277" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 181.510400][ T5355] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.285'. [ 181.527071][ T26] audit: type=1326 audit(1782950496.987:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.2.277" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 181.550907][ C0] vkms_vblank_simulate: vblank timer overrun [ 181.595242][ T5355] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.285'. [ 181.777692][ T26] audit: type=1326 audit(1782950496.987:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.2.277" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 182.857476][ T5359] netlink: 'syz.0.287': attribute type 2 has an invalid length. [ 183.235316][ T5378] netlink: 68 bytes leftover after parsing attributes in process `syz.3.291'. [ 184.560777][ T5400] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.300'. [ 184.597858][ T5400] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.300'. [ 184.876582][ T5411] netlink: 68 bytes leftover after parsing attributes in process `syz.4.304'. [ 185.078918][ T5417] netlink: 'syz.3.303': attribute type 2 has an invalid length. [ 187.699593][ T5439] loop5: detected capacity change from 0 to 7 [ 187.726552][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 187.735788][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 187.778885][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 187.788147][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 187.838170][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 187.847407][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 187.856854][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 187.866066][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 187.922210][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 187.931445][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 187.978772][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 187.987998][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 188.003302][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 188.012549][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 188.020461][ T4545] ldm_validate_partition_table(): Disk read failed. [ 188.053404][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 188.062723][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 188.087113][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 188.096378][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 188.105673][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 188.114911][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 188.130282][ T4545] Dev loop5: unable to read RDB block 0 [ 188.150116][ T4545] loop5: unable to read partition table [ 188.200245][ T4545] loop5: partition table beyond EOD, truncated [ 188.259830][ T5439] ldm_validate_partition_table(): Disk read failed. [ 188.296032][ T5439] Dev loop5: unable to read RDB block 0 [ 188.362030][ T5439] loop5: unable to read partition table [ 188.382303][ T5439] loop5: partition table beyond EOD, truncated [ 188.426029][ T5439] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 189.241259][ T5447] netlink: 68 bytes leftover after parsing attributes in process `syz.2.315'. [ 189.383625][ T48] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 189.393629][ T48] CPU: 0 PID: 48 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 189.401028][ T48] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 189.411092][ T48] Workqueue: hci4 hci_rx_work [ 189.415788][ T48] Call Trace: [ 189.419065][ T48] [ 189.421996][ T48] dump_stack_lvl+0x188/0x24e [ 189.426679][ T48] ? show_regs_print_info+0x12/0x12 [ 189.431877][ T48] ? load_image+0x410/0x410 [ 189.436391][ T48] sysfs_create_dir_ns+0x26a/0x290 [ 189.441513][ T48] ? __lock_acquire+0x7bd0/0x7bd0 [ 189.446543][ T48] ? sysfs_warn_dup+0xa0/0xa0 [ 189.451233][ T48] ? do_raw_spin_unlock+0x11d/0x230 [ 189.456430][ T48] kobject_add_internal+0x617/0xca0 [ 189.461645][ T48] kobject_add+0x160/0x230 [ 189.466083][ T48] ? kobject_init+0x1c0/0x1c0 [ 189.470772][ T48] ? __raw_spin_lock_init+0x41/0x100 [ 189.476054][ T48] ? klist_children_get+0x50/0x50 [ 189.481081][ T48] ? get_device_parent+0x121/0x3e0 [ 189.486192][ T48] device_add+0x470/0x1050 [ 189.490611][ T48] hci_conn_add_sysfs+0xd1/0x1e0 [ 189.495593][ T48] le_conn_complete_evt+0xf69/0x1560 [ 189.500899][ T48] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 189.507153][ T48] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 189.512789][ T48] ? mutex_unlock+0x10/0x10 [ 189.517321][ T48] ? skb_pull_data+0xec/0x1f0 [ 189.522003][ T48] hci_le_conn_complete_evt+0x183/0x440 [ 189.527565][ T48] ? hci_remote_host_features_evt+0x230/0x230 [ 189.533649][ T48] hci_event_packet+0x7b3/0x1290 [ 189.538680][ T48] ? __lock_acquire+0x7bd0/0x7bd0 [ 189.543720][ T48] ? bis_list+0x280/0x280 [ 189.548047][ T48] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 189.553949][ T48] ? kcov_remote_start+0x4b0/0x7e0 [ 189.559065][ T48] ? nf_ct_resolve_clash+0x572/0x68f [ 189.564356][ T48] ? hci_send_to_monitor+0x9c/0x4a0 [ 189.569589][ T48] hci_rx_work+0x3eb/0xd40 [ 189.574013][ T48] ? _raw_spin_unlock+0x40/0x40 [ 189.578873][ T48] ? process_one_work+0x7b4/0x1160 [ 189.583988][ T48] process_one_work+0x8ab/0x1160 [ 189.588938][ T48] ? worker_detach_from_pool+0x240/0x240 [ 189.594584][ T48] ? _raw_spin_lock_irq+0xb7/0xf0 [ 189.599614][ T48] ? _raw_spin_lock_irqsave+0x100/0x100 [ 189.605166][ T48] ? wq_worker_running+0x97/0x190 [ 189.610194][ T48] worker_thread+0xaf5/0x12a0 [ 189.614910][ T48] kthread+0x29d/0x330 [ 189.618977][ T48] ? worker_clr_flags+0x1a0/0x1a0 [ 189.624016][ T48] ? kthread_blkcg+0xd0/0xd0 [ 189.628609][ T48] ret_from_fork+0x1f/0x30 [ 189.633128][ T48] [ 189.637862][ T48] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 189.651159][ T48] Bluetooth: hci4: failed to register connection device [ 191.047080][ T5462] netlink: 'syz.4.320': attribute type 2 has an invalid length. [ 191.134272][ T5479] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 191.141985][ T5479] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 192.611160][ T5490] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 192.623997][ T5490] x_tables: ip6_tables: TCPOPTSTRIP target: only valid for protocol 6 [ 193.658512][ T5494] loop5: detected capacity change from 0 to 7 [ 193.677397][ C1] blk_print_req_error: 25 callbacks suppressed [ 193.677411][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 193.692774][ C1] buffer_io_error: 25 callbacks suppressed [ 193.692782][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 194.358560][ T1278] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.359748][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 194.365080][ T1278] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.374054][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 194.555215][ T4290] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 194.567788][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 194.577009][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 194.597146][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 194.606313][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 194.616926][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 194.626105][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 194.689791][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 194.699038][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 194.712805][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 194.722010][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 194.730061][ T4545] ldm_validate_partition_table(): Disk read failed. [ 194.766601][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 194.775799][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 194.867231][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 194.876426][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 194.886478][ T5514] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 194.894024][ T5514] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 195.577585][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 195.586953][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 195.677530][ T4545] Dev loop5: unable to read RDB block 0 [ 195.695624][ T4545] loop5: unable to read partition table [ 195.716977][ T4545] loop5: partition table beyond EOD, truncated [ 196.010718][ T5517] netlink: 'syz.1.337': attribute type 2 has an invalid length. [ 196.337148][ T4290] Bluetooth: hci0: command 0x0406 tx timeout [ 196.343210][ T4290] Bluetooth: hci2: command 0x0406 tx timeout [ 196.349318][ T4284] Bluetooth: hci4: command 0x0406 tx timeout [ 196.416811][ T4290] Bluetooth: hci1: command 0x0406 tx timeout [ 196.422884][ T4290] Bluetooth: hci3: command 0x0406 tx timeout [ 196.725201][ T5538] netlink: 68 bytes leftover after parsing attributes in process `syz.4.331'. [ 197.765045][ T4290] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 198.075791][ T5554] loop5: detected capacity change from 0 to 7 [ 198.261630][ T5554] ldm_validate_partition_table(): Disk read failed. [ 198.288259][ T5554] Dev loop5: unable to read RDB block 0 [ 198.321602][ T5554] loop5: unable to read partition table [ 198.329961][ T5556] netlink: 'syz.3.351': attribute type 2 has an invalid length. [ 198.402565][ T5554] loop5: partition table beyond EOD, truncated [ 198.432849][ T5554] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 198.723891][ T5565] binder: 5563:5565 ioctl c0306201 0 returned -14 [ 199.004094][ T5571] netlink: 68 bytes leftover after parsing attributes in process `syz.3.356'. [ 200.050971][ T4290] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 200.060781][ T4290] CPU: 1 PID: 4290 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 200.068337][ T4290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 200.078406][ T4290] Workqueue: hci3 hci_rx_work [ 200.083160][ T4290] Call Trace: [ 200.086450][ T4290] [ 200.089380][ T4290] dump_stack_lvl+0x188/0x24e [ 200.094068][ T4290] ? show_regs_print_info+0x12/0x12 [ 200.099310][ T4290] ? load_image+0x410/0x410 [ 200.103828][ T4290] sysfs_create_dir_ns+0x26a/0x290 [ 200.108946][ T4290] ? __lock_acquire+0x7bd0/0x7bd0 [ 200.113980][ T4290] ? sysfs_warn_dup+0xa0/0xa0 [ 200.118678][ T4290] ? do_raw_spin_unlock+0x11d/0x230 [ 200.123883][ T4290] kobject_add_internal+0x617/0xca0 [ 200.129096][ T4290] kobject_add+0x160/0x230 [ 200.133520][ T4290] ? kobject_init+0x1c0/0x1c0 [ 200.138243][ T4290] ? __raw_spin_lock_init+0x41/0x100 [ 200.143526][ T4290] ? klist_children_get+0x50/0x50 [ 200.148555][ T4290] ? get_device_parent+0x121/0x3e0 [ 200.153672][ T4290] device_add+0x470/0x1050 [ 200.158100][ T4290] hci_conn_add_sysfs+0xd1/0x1e0 [ 200.163043][ T4290] le_conn_complete_evt+0xf69/0x1560 [ 200.168406][ T4290] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 200.174683][ T4290] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 200.180327][ T4290] ? mutex_unlock+0x10/0x10 [ 200.184842][ T4290] ? skb_pull_data+0xec/0x1f0 [ 200.189526][ T4290] hci_le_conn_complete_evt+0x183/0x440 [ 200.195080][ T4290] ? hci_remote_host_features_evt+0x230/0x230 [ 200.201152][ T4290] hci_event_packet+0x7b3/0x1290 [ 200.206093][ T4290] ? __lock_acquire+0x7bd0/0x7bd0 [ 200.211124][ T4290] ? bis_list+0x280/0x280 [ 200.215452][ T4290] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 200.221363][ T4290] ? kcov_remote_start+0x4b0/0x7e0 [ 200.226538][ T4290] ? nf_ct_resolve_clash+0x572/0x68f [ 200.231825][ T4290] ? hci_send_to_monitor+0x9c/0x4a0 [ 200.237029][ T4290] hci_rx_work+0x3eb/0xd40 [ 200.241450][ T4290] ? _raw_spin_unlock+0x40/0x40 [ 200.246317][ T4290] ? process_one_work+0x7b4/0x1160 [ 200.251433][ T4290] process_one_work+0x8ab/0x1160 [ 200.256388][ T4290] ? worker_detach_from_pool+0x240/0x240 [ 200.262126][ T4290] ? _raw_spin_lock_irq+0xb7/0xf0 [ 200.267168][ T4290] ? _raw_spin_lock_irqsave+0x100/0x100 [ 200.272724][ T4290] ? wq_worker_running+0x97/0x190 [ 200.277750][ T4290] worker_thread+0xaf5/0x12a0 [ 200.282442][ T4290] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 200.288364][ T4290] kthread+0x29d/0x330 [ 200.292473][ T4290] ? worker_clr_flags+0x1a0/0x1a0 [ 200.297525][ T4290] ? kthread_blkcg+0xd0/0xd0 [ 200.302128][ T4290] ret_from_fork+0x1f/0x30 [ 200.306565][ T4290] [ 200.314724][ T4290] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 200.328802][ T4290] Bluetooth: hci3: failed to register connection device [ 200.495770][ T5589] loop5: detected capacity change from 0 to 7 [ 200.502855][ C1] blk_print_req_error: 36 callbacks suppressed [ 200.502869][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.518316][ C1] buffer_io_error: 35 callbacks suppressed [ 200.518329][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.560447][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.569673][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.631460][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.640736][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.649164][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.658403][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.697251][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.706519][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.766494][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.775734][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.785209][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.794401][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.802628][ T5589] ldm_validate_partition_table(): Disk read failed. [ 200.823522][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.832774][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.871429][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.880663][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.889716][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 200.898936][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 200.927394][ T5589] Dev loop5: unable to read RDB block 0 [ 200.947399][ T5589] loop5: unable to read partition table [ 200.973746][ T5589] loop5: partition table beyond EOD, truncated [ 201.041585][ T5600] netlink: 'syz.1.365': attribute type 2 has an invalid length. [ 201.076040][ T5589] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 201.225524][ T5603] binder: 5602:5603 ioctl c0306201 0 returned -14 [ 202.604141][ T4290] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 202.863675][ T4284] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 203.261939][ T5623] loop1: detected capacity change from 0 to 256 [ 203.416928][ T5623] FAT-fs (loop1): Directory bread(block 64) failed [ 203.423527][ T5623] FAT-fs (loop1): Directory bread(block 65) failed [ 203.927007][ T5627] virtio-fs: tag not found [ 204.157022][ T5623] FAT-fs (loop1): Directory bread(block 66) failed [ 204.163629][ T5623] FAT-fs (loop1): Directory bread(block 67) failed [ 204.177432][ T26] audit: type=1326 audit(1782950521.437:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 204.239715][ T5623] FAT-fs (loop1): Directory bread(block 68) failed [ 204.265646][ T5623] FAT-fs (loop1): Directory bread(block 69) failed [ 204.277461][ T5623] FAT-fs (loop1): Directory bread(block 70) failed [ 204.293128][ T5631] loop5: detected capacity change from 0 to 7 [ 204.299557][ T5623] FAT-fs (loop1): Directory bread(block 71) failed [ 204.316978][ T5623] FAT-fs (loop1): Directory bread(block 72) failed [ 204.323736][ T26] audit: type=1326 audit(1782950521.437:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 204.350691][ T5623] FAT-fs (loop1): Directory bread(block 73) failed [ 204.358569][ T4360] ldm_validate_partition_table(): Disk read failed. [ 204.368155][ T4360] Dev loop5: unable to read RDB block 0 [ 204.384614][ T4360] loop5: unable to read partition table [ 204.404612][ T4360] loop5: partition table beyond EOD, truncated [ 204.515398][ T26] audit: type=1326 audit(1782950521.437:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 204.521627][ T5631] ldm_validate_partition_table(): Disk read failed. [ 204.547675][ T26] audit: type=1326 audit(1782950521.437:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 204.584991][ T26] audit: type=1326 audit(1782950521.437:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 204.767756][ T5634] syz.1.375: attempt to access beyond end of device [ 204.767756][ T5634] loop1: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 204.781515][ T5634] syz.1.375: attempt to access beyond end of device [ 204.781515][ T5634] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 204.976976][ T5634] syz.1.375: attempt to access beyond end of device [ 204.976976][ T5634] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 205.246896][ T5634] syz.1.375: attempt to access beyond end of device [ 205.246896][ T5634] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 205.864535][ T26] audit: type=1326 audit(1782950521.437:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 205.949436][ T26] audit: type=1326 audit(1782950521.437:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 205.949679][ C0] blk_print_req_error: 32 callbacks suppressed [ 205.949691][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 205.973404][ T26] audit: type=1326 audit(1782950521.437:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 205.979469][ C0] buffer_io_error: 33 callbacks suppressed [ 205.979478][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 205.988660][ T26] audit: type=1326 audit(1782950521.437:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 206.075524][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 206.084788][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 206.126896][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 206.136126][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 206.144432][ T5631] Dev loop5: unable to read RDB block 0 [ 206.158948][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 206.168357][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 206.212549][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 206.221815][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 206.256799][ T26] audit: type=1326 audit(1782950521.437:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5626 comm="syz.4.377" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 207.637635][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 207.646955][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 207.667560][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 207.676785][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 207.687070][ T5631] loop5: unable to read partition table [ 207.692918][ T5631] loop5: partition table beyond EOD, truncated [ 207.709379][ T5631] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 207.722116][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 207.731318][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 207.757873][ T5642] netlink: 'syz.1.381': attribute type 2 has an invalid length. [ 207.824660][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 207.833925][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 207.875810][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 207.885102][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 207.977234][ T4284] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 208.056530][ T4290] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 208.897033][ T5661] virtio-fs: tag not found [ 209.162799][ T5665] loop4: detected capacity change from 0 to 256 [ 209.265027][ T5665] FAT-fs (loop4): Directory bread(block 64) failed [ 210.745367][ T5665] FAT-fs (loop4): Directory bread(block 65) failed [ 210.773070][ T5665] FAT-fs (loop4): Directory bread(block 66) failed [ 210.784217][ T5670] netlink: 'syz.0.394': attribute type 2 has an invalid length. [ 210.846695][ T5665] FAT-fs (loop4): Directory bread(block 67) failed [ 210.864947][ T5665] FAT-fs (loop4): Directory bread(block 68) failed [ 210.902102][ T5665] FAT-fs (loop4): Directory bread(block 69) failed [ 210.924537][ T5665] FAT-fs (loop4): Directory bread(block 70) failed [ 210.951739][ T5665] FAT-fs (loop4): Directory bread(block 71) failed [ 211.026983][ T5665] FAT-fs (loop4): Directory bread(block 72) failed [ 211.054036][ T5665] FAT-fs (loop4): Directory bread(block 73) failed [ 211.463906][ T5665] syz.4.391: attempt to access beyond end of device [ 211.463906][ T5665] loop4: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 211.477600][ T5665] syz.4.391: attempt to access beyond end of device [ 211.477600][ T5665] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 211.492350][ T5665] syz.4.391: attempt to access beyond end of device [ 211.492350][ T5665] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 211.497081][ T26] kauditd_printk_skb: 13 callbacks suppressed [ 211.497096][ T26] audit: type=1800 audit(1782950528.827:64): pid=5665 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.391" name="file0" dev="loop4" ino=1048986 res=0 errno=0 [ 211.506135][ T5665] syz.4.391: attempt to access beyond end of device [ 211.506135][ T5665] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 211.544803][ T5665] buffer_io_error: 3 callbacks suppressed [ 211.544812][ T5665] Buffer I/O error on dev loop4, logical block 290, async page read [ 211.919095][ T4290] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 212.025488][ T4290] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 212.747093][ T5694] virtio-fs: tag not found [ 213.009965][ T26] audit: type=1326 audit(1782950530.287:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5692 comm="syz.4.402" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 213.158468][ T26] audit: type=1326 audit(1782950530.287:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5692 comm="syz.4.402" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 213.282254][ T26] audit: type=1326 audit(1782950530.287:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5692 comm="syz.4.402" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 213.391578][ T5702] loop2: detected capacity change from 0 to 512 [ 213.408230][ T5700] netlink: 'syz.0.405': attribute type 2 has an invalid length. [ 213.467585][ T5702] EXT4-fs (loop2): #blocks per group too big: 67051520 [ 213.476320][ T26] audit: type=1326 audit(1782950530.287:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5692 comm="syz.4.402" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 213.556952][ T26] audit: type=1326 audit(1782950530.287:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5692 comm="syz.4.402" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 213.651125][ T26] audit: type=1326 audit(1782950530.287:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5692 comm="syz.4.402" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 213.762851][ T26] audit: type=1326 audit(1782950530.287:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5692 comm="syz.4.402" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 213.773165][ T5702] loop2: detected capacity change from 0 to 4096 [ 213.845675][ T5707] loop0: detected capacity change from 0 to 256 [ 213.857655][ T26] audit: type=1326 audit(1782950530.287:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5692 comm="syz.4.402" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 213.933237][ T5702] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 213.954577][ T5707] FAT-fs (loop0): Directory bread(block 64) failed [ 213.986830][ T26] audit: type=1326 audit(1782950530.287:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5692 comm="syz.4.402" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 213.992655][ T5707] FAT-fs (loop0): Directory bread(block 65) failed [ 214.010846][ C1] vkms_vblank_simulate: vblank timer overrun [ 214.195669][ T5707] FAT-fs (loop0): Directory bread(block 66) failed [ 214.231565][ T5707] FAT-fs (loop0): Directory bread(block 67) failed [ 214.320999][ T5707] FAT-fs (loop0): Directory bread(block 68) failed [ 214.505071][ T5707] FAT-fs (loop0): Directory bread(block 69) failed [ 214.617027][ T5707] FAT-fs (loop0): Directory bread(block 70) failed [ 214.695427][ T5707] FAT-fs (loop0): Directory bread(block 71) failed [ 214.775410][ T5702] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 214.810572][ T5707] FAT-fs (loop0): Directory bread(block 72) failed [ 214.837252][ T5707] FAT-fs (loop0): Directory bread(block 73) failed [ 215.213325][ T5721] overlayfs: missing 'lowerdir' [ 215.612826][ T4284] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 215.661957][ T4290] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 215.687504][ T5726] syz.0.407: attempt to access beyond end of device [ 215.687504][ T5726] loop0: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 215.701340][ T5726] syz.0.407: attempt to access beyond end of device [ 215.701340][ T5726] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 215.896987][ T5726] syz.0.407: attempt to access beyond end of device [ 215.896987][ T5726] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 216.026885][ T5726] syz.0.407: attempt to access beyond end of device [ 216.026885][ T5726] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 216.051939][ T5726] Buffer I/O error on dev loop0, logical block 290, async page read [ 216.337140][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 218.289788][ T5756] No source specified [ 219.023884][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 219.023898][ T26] audit: type=1326 audit(1782950535.657:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 219.079410][ T26] audit: type=1326 audit(1782950535.657:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 219.112176][ T26] audit: type=1326 audit(1782950535.667:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 219.184336][ T26] audit: type=1326 audit(1782950535.667:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 219.294027][ T5762] loop0: detected capacity change from 0 to 512 [ 219.320303][ T26] audit: type=1326 audit(1782950535.667:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 219.352007][ T26] audit: type=1326 audit(1782950535.677:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 219.471238][ T26] audit: type=1326 audit(1782950535.677:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 219.597076][ T5762] EXT4-fs (loop0): #blocks per group too big: 67051520 [ 219.620263][ T26] audit: type=1326 audit(1782950535.677:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 220.040537][ T26] audit: type=1326 audit(1782950535.687:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 220.066464][ T26] audit: type=1326 audit(1782950535.687:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5745 comm="syz.2.414" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 220.243505][ T5762] loop0: detected capacity change from 0 to 4096 [ 220.291259][ T5762] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 220.354857][ T5762] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 220.697981][ T5762] overlayfs: missing 'lowerdir' [ 221.026176][ T5781] loop1: detected capacity change from 0 to 256 [ 221.085165][ T4272] EXT4-fs (loop0): unmounting filesystem. [ 221.199382][ T5781] FAT-fs (loop1): Directory bread(block 64) failed [ 221.224425][ T5781] FAT-fs (loop1): Directory bread(block 65) failed [ 221.262933][ T5781] FAT-fs (loop1): Directory bread(block 66) failed [ 221.289042][ T5781] FAT-fs (loop1): Directory bread(block 67) failed [ 221.295821][ T5781] FAT-fs (loop1): Directory bread(block 68) failed [ 221.342452][ T5781] FAT-fs (loop1): Directory bread(block 69) failed [ 221.402298][ T5781] FAT-fs (loop1): Directory bread(block 70) failed [ 221.430888][ T5781] FAT-fs (loop1): Directory bread(block 71) failed [ 221.441499][ T5781] FAT-fs (loop1): Directory bread(block 72) failed [ 221.466110][ T5781] FAT-fs (loop1): Directory bread(block 73) failed [ 221.529901][ T4290] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 222.189227][ T5799] syz.1.428: attempt to access beyond end of device [ 222.189227][ T5799] loop1: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 222.206622][ T5799] syz.1.428: attempt to access beyond end of device [ 222.206622][ T5799] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 222.229596][ T5799] syz.1.428: attempt to access beyond end of device [ 222.229596][ T5799] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 222.246998][ T5799] syz.1.428: attempt to access beyond end of device [ 222.246998][ T5799] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 222.260923][ T5799] Buffer I/O error on dev loop1, logical block 290, async page read [ 223.339671][ T5794] No source specified [ 223.800668][ T5818] loop3: detected capacity change from 0 to 512 [ 223.895560][ T5818] EXT4-fs (loop3): #blocks per group too big: 67051520 [ 223.927652][ T4290] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 224.250377][ T5818] loop3: detected capacity change from 0 to 4096 [ 224.287936][ T5818] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 224.364649][ T5818] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 224.751945][ T5843] overlayfs: missing 'lowerdir' [ 225.779423][ T5852] No source specified [ 226.506401][ T26] kauditd_printk_skb: 13 callbacks suppressed [ 226.506415][ T26] audit: type=1326 audit(1782950543.147:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 226.594652][ T4280] EXT4-fs (loop3): unmounting filesystem. [ 226.707081][ T26] audit: type=1326 audit(1782950543.147:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 226.737900][ C0] vkms_vblank_simulate: vblank timer overrun [ 226.859851][ T26] audit: type=1326 audit(1782950543.157:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 227.342194][ T26] audit: type=1326 audit(1782950543.157:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 227.842299][ T26] audit: type=1326 audit(1782950543.157:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 227.868373][ C0] vkms_vblank_simulate: vblank timer overrun [ 228.282834][ T26] audit: type=1326 audit(1782950543.167:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 228.808093][ T26] audit: type=1326 audit(1782950543.167:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 228.985823][ T26] audit: type=1326 audit(1782950543.167:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 229.140375][ T26] audit: type=1326 audit(1782950543.177:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 229.256177][ T26] audit: type=1326 audit(1782950543.177:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5848 comm="syz.4.449" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 231.882897][ T26] kauditd_printk_skb: 1 callbacks suppressed [ 231.882914][ T26] audit: type=1326 audit(1782950548.507:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 231.937669][ T26] audit: type=1326 audit(1782950548.507:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 231.993309][ T4290] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 232.050728][ T26] audit: type=1326 audit(1782950548.527:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 232.088032][ T22] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 232.186348][ T26] audit: type=1326 audit(1782950548.527:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 232.281073][ T26] audit: type=1326 audit(1782950548.527:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 232.350512][ T22] usb 4-1: unable to get BOS descriptor or descriptor too short [ 232.423949][ T22] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 232.438630][ T22] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 232.507164][ T22] usb 4-1: string descriptor 0 read error: -22 [ 232.514403][ T22] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 232.527466][ T22] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.598307][ T4359] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 232.794714][ T26] audit: type=1326 audit(1782950548.547:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 232.851532][ T26] audit: type=1326 audit(1782950548.547:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 232.974086][ T26] audit: type=1326 audit(1782950548.547:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 233.008455][ T26] audit: type=1326 audit(1782950548.557:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 233.037171][ T4359] usb 1-1: Using ep0 maxpacket: 8 [ 233.056024][ T4359] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 48, changing to 7 [ 234.046471][ T26] audit: type=1326 audit(1782950548.557:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5890 comm="syz.2.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 234.082027][ T4359] usb 1-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 234.096260][ T126] usb 4-1: USB disconnect, device number 5 [ 234.121540][ T4359] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.316882][ T4359] usb 1-1: Product: syz [ 234.321116][ T4359] usb 1-1: Manufacturer: syz [ 234.325759][ T4359] usb 1-1: SerialNumber: syz [ 236.069455][ T4359] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 236.112403][ T4359] usb 1-1: found format II with max.bitrate = 1025, frame size=32767 [ 238.488960][ T26] kauditd_printk_skb: 1 callbacks suppressed [ 238.488971][ T26] audit: type=1326 audit(1782950555.147:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 238.585206][ T4359] usb 1-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 238.628884][ T4290] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 238.697078][ T4359] usb 1-1: USB disconnect, device number 3 [ 238.746835][ T26] audit: type=1326 audit(1782950555.147:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 238.849501][ T26] audit: type=1326 audit(1782950555.157:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 238.934858][ T26] audit: type=1326 audit(1782950555.167:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 239.039732][ T26] audit: type=1326 audit(1782950555.167:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 239.069364][ T4481] udevd[4481]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 239.214770][ T26] audit: type=1326 audit(1782950555.197:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 240.616824][ T26] audit: type=1326 audit(1782950555.207:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 240.717320][ T26] audit: type=1326 audit(1782950555.207:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 241.021663][ T26] audit: type=1326 audit(1782950555.217:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 242.177201][ T26] audit: type=1326 audit(1782950555.217:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5925 comm="syz.4.474" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 243.636961][ T4290] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 248.492795][ T26] kauditd_printk_skb: 1 callbacks suppressed [ 248.492814][ T26] audit: type=1326 audit(1782950565.217:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 248.618273][ T4284] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 248.932581][ T26] audit: type=1326 audit(1782950565.217:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 249.211339][ T26] audit: type=1326 audit(1782950565.227:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 249.357499][ T26] audit: type=1326 audit(1782950565.237:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 249.848968][ T26] audit: type=1326 audit(1782950565.237:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 250.230137][ T26] audit: type=1326 audit(1782950565.257:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 250.267242][ T26] audit: type=1326 audit(1782950565.257:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 250.335918][ T26] audit: type=1326 audit(1782950565.257:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 250.365447][ T26] audit: type=1326 audit(1782950565.267:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 250.420503][ T26] audit: type=1326 audit(1782950565.267:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b8f39de59 code=0x7ffc0000 [ 250.472255][ T6064] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 250.497403][ T6064] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 252.674046][ T4284] Bluetooth: hci0: Unknown advertising packet type: 0x20 [ 252.675744][ T4284] Bluetooth: hci0: Malformed LE Event: 0x0d [ 254.561862][ T4284] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 255.536703][ T6119] loop0: detected capacity change from 0 to 256 [ 256.722276][ T1278] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.723310][ T26] kauditd_printk_skb: 12 callbacks suppressed [ 256.723325][ T26] audit: type=1326 audit(1782950573.457:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 256.728644][ T1278] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.780112][ T6122] Driver unsupported XDP return value 0 on prog (id 19) dev N/A, expect packet loss! [ 256.828392][ T6119] FAT-fs (loop0): Directory bread(block 64) failed [ 256.848693][ T6119] FAT-fs (loop0): Directory bread(block 65) failed [ 256.881635][ T6119] FAT-fs (loop0): Directory bread(block 66) failed [ 256.916895][ T6119] FAT-fs (loop0): Directory bread(block 67) failed [ 256.921159][ T26] audit: type=1326 audit(1782950573.457:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 256.932071][ T6119] FAT-fs (loop0): Directory bread(block 68) failed [ 257.013245][ T6119] FAT-fs (loop0): Directory bread(block 69) failed [ 257.053062][ T26] audit: type=1326 audit(1782950573.467:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 257.076944][ T6119] FAT-fs (loop0): Directory bread(block 70) failed [ 257.107104][ T26] audit: type=1326 audit(1782950573.477:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 257.110199][ T6119] FAT-fs (loop0): Directory bread(block 71) failed [ 257.162056][ T26] audit: type=1326 audit(1782950573.477:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 257.227827][ T6119] FAT-fs (loop0): Directory bread(block 72) failed [ 257.249017][ T6119] FAT-fs (loop0): Directory bread(block 73) failed [ 257.249105][ T26] audit: type=1326 audit(1782950573.487:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 257.308899][ T26] audit: type=1326 audit(1782950573.487:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 257.492173][ T26] audit: type=1326 audit(1782950573.487:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 257.583295][ T26] audit: type=1326 audit(1782950573.497:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 257.612232][ T26] audit: type=1326 audit(1782950573.497:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6121 comm="syz.4.524" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6dc7f9de59 code=0x7ffc0000 [ 257.807651][ T6143] syz.0.523: attempt to access beyond end of device [ 257.807651][ T6143] loop0: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 257.821372][ T6143] syz.0.523: attempt to access beyond end of device [ 257.821372][ T6143] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 257.956137][ T6143] syz.0.523: attempt to access beyond end of device [ 257.956137][ T6143] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 257.969910][ T6143] syz.0.523: attempt to access beyond end of device [ 257.969910][ T6143] loop0: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 257.983150][ T6143] Buffer I/O error on dev loop0, logical block 290, async page read [ 259.053275][ T4290] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 260.596555][ T41] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 260.649170][ T41] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 260.831642][ T4290] Bluetooth: hci4: Unknown advertising packet type: 0x20 [ 260.832672][ T4290] Bluetooth: hci4: Malformed LE Event: 0x0d [ 261.698050][ T6187] loop1: detected capacity change from 0 to 256 [ 262.366983][ T6187] FAT-fs (loop1): Directory bread(block 64) failed [ 262.445910][ T6187] FAT-fs (loop1): Directory bread(block 65) failed [ 262.486910][ T6187] FAT-fs (loop1): Directory bread(block 66) failed [ 262.493511][ T6187] FAT-fs (loop1): Directory bread(block 67) failed [ 262.522276][ T6187] FAT-fs (loop1): Directory bread(block 68) failed [ 262.544329][ T6187] FAT-fs (loop1): Directory bread(block 69) failed [ 262.572404][ T6187] FAT-fs (loop1): Directory bread(block 70) failed [ 262.604874][ T6187] FAT-fs (loop1): Directory bread(block 71) failed [ 262.634256][ T6187] FAT-fs (loop1): Directory bread(block 72) failed [ 262.670858][ T6187] FAT-fs (loop1): Directory bread(block 73) failed [ 262.739181][ T6196] sctp: [Deprecated]: syz.3.548 (pid 6196) Use of struct sctp_assoc_value in delayed_ack socket option. [ 262.739181][ T6196] Use struct sctp_sack_info instead [ 262.757405][ T4290] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 263.022675][ T6198] syz.1.545: attempt to access beyond end of device [ 263.022675][ T6198] loop1: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 263.037567][ T6198] syz.1.545: attempt to access beyond end of device [ 263.037567][ T6198] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 263.051570][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 263.051586][ T26] audit: type=1800 audit(1782950580.387:167): pid=6198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.545" name="file0" dev="loop1" ino=1049074 res=0 errno=0 [ 263.052420][ T6198] syz.1.545: attempt to access beyond end of device [ 263.052420][ T6198] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 263.094879][ T6198] syz.1.545: attempt to access beyond end of device [ 263.094879][ T6198] loop1: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 263.108516][ T6198] Buffer I/O error on dev loop1, logical block 290, async page read [ 267.885603][ T6253] loop2: detected capacity change from 0 to 256 [ 267.976569][ T6253] FAT-fs (loop2): Directory bread(block 64) failed [ 268.000761][ T6253] FAT-fs (loop2): Directory bread(block 65) failed [ 268.025445][ T6253] FAT-fs (loop2): Directory bread(block 66) failed [ 268.034030][ T6253] FAT-fs (loop2): Directory bread(block 67) failed [ 268.046257][ T6253] FAT-fs (loop2): Directory bread(block 68) failed [ 268.055537][ T6253] FAT-fs (loop2): Directory bread(block 69) failed [ 268.076113][ T6253] FAT-fs (loop2): Directory bread(block 70) failed [ 268.084179][ T6253] FAT-fs (loop2): Directory bread(block 71) failed [ 268.095932][ T6253] FAT-fs (loop2): Directory bread(block 72) failed [ 268.112599][ T6253] FAT-fs (loop2): Directory bread(block 73) failed [ 269.907571][ T6269] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 269.915088][ T6269] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 270.667833][ T6285] syz.2.564: attempt to access beyond end of device [ 270.667833][ T6285] loop2: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 270.681768][ T6285] syz.2.564: attempt to access beyond end of device [ 270.681768][ T6285] loop2: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 270.695197][ T26] audit: type=1800 audit(1782950588.027:168): pid=6285 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.564" name="file0" dev="loop2" ino=1049096 res=0 errno=0 [ 270.696136][ T6285] syz.2.564: attempt to access beyond end of device [ 270.696136][ T6285] loop2: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 270.735231][ T6285] syz.2.564: attempt to access beyond end of device [ 270.735231][ T6285] loop2: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 270.748616][ T6285] Buffer I/O error on dev loop2, logical block 290, async page read [ 274.215497][ T6312] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 274.224032][ T6312] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 275.198029][ T6323] loop2: detected capacity change from 0 to 512 [ 275.212433][ T6323] EXT4-fs (loop2): #blocks per group too big: 67051520 [ 275.384970][ T6323] loop2: detected capacity change from 0 to 4096 [ 275.425240][ T6323] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 275.495533][ T6323] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 277.000211][ T6333] overlayfs: missing 'lowerdir' [ 277.256021][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 277.995473][ T6340] x_tables: ip6_tables: TCPOPTSTRIP target: only valid for protocol 6 [ 279.822363][ T6352] loop4: detected capacity change from 0 to 256 [ 279.885017][ T6352] FAT-fs (loop4): Directory bread(block 64) failed [ 279.912610][ T6352] FAT-fs (loop4): Directory bread(block 65) failed [ 279.921761][ T6352] FAT-fs (loop4): Directory bread(block 66) failed [ 280.082174][ T6352] FAT-fs (loop4): Directory bread(block 67) failed [ 280.118522][ T6352] FAT-fs (loop4): Directory bread(block 68) failed [ 280.757367][ T6352] FAT-fs (loop4): Directory bread(block 69) failed [ 280.881782][ T6352] FAT-fs (loop4): Directory bread(block 70) failed [ 280.906119][ T6352] FAT-fs (loop4): Directory bread(block 71) failed [ 280.936911][ T6352] FAT-fs (loop4): Directory bread(block 72) failed [ 280.943502][ T6352] FAT-fs (loop4): Directory bread(block 73) failed [ 281.102878][ T4284] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 281.172708][ T6365] loop0: detected capacity change from 0 to 512 [ 281.303654][ T6365] EXT4-fs (loop0): #blocks per group too big: 67051520 [ 281.706521][ T6363] loop0: detected capacity change from 0 to 4096 [ 281.774228][ T6363] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 281.787869][ T6369] syz.4.595: attempt to access beyond end of device [ 281.787869][ T6369] loop4: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 281.801682][ T6369] syz.4.595: attempt to access beyond end of device [ 281.801682][ T6369] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 281.815325][ T26] audit: type=1800 audit(1782950599.147:169): pid=6369 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.595" name="file0" dev="loop4" ino=1049118 res=0 errno=0 [ 281.909523][ T6363] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 281.976834][ T6369] syz.4.595: attempt to access beyond end of device [ 281.976834][ T6369] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 281.994622][ T6369] syz.4.595: attempt to access beyond end of device [ 281.994622][ T6369] loop4: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 282.007900][ T6369] Buffer I/O error on dev loop4, logical block 290, async page read [ 282.626024][ T6363] overlayfs: missing 'lowerdir' [ 283.294153][ T4272] EXT4-fs (loop0): unmounting filesystem. [ 284.698042][ T4290] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 285.577461][ T4284] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 285.774927][ T6416] loop1: detected capacity change from 0 to 512 [ 285.861137][ T6416] EXT4-fs (loop1): #blocks per group too big: 67051520 [ 288.406429][ T6416] loop1: detected capacity change from 0 to 4096 [ 288.500998][ T6416] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 288.560213][ T6416] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 289.460395][ T6440] overlayfs: missing 'lowerdir' [ 290.300900][ T4273] EXT4-fs (loop1): unmounting filesystem. [ 290.483317][ T4284] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 291.077875][ T4284] Bluetooth: hci4: Unknown advertising packet type: 0x20 [ 291.077958][ T4284] Bluetooth: hci4: Malformed LE Event: 0x0d [ 292.920025][ T6456] netlink: 4 bytes leftover after parsing attributes in process `syz.1.622'. [ 293.220801][ T4284] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 294.019610][ T6476] x_tables: ip6_tables: TCPOPTSTRIP target: only valid for protocol 6 [ 294.629576][ T6489] loop2: detected capacity change from 0 to 512 [ 294.671802][ T6489] EXT4-fs (loop2): #blocks per group too big: 67051520 [ 297.198211][ T4284] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 299.092304][ T6511] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 299.619356][ T6507] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 299.680773][ T6507] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 299.717486][ T6507] ================================================================== [ 299.725648][ T6507] BUG: KASAN: use-after-free in __lock_acquire+0x107/0x7bd0 [ 299.732935][ T6507] Read of size 8 at addr ffff888058f9b540 by task syz.3.638/6507 [ 299.740641][ T6507] [ 299.742980][ T6507] CPU: 0 PID: 6507 Comm: syz.3.638 Not tainted syzkaller #0 [ 299.750261][ T6507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 299.760435][ T6507] Call Trace: [ 299.763727][ T6507] [ 299.766670][ T6507] dump_stack_lvl+0x188/0x24e [ 299.771391][ T6507] ? __lock_acquire+0x7bd0/0x7bd0 [ 299.776458][ T6507] ? show_regs_print_info+0x12/0x12 [ 299.781688][ T6507] ? load_image+0x410/0x410 [ 299.786229][ T6507] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 299.791722][ T6507] ? __virt_addr_valid+0x188/0x540 [ 299.796873][ T6507] ? __virt_addr_valid+0x467/0x540 [ 299.802014][ T6507] ? __lock_acquire+0x107/0x7bd0 [ 299.807068][ T6507] print_report+0xa8/0x210 [ 299.811526][ T6507] kasan_report+0x10b/0x140 [ 299.816071][ T6507] ? __lock_acquire+0x107/0x7bd0 [ 299.821041][ T6507] __lock_acquire+0x107/0x7bd0 [ 299.825841][ T6507] ? print_circular_bug+0x140/0x1a0 [ 299.831087][ T6507] ? verify_lock_unused+0x140/0x140 [ 299.836334][ T6507] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 299.842353][ T6507] lock_acquire+0x1bb/0x4a0 [ 299.846893][ T6507] ? bt_accept_unlink+0x5f/0x290 [ 299.851882][ T6507] ? __local_bh_disable_ip+0x111/0x1a0 [ 299.857373][ T6507] ? read_lock_is_recursive+0x10/0x10 [ 299.862778][ T6507] ? __local_bh_enable_ip+0x136/0x1c0 [ 299.868169][ T6507] ? lockdep_hardirqs_on+0x94/0x140 [ 299.873508][ T6507] ? __local_bh_enable_ip+0x136/0x1c0 [ 299.878880][ T6507] ? bt_accept_unlink+0x5f/0x290 [ 299.883822][ T6507] _raw_spin_lock_bh+0x32/0x50 [ 299.888626][ T6507] ? bt_accept_unlink+0x5f/0x290 [ 299.893620][ T6507] bt_accept_unlink+0x5f/0x290 [ 299.898600][ T6507] l2cap_sock_teardown_cb+0x1af/0x380 [ 299.903999][ T6507] l2cap_chan_del+0xab/0x620 [ 299.908713][ T6507] ? kfree_skb_reason+0x17a/0x370 [ 299.913761][ T6507] l2cap_conn_del+0x3c5/0x6a0 [ 299.918444][ T6507] l2cap_connect_cfm+0x125/0x11e0 [ 299.923495][ T6507] ? hci_conn_failed+0x10c/0x2a0 [ 299.928433][ T6507] ? mutex_lock_nested+0x10/0x10 [ 299.933385][ T6507] ? l2cap_ertm_resend+0xf30/0xf30 [ 299.938498][ T6507] ? l2cap_ertm_resend+0xf30/0xf30 [ 299.943609][ T6507] hci_conn_failed+0x16f/0x2a0 [ 299.948384][ T6507] hci_abort_conn_sync+0xb3c/0xd50 [ 299.953516][ T6507] ? hci_abort_conn_sync+0x8e1/0xd50 [ 299.958827][ T6507] ? hci_resume_advertising_sync+0x540/0x540 [ 299.964918][ T6507] hci_suspend_sync+0x445/0xd20 [ 299.969795][ T6507] ? hci_suspend_dev+0x191/0x320 [ 299.974735][ T6507] ? mutex_lock_nested+0x10/0x10 [ 299.979672][ T6507] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 299.985326][ T6507] ? hci_active_scan_sync+0x6f0/0x6f0 [ 299.990730][ T6507] ? mutex_unlock+0x10/0x10 [ 299.995319][ T6507] ? _find_next_bit+0x11e/0x130 [ 300.000200][ T6507] ? mgmt_pending_find+0x108/0x120 [ 300.005310][ T6507] ? hci_cmd_sync_cancel_sync+0xc4/0x180 [ 300.010962][ T6507] hci_suspend_dev+0x199/0x320 [ 300.015767][ T6507] hci_suspend_notifier+0xc8/0x270 [ 300.020920][ T6507] notifier_call_chain_robust+0xe1/0x2c0 [ 300.026594][ T6507] blocking_notifier_call_chain_robust+0x66/0x90 [ 300.032930][ T6507] pm_notifier_call_chain_robust+0x28/0x60 [ 300.038735][ T6507] snapshot_open+0x19b/0x280 [ 300.043318][ T6507] ? snapshot_compat_ioctl+0x90/0x90 [ 300.048676][ T6507] misc_open+0x31f/0x390 [ 300.052934][ T6507] chrdev_open+0x585/0x5f0 [ 300.057352][ T6507] ? cd_forget+0x160/0x160 [ 300.061794][ T6507] ? fsnotify_perm+0x39b/0x550 [ 300.066551][ T6507] ? cd_forget+0x160/0x160 [ 300.070965][ T6507] do_dentry_open+0x7dd/0x10b0 [ 300.075725][ T6507] path_openat+0x2674/0x2f10 [ 300.080337][ T6507] ? verify_lock_unused+0x140/0x140 [ 300.085617][ T6507] ? do_sys_openat2+0xdd/0x4f0 [ 300.090486][ T6507] ? do_filp_open+0x420/0x420 [ 300.095164][ T6507] do_filp_open+0x1ee/0x420 [ 300.099678][ T6507] ? vfs_tmpfile+0x470/0x470 [ 300.104288][ T6507] ? _raw_spin_unlock+0x24/0x40 [ 300.109323][ T6507] ? alloc_fd+0x590/0x640 [ 300.113674][ T6507] do_sys_openat2+0x14b/0x4f0 [ 300.118345][ T6507] ? do_sys_open+0xe0/0xe0 [ 300.122754][ T6507] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 300.128736][ T6507] ? lock_chain_count+0x20/0x20 [ 300.133678][ T6507] __x64_sys_openat+0x135/0x160 [ 300.138527][ T6507] do_syscall_64+0x4c/0xa0 [ 300.142947][ T6507] ? clear_bhb_loop+0x60/0xb0 [ 300.147649][ T6507] ? clear_bhb_loop+0x60/0xb0 [ 300.152337][ T6507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 300.158243][ T6507] RIP: 0033:0x7f8ffe19de59 [ 300.162658][ T6507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 300.182275][ T6507] RSP: 002b:00007f8fff0c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 300.190690][ T6507] RAX: ffffffffffffffda RBX: 00007f8ffe425fa0 RCX: 00007f8ffe19de59 [ 300.198687][ T6507] RDX: 0000000000000400 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 300.206661][ T6507] RBP: 00007f8ffe233e6f R08: 0000000000000000 R09: 0000000000000000 [ 300.214640][ T6507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 300.222616][ T6507] R13: 00007f8ffe426038 R14: 00007f8ffe425fa0 R15: 00007ffdb46a9a98 [ 300.230592][ T6507] [ 300.233608][ T6507] [ 300.235944][ T6507] Allocated by task 6206: [ 300.240284][ T6507] kasan_set_track+0x4b/0x70 [ 300.244889][ T6507] __kasan_kmalloc+0x8e/0xa0 [ 300.249477][ T6507] __kmalloc_node_track_caller+0xb0/0x240 [ 300.255194][ T6507] __alloc_skb+0x226/0x7d0 [ 300.259599][ T6507] sctp_packet_transmit+0xf2f/0x2960 [ 300.264918][ T6507] sctp_outq_flush+0xeb6/0x3140 [ 300.269766][ T6507] sctp_do_sm+0x4f05/0x5610 [ 300.274256][ T6507] sctp_assoc_bh_rcv+0x3ee/0x630 [ 300.279210][ T6507] sctp_backlog_rcv+0x158/0x360 [ 300.284056][ T6507] __release_sock+0x1e6/0x460 [ 300.288728][ T6507] release_sock+0x5b/0x1b0 [ 300.293145][ T6507] sctp_sendmsg+0x1bed/0x2940 [ 300.297811][ T6507] __sys_sendto+0x497/0x650 [ 300.302337][ T6507] __x64_sys_sendto+0xda/0xf0 [ 300.307011][ T6507] do_syscall_64+0x4c/0xa0 [ 300.311434][ T6507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 300.317323][ T6507] [ 300.319641][ T6507] Last potentially related work creation: [ 300.325338][ T6507] kasan_save_stack+0x3a/0x60 [ 300.330008][ T6507] __kasan_record_aux_stack+0xb2/0xc0 [ 300.335384][ T6507] call_rcu+0x14f/0x950 [ 300.339537][ T6507] netlink_release+0x157e/0x19b0 [ 300.344530][ T6507] sock_close+0xbf/0x210 [ 300.348768][ T6507] __fput+0x20a/0x8b0 [ 300.352748][ T6507] task_work_run+0x1d0/0x260 [ 300.357333][ T6507] exit_to_user_mode_loop+0xe6/0x110 [ 300.362615][ T6507] exit_to_user_mode_prepare+0xee/0x180 [ 300.368156][ T6507] syscall_exit_to_user_mode+0x16/0x40 [ 300.373606][ T6507] do_syscall_64+0x58/0xa0 [ 300.378008][ T6507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 300.383945][ T6507] [ 300.386269][ T6507] Second to last potentially related work creation: [ 300.392851][ T6507] kasan_save_stack+0x3a/0x60 [ 300.397620][ T6507] __kasan_record_aux_stack+0xb2/0xc0 [ 300.402992][ T6507] call_rcu+0x14f/0x950 [ 300.407331][ T6507] netlink_release+0x157e/0x19b0 [ 300.412334][ T6507] sock_close+0xbf/0x210 [ 300.416603][ T6507] __fput+0x20a/0x8b0 [ 300.420572][ T6507] task_work_run+0x1d0/0x260 [ 300.425246][ T6507] exit_to_user_mode_loop+0xe6/0x110 [ 300.430564][ T6507] exit_to_user_mode_prepare+0xee/0x180 [ 300.436134][ T6507] syscall_exit_to_user_mode+0x16/0x40 [ 300.441602][ T6507] do_syscall_64+0x58/0xa0 [ 300.446016][ T6507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 300.452008][ T6507] [ 300.454340][ T6507] The buggy address belongs to the object at ffff888058f9b000 [ 300.454340][ T6507] which belongs to the cache kmalloc-2k of size 2048 [ 300.468476][ T6507] The buggy address is located 1344 bytes inside of [ 300.468476][ T6507] 2048-byte region [ffff888058f9b000, ffff888058f9b800) [ 300.482261][ T6507] [ 300.484571][ T6507] The buggy address belongs to the physical page: [ 300.490997][ T6507] page:ffffea000163e600 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888058f9c000 pfn:0x58f98 [ 300.502695][ T6507] head:ffffea000163e600 order:3 compound_mapcount:0 compound_pincount:0 [ 300.511002][ T6507] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 300.518991][ T6507] raw: 00fff00000010200 ffffea0001d6ee08 ffffea0001e4f808 ffff888017442000 [ 300.527651][ T6507] raw: ffff888058f9c000 0000000000080002 00000001ffffffff 0000000000000000 [ 300.536302][ T6507] page dumped because: kasan: bad access detected [ 300.542722][ T6507] page_owner tracks the page as allocated [ 300.548486][ T6507] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4272, tgid 4272 (syz-executor), ts 73823277630, free_ts 22807528304 [ 300.569235][ T6507] post_alloc_hook+0x173/0x1a0 [ 300.574262][ T6507] get_page_from_freelist+0x206b/0x2180 [ 300.580798][ T6507] __alloc_pages+0x1ec/0x4f0 [ 300.585493][ T6507] alloc_slab_page+0x5d/0x180 [ 300.590277][ T6507] new_slab+0x87/0x2d0 [ 300.594402][ T6507] ___slab_alloc+0xbc5/0x1240 [ 300.599168][ T6507] __kmem_cache_alloc_node+0x126/0x270 [ 300.605052][ T6507] __kmalloc_node_track_caller+0xa0/0x240 [ 300.610774][ T6507] __alloc_skb+0x226/0x7d0 [ 300.615183][ T6507] inet6_ifinfo_notify+0x6c/0x110 [ 300.620195][ T6507] addrconf_notify+0xc4d/0xf60 [ 300.624944][ T6507] raw_notifier_call_chain+0xcb/0x160 [ 300.630299][ T6507] __dev_notify_flags+0x1a7/0x310 [ 300.635334][ T6507] dev_change_flags+0xda/0x1a0 [ 300.640116][ T6507] do_setlink+0xbc7/0x29c0 [ 300.644534][ T6507] rtnl_newlink+0x16e4/0x1f90 [ 300.649215][ T6507] page last free stack trace: [ 300.653878][ T6507] free_unref_page_prepare+0x8e5/0x9e0 [ 300.659401][ T6507] free_unref_page+0x2e/0x3f0 [ 300.664097][ T6507] free_contig_range+0x9d/0x150 [ 300.668961][ T6507] destroy_args+0xef/0xa0e [ 300.673382][ T6507] debug_vm_pgtable+0x33c/0x38e [ 300.678240][ T6507] do_one_initcall+0x257/0x800 [ 300.683014][ T6507] do_initcall_level+0x13d/0x1ed [ 300.687950][ T6507] do_initcalls+0x4b/0x8a [ 300.692407][ T6507] kernel_init_freeable+0x401/0x5ab [ 300.697612][ T6507] kernel_init+0x19/0x1b0 [ 300.701935][ T6507] ret_from_fork+0x1f/0x30 [ 300.706446][ T6507] [ 300.708761][ T6507] Memory state around the buggy address: [ 300.714380][ T6507] ffff888058f9b400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 300.722533][ T6507] ffff888058f9b480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 300.730589][ T6507] >ffff888058f9b500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 300.738914][ T6507] ^ [ 300.745053][ T6507] ffff888058f9b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 300.753113][ T6507] ffff888058f9b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 300.761161][ T6507] ================================================================== [ 300.769263][ T6507] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 300.776444][ T6507] CPU: 0 PID: 6507 Comm: syz.3.638 Not tainted syzkaller #0 [ 300.783724][ T6507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 300.793907][ T6507] Call Trace: [ 300.797178][ T6507] [ 300.800121][ T6507] dump_stack_lvl+0x188/0x24e [ 300.804814][ T6507] ? memcpy+0x3c/0x60 [ 300.808783][ T6507] ? show_regs_print_info+0x12/0x12 [ 300.813980][ T6507] ? load_image+0x410/0x410 [ 300.818499][ T6507] panic+0x2d3/0x710 [ 300.822396][ T6507] ? __lock_acquire+0x7bd0/0x7bd0 [ 300.827456][ T6507] ? bpf_jit_dump+0xd0/0xd0 [ 300.831966][ T6507] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 300.837866][ T6507] ? _raw_spin_unlock+0x40/0x40 [ 300.842712][ T6507] check_panic_on_warn+0x80/0xa0 [ 300.847648][ T6507] ? __lock_acquire+0x107/0x7bd0 [ 300.852590][ T6507] end_report+0x66/0x110 [ 300.856839][ T6507] kasan_report+0x118/0x140 [ 300.861602][ T6507] ? __lock_acquire+0x107/0x7bd0 [ 300.866536][ T6507] __lock_acquire+0x107/0x7bd0 [ 300.871291][ T6507] ? print_circular_bug+0x140/0x1a0 [ 300.876553][ T6507] ? verify_lock_unused+0x140/0x140 [ 300.881801][ T6507] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 300.887897][ T6507] lock_acquire+0x1bb/0x4a0 [ 300.892407][ T6507] ? bt_accept_unlink+0x5f/0x290 [ 300.897343][ T6507] ? __local_bh_disable_ip+0x111/0x1a0 [ 300.902797][ T6507] ? read_lock_is_recursive+0x10/0x10 [ 300.908191][ T6507] ? __local_bh_enable_ip+0x136/0x1c0 [ 300.913550][ T6507] ? lockdep_hardirqs_on+0x94/0x140 [ 300.918743][ T6507] ? __local_bh_enable_ip+0x136/0x1c0 [ 300.924098][ T6507] ? bt_accept_unlink+0x5f/0x290 [ 300.929104][ T6507] _raw_spin_lock_bh+0x32/0x50 [ 300.933869][ T6507] ? bt_accept_unlink+0x5f/0x290 [ 300.938808][ T6507] bt_accept_unlink+0x5f/0x290 [ 300.943564][ T6507] l2cap_sock_teardown_cb+0x1af/0x380 [ 300.949101][ T6507] l2cap_chan_del+0xab/0x620 [ 300.953677][ T6507] ? kfree_skb_reason+0x17a/0x370 [ 300.958702][ T6507] l2cap_conn_del+0x3c5/0x6a0 [ 300.963370][ T6507] l2cap_connect_cfm+0x125/0x11e0 [ 300.968382][ T6507] ? hci_conn_failed+0x10c/0x2a0 [ 300.973485][ T6507] ? mutex_lock_nested+0x10/0x10 [ 300.978513][ T6507] ? l2cap_ertm_resend+0xf30/0xf30 [ 300.983627][ T6507] ? l2cap_ertm_resend+0xf30/0xf30 [ 300.988725][ T6507] hci_conn_failed+0x16f/0x2a0 [ 300.993481][ T6507] hci_abort_conn_sync+0xb3c/0xd50 [ 300.998579][ T6507] ? hci_abort_conn_sync+0x8e1/0xd50 [ 301.003849][ T6507] ? hci_resume_advertising_sync+0x540/0x540 [ 301.009817][ T6507] hci_suspend_sync+0x445/0xd20 [ 301.014693][ T6507] ? hci_suspend_dev+0x191/0x320 [ 301.019616][ T6507] ? mutex_lock_nested+0x10/0x10 [ 301.024559][ T6507] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 301.030207][ T6507] ? hci_active_scan_sync+0x6f0/0x6f0 [ 301.036012][ T6507] ? mutex_unlock+0x10/0x10 [ 301.040523][ T6507] ? _find_next_bit+0x11e/0x130 [ 301.045385][ T6507] ? mgmt_pending_find+0x108/0x120 [ 301.050588][ T6507] ? hci_cmd_sync_cancel_sync+0xc4/0x180 [ 301.056225][ T6507] hci_suspend_dev+0x199/0x320 [ 301.061066][ T6507] hci_suspend_notifier+0xc8/0x270 [ 301.066180][ T6507] notifier_call_chain_robust+0xe1/0x2c0 [ 301.071905][ T6507] blocking_notifier_call_chain_robust+0x66/0x90 [ 301.078243][ T6507] pm_notifier_call_chain_robust+0x28/0x60 [ 301.084061][ T6507] snapshot_open+0x19b/0x280 [ 301.088646][ T6507] ? snapshot_compat_ioctl+0x90/0x90 [ 301.093923][ T6507] misc_open+0x31f/0x390 [ 301.098156][ T6507] chrdev_open+0x585/0x5f0 [ 301.102579][ T6507] ? cd_forget+0x160/0x160 [ 301.106988][ T6507] ? fsnotify_perm+0x39b/0x550 [ 301.111741][ T6507] ? cd_forget+0x160/0x160 [ 301.116139][ T6507] do_dentry_open+0x7dd/0x10b0 [ 301.120906][ T6507] path_openat+0x2674/0x2f10 [ 301.125509][ T6507] ? verify_lock_unused+0x140/0x140 [ 301.130696][ T6507] ? do_sys_openat2+0xdd/0x4f0 [ 301.135446][ T6507] ? do_filp_open+0x420/0x420 [ 301.140110][ T6507] do_filp_open+0x1ee/0x420 [ 301.144600][ T6507] ? vfs_tmpfile+0x470/0x470 [ 301.149190][ T6507] ? _raw_spin_unlock+0x24/0x40 [ 301.154036][ T6507] ? alloc_fd+0x590/0x640 [ 301.158369][ T6507] do_sys_openat2+0x14b/0x4f0 [ 301.163056][ T6507] ? do_sys_open+0xe0/0xe0 [ 301.167459][ T6507] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 301.173548][ T6507] ? lock_chain_count+0x20/0x20 [ 301.178392][ T6507] __x64_sys_openat+0x135/0x160 [ 301.183240][ T6507] do_syscall_64+0x4c/0xa0 [ 301.187658][ T6507] ? clear_bhb_loop+0x60/0xb0 [ 301.192336][ T6507] ? clear_bhb_loop+0x60/0xb0 [ 301.197053][ T6507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 301.203064][ T6507] RIP: 0033:0x7f8ffe19de59 [ 301.207493][ T6507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 301.227215][ T6507] RSP: 002b:00007f8fff0c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 301.235649][ T6507] RAX: ffffffffffffffda RBX: 00007f8ffe425fa0 RCX: 00007f8ffe19de59 [ 301.243622][ T6507] RDX: 0000000000000400 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 301.251591][ T6507] RBP: 00007f8ffe233e6f R08: 0000000000000000 R09: 0000000000000000 [ 301.259653][ T6507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 301.267623][ T6507] R13: 00007f8ffe426038 R14: 00007f8ffe425fa0 R15: 00007ffdb46a9a98 [ 301.275720][ T6507] [ 301.279031][ T6507] Kernel Offset: disabled [ 301.283350][ T6507] Rebooting in 86400 seconds..