last executing test programs: 28.65031354s ago: executing program 2 (id=503): sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8d06, 0x90102) ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000080)={0xca}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x45, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x94}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) 26.258342232s ago: executing program 1 (id=506): sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8d06, 0x90102) ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000080)={0xca}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x45, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x94}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) 26.121921621s ago: executing program 0 (id=507): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x20, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x50483}}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 23.538662432s ago: executing program 0 (id=509): mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000100)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) pipe(&(0x7f0000000040)) io_setup(0x3ff, &(0x7f0000000500)) 21.247053783s ago: executing program 0 (id=510): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000000740)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x42) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1c00000, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) capset(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r8 = dup(r2) syz_ublk_setup_queues(r8, r7, &(0x7f0000000180)={0x0, 0x3e80, 0x800, 0x1, 0x32c, 0x0, r3}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40, 0x10001, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe, 0x0, r3}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x5c0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000640)=0x10) umount2(&(0x7f0000000000)='./file0\x00', 0x3) 20.54228867s ago: executing program 2 (id=511): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x90) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffffc6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 18.06644185s ago: executing program 3 (id=513): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)={0x14, r1, 0x2b8ee6cf79dab3f, 0x0, 0x0, {0x2e}}, 0x14}, 0x1, 0x0, 0x0, 0x4008040}, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0xf) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)="aa", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x40000000}, 0xc800) setsockopt$sock_int(r4, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r4, &(0x7f0000001140), 0x700, 0x2, 0x0) 18.01827595s ago: executing program 1 (id=514): socket$inet6(0xa, 0x80003, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getegid() r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x15, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x1000, r3}, 0x38) 17.231158325s ago: executing program 2 (id=515): socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r4, &(0x7f0000000240)='e:mygroup/myevent sched.', 0x18) 14.82008935s ago: executing program 1 (id=516): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000280)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x9800, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x1, 0x1}, 0x50) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) 14.812898222s ago: executing program 2 (id=517): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_MCE_KILL(0x21, 0x1, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) add_key$user(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, 0x0, 0x0) accept4$bt_l2cap(r3, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c9", @ANYBLOB=' '], 0x16) ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, &(0x7f0000000300)={0x9, 0x3, 0x35a, 0x10, 0x200, 0x0, 0x3}) 12.746642105s ago: executing program 1 (id=518): openat$rtc(0xffffff9c, &(0x7f00000000c0), 0xa200, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000100001f500000000000000000000000a20000000000a010100000000000000000a0000000900010073797a300000000048000000030a010200000000000000000a0004000900010073797a30000000000900030073797a3100000000080007006e617400140004800800014000000003080002"], 0xa4}}, 0x0) 12.517404723s ago: executing program 0 (id=519): sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8d06, 0x90102) ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000080)={0xca}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x45, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x94}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) 11.234189532s ago: executing program 3 (id=520): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)={0x14, r1, 0x2b8ee6cf79dab3f, 0x0, 0x0, {0x2e}}, 0x14}, 0x1, 0x0, 0x0, 0x4008040}, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0xf) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(0x0, 0x2, 0x4a102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)="aa", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x40000000}, 0xc800) setsockopt$sock_int(r4, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r4, &(0x7f0000001140), 0x700, 0x2, 0x0) 10.388384819s ago: executing program 3 (id=521): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x38, 0x2, 0x3, 0x301, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x5}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x38}}, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x8810) syz_usb_connect$uac2(0x3, 0x98, 0x0, 0x0) socket(0x2, 0x80805, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r4, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x2, 0x4d2, @remote}, 0x10) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008188040f46ecdb4cb9cca7480ef410000000e3bd6efb440009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x24000040) 8.04775074s ago: executing program 2 (id=522): sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x8d06, 0x90102) ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000080)={0xca}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x45, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x94}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) 7.254311616s ago: executing program 0 (id=523): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x21031, 0xffffffffffffffff, 0x21d63000) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) read$FUSE(r4, &(0x7f0000000380)={0x2020}, 0xfffffdf1) 7.254137836s ago: executing program 1 (id=524): socket$inet6(0xa, 0x80003, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getegid() r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x15, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x1000, r3}, 0x38) 7.253109887s ago: executing program 3 (id=531): mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000100)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) pipe(&(0x7f0000000040)) io_setup(0x3ff, &(0x7f0000000500)) 5.227044765s ago: executing program 0 (id=525): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x90) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffffc6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.066103142s ago: executing program 3 (id=526): socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0xd0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000080), 0x12) connect$x25(r2, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000040)={'bond0\x00', 0x2000}) 15.475657ms ago: executing program 3 (id=527): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000280)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x9800, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x1, 0x1}, 0x50) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) 426.111µs ago: executing program 1 (id=536): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xbfd}, 0x2a, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'user:', 'user:'}, 0x1b, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x20000e, &(0x7f0000000c80)={[{@i_version}, {@nogrpid}, {@quota}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x2000}, 0x4) 0s ago: executing program 2 (id=528): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)={0x14, r1, 0x2b8ee6cf79dab3f, 0x0, 0x0, {0x2e}}, 0x14}, 0x1, 0x0, 0x0, 0x4008040}, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0xf) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)="aa", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x40000000}, 0xc800) setsockopt$sock_int(r4, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r4, &(0x7f0000001140), 0x700, 0x2, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.39' (ED25519) to the list of known hosts. [ 80.601796][ T5762] cgroup: Unknown subsys name 'net' [ 80.773211][ T5762] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.427923][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 84.192814][ T5787] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 84.198035][ T5791] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 84.208215][ T5791] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 84.213257][ T5788] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 84.220630][ T5791] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 84.228280][ T5787] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 84.231386][ T5791] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 84.238191][ T5787] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 84.246653][ T5791] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 84.257544][ T5788] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 84.260207][ T5791] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 84.271723][ T5792] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 84.280690][ T5792] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 84.282860][ T5787] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 84.290697][ T5792] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 84.297597][ T5787] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 84.304040][ T5792] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 84.311604][ T5787] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 84.323495][ T5792] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 84.323512][ T5787] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 84.332918][ T5792] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 84.361109][ T5787] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 84.374966][ T5792] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 84.385418][ T5792] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 84.852439][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 84.930379][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 84.984558][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 85.037335][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 85.058858][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.067402][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.074877][ T5777] bridge_slave_0: entered allmulticast mode [ 85.081931][ T5777] bridge_slave_0: entered promiscuous mode [ 85.121555][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.128889][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.136217][ T5777] bridge_slave_1: entered allmulticast mode [ 85.143646][ T5777] bridge_slave_1: entered promiscuous mode [ 85.227740][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.235211][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.242404][ T5775] bridge_slave_0: entered allmulticast mode [ 85.249612][ T5775] bridge_slave_0: entered promiscuous mode [ 85.286089][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.293242][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.300819][ T5775] bridge_slave_1: entered allmulticast mode [ 85.308581][ T5775] bridge_slave_1: entered promiscuous mode [ 85.327691][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.340243][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.380028][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.402858][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.410412][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.417744][ T5774] bridge_slave_0: entered allmulticast mode [ 85.425285][ T5774] bridge_slave_0: entered promiscuous mode [ 85.442403][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.484908][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.492364][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.499835][ T5774] bridge_slave_1: entered allmulticast mode [ 85.507387][ T5774] bridge_slave_1: entered promiscuous mode [ 85.548867][ T5777] team0: Port device team_slave_0 added [ 85.557805][ T5777] team0: Port device team_slave_1 added [ 85.575801][ T5775] team0: Port device team_slave_0 added [ 85.584633][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.621213][ T5775] team0: Port device team_slave_1 added [ 85.629983][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.649115][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.656475][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.663622][ T5776] bridge_slave_0: entered allmulticast mode [ 85.671271][ T5776] bridge_slave_0: entered promiscuous mode [ 85.679788][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.688393][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.717398][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.749270][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.756667][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.763868][ T5776] bridge_slave_1: entered allmulticast mode [ 85.771090][ T5776] bridge_slave_1: entered promiscuous mode [ 85.788583][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.797816][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.824179][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.847177][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.854157][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.880230][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.897325][ T5774] team0: Port device team_slave_0 added [ 85.931289][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.939751][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.966061][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.978787][ T5774] team0: Port device team_slave_1 added [ 85.999088][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.060662][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.075605][ T5777] hsr_slave_0: entered promiscuous mode [ 86.082467][ T5777] hsr_slave_1: entered promiscuous mode [ 86.089989][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.099933][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.126326][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.139179][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.146534][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.172795][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.228222][ T5776] team0: Port device team_slave_0 added [ 86.237502][ T5776] team0: Port device team_slave_1 added [ 86.273274][ T5775] hsr_slave_0: entered promiscuous mode [ 86.279797][ T5775] hsr_slave_1: entered promiscuous mode [ 86.286516][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.294470][ T5775] Cannot create hsr debugfs directory [ 86.344609][ T5774] hsr_slave_0: entered promiscuous mode [ 86.350941][ T5774] hsr_slave_1: entered promiscuous mode [ 86.360608][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.368268][ T5774] Cannot create hsr debugfs directory [ 86.415118][ T5792] Bluetooth: hci3: command tx timeout [ 86.415535][ T51] Bluetooth: hci1: command tx timeout [ 86.426938][ T5787] Bluetooth: hci2: command tx timeout [ 86.427625][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.432903][ T5783] Bluetooth: hci0: command tx timeout [ 86.443666][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.471310][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.484382][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.491434][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.517784][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.617728][ T5776] hsr_slave_0: entered promiscuous mode [ 86.624162][ T5776] hsr_slave_1: entered promiscuous mode [ 86.630546][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.638378][ T5776] Cannot create hsr debugfs directory [ 87.041547][ T5777] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 87.071012][ T5777] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 87.088893][ T5777] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 87.119961][ T5777] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 87.212382][ T5774] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 87.238133][ T5774] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 87.287993][ T5774] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 87.302134][ T5774] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.408694][ T5775] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.444893][ T5775] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.469336][ T5775] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.507979][ T5775] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.608908][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.662956][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.677465][ T5776] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.690198][ T5776] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.702701][ T243] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.710160][ T243] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.722417][ T5776] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 87.733651][ T5776] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 87.774062][ T2930] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.781246][ T2930] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.001913][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.012345][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.063829][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.088872][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.107623][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.137817][ T1097] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.145135][ T1097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.170816][ T1097] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.178085][ T1097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.228500][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.247663][ T1097] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.254920][ T1097] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.269035][ T1097] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.276267][ T1097] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.322558][ T2930] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.329720][ T2930] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.340540][ T2930] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.347740][ T2930] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.417508][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.495086][ T5783] Bluetooth: hci3: command tx timeout [ 88.505354][ T5783] Bluetooth: hci0: command tx timeout [ 88.510812][ T5783] Bluetooth: hci1: command tx timeout [ 88.516849][ T5783] Bluetooth: hci2: command tx timeout [ 88.598666][ T5777] veth0_vlan: entered promiscuous mode [ 88.660072][ T5777] veth1_vlan: entered promiscuous mode [ 88.751079][ T5777] veth0_macvtap: entered promiscuous mode [ 88.782052][ T5777] veth1_macvtap: entered promiscuous mode [ 88.824353][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.873748][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.906559][ T5777] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.915710][ T5777] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.925295][ T5777] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.934040][ T5777] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.011584][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.144285][ T1097] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.165249][ T1097] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.218388][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.243324][ T243] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.260725][ T243] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.277350][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.318997][ T5775] veth0_vlan: entered promiscuous mode [ 89.392342][ T5775] veth1_vlan: entered promiscuous mode [ 89.463306][ T5776] veth0_vlan: entered promiscuous mode [ 89.507388][ T5839] lo: entered allmulticast mode [ 89.520767][ T5838] lo: left allmulticast mode [ 89.537033][ T5774] veth0_vlan: entered promiscuous mode [ 89.549959][ T5776] veth1_vlan: entered promiscuous mode [ 89.568443][ T5774] veth1_vlan: entered promiscuous mode [ 89.579766][ T5775] veth0_macvtap: entered promiscuous mode [ 89.592046][ T5775] veth1_macvtap: entered promiscuous mode [ 89.626764][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.638468][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.650350][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.672772][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.683419][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.695503][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.714915][ T5775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.723879][ T5775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.734254][ T5775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.744329][ T5775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.773354][ T5776] veth0_macvtap: entered promiscuous mode [ 89.788640][ T5774] veth0_macvtap: entered promiscuous mode [ 89.820330][ T5774] veth1_macvtap: entered promiscuous mode [ 89.831623][ T5776] veth1_macvtap: entered promiscuous mode [ 89.874705][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.886136][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.896592][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.908179][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.920763][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.956536][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.970826][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.981698][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.995133][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.005101][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.017919][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.030094][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.051299][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.062218][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.072871][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.083843][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.097436][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.147376][ T5776] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.164347][ T5776] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.174901][ T5776] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.183746][ T5776] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.223544][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.235104][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.248369][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.260640][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.271681][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.282572][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.295575][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.323369][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.627412][ T5783] Bluetooth: hci2: command tx timeout [ 90.633255][ T5783] Bluetooth: hci3: command tx timeout [ 90.641556][ T5783] Bluetooth: hci1: command tx timeout [ 90.651185][ T5783] Bluetooth: hci0: command tx timeout [ 90.686804][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.081648][ T5774] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.095550][ T5774] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.135090][ T5774] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.143868][ T5774] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.252625][ T1097] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.276680][ T1097] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.483057][ T2930] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.530009][ T2930] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.653032][ T5854] ======================================================= [ 91.653032][ T5854] WARNING: The mand mount option has been deprecated and [ 91.653032][ T5854] and is ignored by this kernel. Remove the mand [ 91.653032][ T5854] option from the mount to silence this warning. [ 91.653032][ T5854] ======================================================= [ 92.243984][ T2930] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.268864][ T1097] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.305052][ T2930] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.326488][ T23] cfg80211: failed to load regulatory.db [ 92.341864][ T1097] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.459349][ T1097] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.488402][ T1097] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.148179][ T5783] Bluetooth: hci0: command tx timeout [ 93.153846][ T5783] Bluetooth: hci2: command tx timeout [ 93.166805][ T5783] Bluetooth: hci1: command tx timeout [ 93.172418][ T5783] Bluetooth: hci3: command tx timeout [ 93.591253][ T5869] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 95.423250][ T5873] syz.3.4[5873]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 95.440496][ T5873] loop3: detected capacity change from 0 to 512 [ 95.448373][ T5873] EXT4-fs: Ignoring removed mblk_io_submit option [ 95.486701][ T5873] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 95.547399][ T5873] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2974: inode #15: comm syz.3.4: corrupted xattr block 252: invalid header [ 95.568698][ T5873] EXT4-fs (loop3): Remounting filesystem read-only [ 95.575594][ T5873] EXT4-fs warning (device loop3): ext4_evict_inode:274: xattr delete (err -117) [ 95.585065][ T5873] EXT4-fs (loop3): 1 orphan inode deleted [ 95.592849][ T5873] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.931351][ T5774] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.914590][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 98.043379][ T5783] Bluetooth: hci2: command 0x0406 tx timeout [ 99.793174][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 103.081898][ T5820] IPVS: starting estimator thread 0... [ 103.214208][ T5908] IPVS: using max 16 ests per chain, 38400 per kthread [ 103.675345][ T5910] EXT4-fs (sda1): shut down requested (1) [ 103.740451][ T5910] Aborting journal on device sda1-8. [ 103.750976][ T5879] Zero length message leads to an empty skb [ 103.843351][ T5915] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 104.414335][ T5921] jffs2: notice: (5921) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 104.444871][ T5915] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 105.594597][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 106.004436][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 106.341111][ T5915] kvm: pic: level sensitive irq not supported [ 106.341436][ T5915] kvm: pic: non byte read [ 106.416439][ T5915] kvm: pic: level sensitive irq not supported [ 106.418833][ T5915] kvm: pic: non byte read [ 106.851517][ T5935] Cannot find add_set index 0 as target [ 108.710734][ T5787] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 108.720819][ T5787] CPU: 1 PID: 5787 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 108.728428][ T5787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 108.738529][ T5787] Workqueue: hci0 hci_rx_work [ 108.743292][ T5787] Call Trace: [ 108.746633][ T5787] [ 108.749617][ T5787] dump_stack_lvl+0x18c/0x250 [ 108.754344][ T5787] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 108.760056][ T5787] ? show_regs_print_info+0x20/0x20 [ 108.765301][ T5787] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 108.771021][ T5787] sysfs_create_dir_ns+0x26e/0x2a0 [ 108.776205][ T5787] ? __lock_acquire+0x7d80/0x7d80 [ 108.781303][ T5787] ? sysfs_warn_dup+0xa0/0xa0 [ 108.786122][ T5787] ? do_raw_spin_unlock+0x121/0x230 [ 108.791381][ T5787] kobject_add_internal+0x617/0xc90 [ 108.796635][ T5787] kobject_add+0x164/0x240 [ 108.801120][ T5787] ? preempt_schedule_thunk+0x1a/0x30 [ 108.806573][ T5787] ? kobject_init+0x1d0/0x1d0 [ 108.811321][ T5787] ? get_device_parent+0x366/0x390 [ 108.816514][ T5787] device_add+0x3fa/0xc40 [ 108.820896][ T5787] hci_conn_add_sysfs+0xd5/0x1e0 [ 108.825888][ T5787] le_conn_complete_evt+0xe9a/0x1480 [ 108.831238][ T5787] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 108.837539][ T5787] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 108.843219][ T5787] ? mutex_unlock+0x10/0x10 [ 108.847765][ T5787] ? skb_pull_data+0xf0/0x1f0 [ 108.852493][ T5787] hci_le_conn_complete_evt+0x187/0x440 [ 108.858090][ T5787] ? hci_remote_host_features_evt+0x150/0x150 [ 108.864205][ T5787] hci_event_packet+0x7b4/0x1280 [ 108.869195][ T5787] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 108.874890][ T5787] ? bis_list+0x290/0x290 [ 108.879287][ T5787] ? kcov_remote_start+0x1b7/0x810 [ 108.884464][ T5787] ? hci_send_to_monitor+0xd7/0x4f0 [ 108.889730][ T5787] hci_rx_work+0x43a/0xd60 [ 108.894206][ T5787] ? process_scheduled_works+0x975/0x1600 [ 108.899978][ T5787] process_scheduled_works+0xa60/0x1600 [ 108.905607][ T5787] ? worker_attach_to_pool+0x370/0x370 [ 108.911132][ T5787] ? assign_work+0x3cc/0x5d0 [ 108.915793][ T5787] worker_thread+0xa5e/0xfe0 [ 108.920458][ T5787] kthread+0x2fa/0x390 [ 108.924566][ T5787] ? pr_cont_work+0x550/0x550 [ 108.929289][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 108.933923][ T5787] ret_from_fork+0x48/0x80 [ 108.938391][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 108.943156][ T5787] ret_from_fork_asm+0x11/0x20 [ 108.947983][ T5787] [ 109.118700][ T5787] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 109.132974][ T5787] Bluetooth: hci0: failed to register connection device [ 112.495063][ T5783] Bluetooth: hci0: command tx timeout [ 115.834614][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 118.394589][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 118.578080][ T28] IPVS: starting estimator thread 0... [ 118.694649][ T6000] IPVS: using max 21 ests per chain, 50400 per kthread [ 118.915680][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x800100000080 [ 118.939627][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x800000000000 [ 118.967486][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x800000000000 [ 118.994722][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 119.035017][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x800000000000 [ 119.054850][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 119.093148][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x800000000000 [ 119.118459][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 119.145922][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x800000000000 [ 119.164667][ T6002] kvm: kvm [6001]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 123.607858][ T6034] loop0: detected capacity change from 0 to 512 [ 123.646304][ T6034] EXT4-fs: Ignoring removed nomblk_io_submit option [ 123.722895][ T6034] ext4: Unknown parameter 'fsname' [ 124.502585][ T6043] syzkaller0: entered promiscuous mode [ 124.542786][ T6043] syzkaller0: entered allmulticast mode [ 124.635917][ T6043] TC_ACT_REPEAT abuse ? [ 125.223456][ T6053] 0x000000000000-0x000000020000 : "" [ 125.248747][ T6053] ftl_cs: FTL header not found. [ 126.143523][ T6054] udevd[6054]: failed to execute '/lib/udev/mtd_probe' 'mtd_probe /dev/mtd1ro': Input/output error [ 126.325354][ T6058] loop0: detected capacity change from 0 to 256 [ 126.487518][ T6058] FAT-fs (loop0): Directory bread(block 64) failed [ 126.514512][ T6058] FAT-fs (loop0): Directory bread(block 65) failed [ 126.535155][ T6058] FAT-fs (loop0): Directory bread(block 66) failed [ 126.564523][ T6058] FAT-fs (loop0): Directory bread(block 67) failed [ 126.581463][ T6058] FAT-fs (loop0): Directory bread(block 68) failed [ 126.614519][ T6058] FAT-fs (loop0): Directory bread(block 69) failed [ 126.652129][ T6058] FAT-fs (loop0): Directory bread(block 70) failed [ 126.675177][ T6060] FAULT_INJECTION: forcing a failure. [ 126.675177][ T6060] name failslab, interval 1, probability 0, space 0, times 1 [ 126.688510][ T6058] FAT-fs (loop0): Directory bread(block 71) failed [ 126.707589][ T6058] FAT-fs (loop0): Directory bread(block 72) failed [ 126.714177][ T6058] FAT-fs (loop0): Directory bread(block 73) failed [ 126.736405][ T6060] CPU: 0 PID: 6060 Comm: syz.1.56 Not tainted syzkaller #0 [ 126.743676][ T6060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 126.753825][ T6060] Call Trace: [ 126.757146][ T6060] [ 126.760119][ T6060] dump_stack_lvl+0x18c/0x250 [ 126.764855][ T6060] ? kmalloc_reserve+0x95/0x240 [ 126.769773][ T6060] ? skb_copy+0x126/0x700 [ 126.774158][ T6060] ? show_regs_print_info+0x20/0x20 [ 126.779440][ T6060] ? load_image+0x420/0x420 [ 126.780543][ T6062] netlink: 'syz.2.57': attribute type 1 has an invalid length. [ 126.783977][ T6060] ? do_syscall_64+0x55/0xb0 [ 126.796188][ T6060] should_fail_ex+0x394/0x4c0 [ 126.800928][ T6060] should_failslab+0x9/0x20 [ 126.805486][ T6060] slab_pre_alloc_hook+0x59/0x300 [ 126.810667][ T6060] kmem_cache_alloc+0x5a/0x2c0 [ 126.815507][ T6060] ? skb_clone+0x1eb/0x370 [ 126.819991][ T6060] skb_clone+0x1eb/0x370 [ 126.824288][ T6060] ? __tcp_transmit_skb+0x2a8/0x3470 [ 126.829621][ T6060] __tcp_transmit_skb+0x373/0x3470 [ 126.834795][ T6060] ? rcu_is_watching+0x15/0xb0 [ 126.839618][ T6060] ? kmem_cache_alloc_node+0x1d7/0x310 [ 126.845138][ T6060] ? kmalloc_reserve+0x95/0x240 [ 126.850026][ T6060] ? skb_copy_bits+0xf0/0x7a0 [ 126.854745][ T6060] ? __tcp_send_ack+0x5f0/0x5f0 [ 126.859627][ T6060] ? __asan_memset+0x22/0x40 [ 126.864262][ T6060] ? tcp_rbtree_insert+0x118/0x170 [ 126.869422][ T6060] tcp_send_synack+0x9a4/0xd00 [ 126.874220][ T6060] ? ktime_get_real_ts64+0x440/0x440 [ 126.879538][ T6060] ? tcp_send_active_reset+0x6c0/0x6c0 [ 126.885037][ T6060] ? __tcp_mtu_to_mss+0x236/0x3a0 [ 126.890099][ T6060] ? tcp_sync_mss+0x175/0x310 [ 126.894815][ T6060] tcp_rcv_state_process+0x13c7/0x4440 [ 126.900320][ T6060] ? tcp_finish_connect+0x5c0/0x5c0 [ 126.905558][ T6060] ? __local_bh_enable_ip+0x13a/0x1c0 [ 126.910962][ T6060] ? lockdep_hardirqs_on+0x98/0x150 [ 126.916196][ T6060] ? __local_bh_enable_ip+0x13a/0x1c0 [ 126.921594][ T6060] ? _local_bh_enable+0xa0/0xa0 [ 126.926471][ T6060] tcp_v4_do_rcv+0x3c0/0xba0 [ 126.931094][ T6060] __release_sock+0x1ea/0x460 [ 126.935809][ T6060] release_sock+0x5f/0x1c0 [ 126.940261][ T6060] tcp_sendmsg+0x39/0x50 [ 126.944534][ T6060] __sys_sendto+0x4a9/0x6b0 [ 126.949070][ T6060] ? __ia32_sys_getpeername+0x90/0x90 [ 126.954485][ T6060] ? __sys_bind+0x32f/0x3f0 [ 126.959025][ T6060] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 126.965040][ T6060] ? lock_chain_count+0x20/0x20 [ 126.969943][ T6060] __x64_sys_sendto+0xde/0xf0 [ 126.974660][ T6060] do_syscall_64+0x55/0xb0 [ 126.979112][ T6060] ? clear_bhb_loop+0x40/0x90 [ 126.983821][ T6060] ? clear_bhb_loop+0x40/0x90 [ 126.988553][ T6060] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 126.994489][ T6060] RIP: 0033:0x7fcf6d79e159 [ 126.998945][ T6060] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.018586][ T6060] RSP: 002b:00007fcf6e67e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 127.027033][ T6060] RAX: ffffffffffffffda RBX: 00007fcf6da25fa0 RCX: 00007fcf6d79e159 [ 127.035038][ T6060] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 127.043048][ T6060] RBP: 00007fcf6d83506b R08: 0000200000000280 R09: 0000000000000010 [ 127.051049][ T6060] R10: 00000000200007f9 R11: 0000000000000246 R12: 0000000000000000 [ 127.059043][ T6060] R13: 00007fcf6da26038 R14: 00007fcf6da25fa0 R15: 00007ffd47ac0fc8 [ 127.067064][ T6060] [ 127.335060][ T6058] Bluetooth: MGMT ver 1.22 [ 131.496610][ T5820] IPVS: starting estimator thread 0... [ 131.614842][ T6101] IPVS: using max 17 ests per chain, 40800 per kthread [ 133.754581][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 134.164436][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 134.265546][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 134.273088][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.610784][ T6113] loop3: detected capacity change from 0 to 1024 [ 134.795948][ T6113] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 135.766689][ T6117] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 136.421435][ T5774] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 138.983234][ T6134] syzkaller0: entered promiscuous mode [ 138.993415][ T6134] syzkaller0: entered allmulticast mode [ 139.010983][ T6134] 0: reclassify loop, rule prio 0, protocol 800 [ 141.572601][ T6148] ubi0: attaching mtd0 [ 141.578890][ T6148] ubi0: scanning is finished [ 141.583547][ T6148] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 141.775338][ T6148] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 141.844408][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 144.404413][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 145.142270][ T6159] bond_slave_0: entered promiscuous mode [ 145.148306][ T6159] bond_slave_1: entered promiscuous mode [ 145.198939][ T6159] vlan2: entered promiscuous mode [ 145.234317][ T6159] bond0: entered promiscuous mode [ 148.636536][ T6175] loop1: detected capacity change from 0 to 512 [ 148.644064][ T6175] ext4: Bad value for 'data' [ 149.576761][ T6183] 0x000000000000-0x000000020000 : "" [ 149.744604][ T6183] ftl_cs: FTL header not found. [ 149.974389][ C1] sched: RT throttling activated [ 150.262493][ T6184] udevd[6184]: failed to execute '/lib/udev/mtd_probe' 'mtd_probe /dev/mtd2ro': Input/output error [ 150.514189][ T6189] syzkaller0: entered promiscuous mode [ 150.530058][ T6189] syzkaller0: entered allmulticast mode [ 150.554273][ T6193] loop0: detected capacity change from 0 to 8 [ 150.614986][ T6192] syzkaller0: entered promiscuous mode [ 150.620538][ T6192] syzkaller0: entered allmulticast mode [ 155.246426][ T6215] loop0: detected capacity change from 0 to 512 [ 155.282617][ T6215] ext4: Bad value for 'data' [ 156.880615][ T6228] loop1: detected capacity change from 0 to 512 [ 156.892856][ T6228] EXT4-fs: Ignoring removed mblk_io_submit option [ 156.918997][ T6228] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 156.998695][ T6228] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2974: inode #15: comm syz.1.98: corrupted xattr block 252: invalid header [ 157.026391][ T6228] EXT4-fs (loop1): Remounting filesystem read-only [ 157.033047][ T6228] EXT4-fs warning (device loop1): ext4_evict_inode:274: xattr delete (err -117) [ 157.042618][ T6228] EXT4-fs (loop1): 1 orphan inode deleted [ 157.059762][ T6228] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 157.561737][ T6235] loop3: detected capacity change from 0 to 8 [ 157.581905][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 157.937849][ T6238] syz.1.102 (6238) used greatest stack depth: 20824 bytes left [ 158.813731][ T6246] syzkaller0: entered promiscuous mode [ 158.834506][ T6246] syzkaller0: entered allmulticast mode [ 158.860531][ T6247] syzkaller0: entered promiscuous mode [ 158.871832][ T6247] syzkaller0: entered allmulticast mode [ 158.888172][ T6246] 0: reclassify loop, rule prio 0, protocol 800 [ 159.725282][ T6258] syzkaller0: entered promiscuous mode [ 159.730915][ T6258] syzkaller0: entered allmulticast mode [ 161.294205][ T6270] FAULT_INJECTION: forcing a failure. [ 161.294205][ T6270] name failslab, interval 1, probability 0, space 0, times 0 [ 161.312618][ T6270] CPU: 1 PID: 6270 Comm: syz.3.112 Not tainted syzkaller #0 [ 161.319985][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 161.330093][ T6270] Call Trace: [ 161.333416][ T6270] [ 161.336386][ T6270] dump_stack_lvl+0x18c/0x250 [ 161.341127][ T6270] ? _local_bh_enable+0xa0/0xa0 [ 161.346035][ T6270] ? show_regs_print_info+0x20/0x20 [ 161.351301][ T6270] ? load_image+0x420/0x420 [ 161.355891][ T6270] ? rt_set_nexthop+0x72f/0xa10 [ 161.360797][ T6270] should_fail_ex+0x394/0x4c0 [ 161.365543][ T6270] should_failslab+0x9/0x20 [ 161.370111][ T6270] slab_pre_alloc_hook+0x59/0x300 [ 161.375206][ T6270] ? __asan_memset+0x22/0x40 [ 161.379865][ T6270] kmem_cache_alloc+0x5a/0x2c0 [ 161.384710][ T6270] ? __inet_bhash2_update_saddr+0x203/0x1550 [ 161.390761][ T6270] __inet_bhash2_update_saddr+0x203/0x1550 [ 161.396640][ T6270] ? rcu_force_quiescent_state+0x220/0x220 [ 161.402523][ T6270] ? xfrm_lookup_route+0xfc/0x1b0 [ 161.407603][ T6270] tcp_v4_connect+0x9ee/0x18a0 [ 161.412439][ T6270] ? tcp_twsk_unique+0x970/0x970 [ 161.417433][ T6270] __inet_stream_connect+0x254/0xdf0 [ 161.422769][ T6270] ? inet_dgram_connect+0x340/0x340 [ 161.428006][ T6270] tcp_sendmsg_fastopen+0x3af/0x5f0 [ 161.433247][ T6270] tcp_sendmsg_locked+0x44ee/0x4ab0 [ 161.438474][ T6270] ? verify_lock_unused+0x140/0x140 [ 161.443711][ T6270] ? __might_sleep+0xe0/0xe0 [ 161.448347][ T6270] ? mark_lock+0x94/0x320 [ 161.452712][ T6270] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 161.458737][ T6270] ? lock_chain_count+0x20/0x20 [ 161.463637][ T6270] ? tcp_set_state+0x6c0/0x6c0 [ 161.468463][ T6270] tcp_sendmsg+0x2f/0x50 [ 161.472745][ T6270] __sys_sendto+0x4a9/0x6b0 [ 161.477304][ T6270] ? __ia32_sys_getpeername+0x90/0x90 [ 161.482733][ T6270] ? __sys_bind+0x32f/0x3f0 [ 161.487279][ T6270] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 161.493293][ T6270] ? lock_chain_count+0x20/0x20 [ 161.498177][ T6270] __x64_sys_sendto+0xde/0xf0 [ 161.502885][ T6270] do_syscall_64+0x55/0xb0 [ 161.507352][ T6270] ? clear_bhb_loop+0x40/0x90 [ 161.512067][ T6270] ? clear_bhb_loop+0x40/0x90 [ 161.516791][ T6270] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 161.522725][ T6270] RIP: 0033:0x7fbc1ad9e159 [ 161.527169][ T6270] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.546825][ T6270] RSP: 002b:00007fbc1bd17028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 161.555288][ T6270] RAX: ffffffffffffffda RBX: 00007fbc1b025fa0 RCX: 00007fbc1ad9e159 [ 161.563281][ T6270] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 161.571284][ T6270] RBP: 00007fbc1ae3506b R08: 0000200000000280 R09: 0000000000000010 [ 161.579292][ T6270] R10: 00000000200007f9 R11: 0000000000000246 R12: 0000000000000000 [ 161.587290][ T6270] R13: 00007fbc1b026038 R14: 00007fbc1b025fa0 R15: 00007ffddaa86b58 [ 161.595299][ T6270] [ 161.616511][ T6275] loop2: detected capacity change from 0 to 8 [ 165.338326][ T6290] loop0: detected capacity change from 0 to 32768 [ 165.440978][ T6290] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 167.501942][ T6290] XFS (loop0): Ending clean mount [ 167.580107][ T5775] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 167.788527][ T6317] netdevsim netdevsim1: loading /lib/firmware// failed with error -22 [ 167.797252][ T6317] netdevsim netdevsim1: Direct firmware load for / failed with error -22 [ 167.806043][ T6317] netdevsim netdevsim1: Falling back to sysfs fallback for: / [ 170.505021][ T6327] loop1: detected capacity change from 0 to 8 [ 170.824954][ T6330] netlink: 'syz.3.129': attribute type 10 has an invalid length. [ 170.911296][ T6330] team0 (unregistering): Port device team_slave_0 removed [ 170.957873][ T6330] team0 (unregistering): Port device team_slave_1 removed [ 172.179853][ T6341] FAULT_INJECTION: forcing a failure. [ 172.179853][ T6341] name failslab, interval 1, probability 0, space 0, times 0 [ 172.193003][ T6341] CPU: 1 PID: 6341 Comm: syz.0.126 Not tainted syzkaller #0 [ 172.200326][ T6341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 172.210391][ T6341] Call Trace: [ 172.213695][ T6341] [ 172.216637][ T6341] dump_stack_lvl+0x18c/0x250 [ 172.221334][ T6341] ? show_regs_print_info+0x20/0x20 [ 172.226552][ T6341] ? load_image+0x420/0x420 [ 172.231072][ T6341] ? __might_sleep+0xe0/0xe0 [ 172.235682][ T6341] ? __lock_acquire+0x7d80/0x7d80 [ 172.240720][ T6341] should_fail_ex+0x394/0x4c0 [ 172.245436][ T6341] should_failslab+0x9/0x20 [ 172.250005][ T6341] slab_pre_alloc_hook+0x59/0x300 [ 172.255103][ T6341] kmem_cache_alloc_node+0x5e/0x310 [ 172.260364][ T6341] ? __alloc_skb+0x103/0x2c0 [ 172.265020][ T6341] __alloc_skb+0x103/0x2c0 [ 172.269497][ T6341] tcp_stream_alloc_skb+0x3d/0x330 [ 172.274667][ T6341] tcp_connect+0x16cc/0x5300 [ 172.279339][ T6341] ? mark_lock+0x94/0x320 [ 172.283718][ T6341] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 172.289751][ T6341] ? lock_chain_count+0x20/0x20 [ 172.294648][ T6341] ? tcp_options_write+0xc70/0xc70 [ 172.299806][ T6341] ? get_random_u16+0x4b0/0x990 [ 172.304714][ T6341] ? lockdep_hardirqs_on+0x98/0x150 [ 172.309958][ T6341] ? get_random_u16+0x16e/0x990 [ 172.314861][ T6341] ? get_random_u16+0x517/0x990 [ 172.319766][ T6341] ? __asan_memset+0x22/0x40 [ 172.324429][ T6341] ? tcp_fastopen_active_should_disable+0x240/0x240 [ 172.331085][ T6341] ? dst_release+0x72/0x1a0 [ 172.335656][ T6341] tcp_v4_connect+0xf99/0x18a0 [ 172.340481][ T6341] ? tcp_twsk_unique+0x970/0x970 [ 172.345492][ T6341] __inet_stream_connect+0x254/0xdf0 [ 172.350954][ T6341] ? inet_dgram_connect+0x340/0x340 [ 172.356215][ T6341] tcp_sendmsg_fastopen+0x3af/0x5f0 [ 172.361473][ T6341] tcp_sendmsg_locked+0x44ee/0x4ab0 [ 172.366736][ T6341] ? mark_lock+0x94/0x320 [ 172.371130][ T6341] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 172.377151][ T6341] ? trace_irq_disable+0x37/0xe0 [ 172.382150][ T6341] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 172.387838][ T6341] ? lockdep_hardirqs_on+0x98/0x150 [ 172.393079][ T6341] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 172.398771][ T6341] ? tcp_sendmsg+0x21/0x50 [ 172.403249][ T6341] ? tcp_set_state+0x6c0/0x6c0 [ 172.408055][ T6341] ? __local_bh_enable_ip+0x142/0x1c0 [ 172.413589][ T6341] tcp_sendmsg+0x2f/0x50 [ 172.417880][ T6341] __sys_sendto+0x4a9/0x6b0 [ 172.422472][ T6341] ? __ia32_sys_getpeername+0x90/0x90 [ 172.427929][ T6341] ? __sys_bind+0x32f/0x3f0 [ 172.432492][ T6341] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 172.438541][ T6341] ? lock_chain_count+0x20/0x20 [ 172.443455][ T6341] __x64_sys_sendto+0xde/0xf0 [ 172.448199][ T6341] do_syscall_64+0x55/0xb0 [ 172.452668][ T6341] ? clear_bhb_loop+0x40/0x90 [ 172.457396][ T6341] ? clear_bhb_loop+0x40/0x90 [ 172.462152][ T6341] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 172.468104][ T6341] RIP: 0033:0x7f568b99e159 [ 172.472561][ T6341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 172.492225][ T6341] RSP: 002b:00007f568c869028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 172.500696][ T6341] RAX: ffffffffffffffda RBX: 00007f568bc25fa0 RCX: 00007f568b99e159 [ 172.508719][ T6341] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 172.516734][ T6341] RBP: 00007f568ba3506b R08: 0000200000000280 R09: 0000000000000010 [ 172.524754][ T6341] R10: 00000000200007f9 R11: 0000000000000246 R12: 0000000000000000 [ 172.532761][ T6341] R13: 00007f568bc26038 R14: 00007f568bc25fa0 R15: 00007ffef4baa438 [ 172.540793][ T6341] [ 174.485651][ T6348] netlink: 'syz.3.133': attribute type 10 has an invalid length. [ 178.335799][ T5781] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 182.383321][ T6389] nvmet_tcp: address family 255 not supported [ 182.405272][ T27] audit: type=1800 audit(1790275756.098:2): pid=6389 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.145" name="addr_trtype" dev="configfs" ino=9574 res=0 errno=0 [ 182.474471][ T5781] usb 3-1: device not accepting address 2, error -71 [ 182.659792][ T27] audit: type=1800 audit(1790275756.108:3): pid=6389 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.145" name="addr_traddr" dev="configfs" ino=9575 res=0 errno=0 [ 183.154624][ T6391] netlink: 'syz.2.148': attribute type 10 has an invalid length. [ 183.387019][ T6391] team0 (unregistering): Port device team_slave_0 removed [ 183.484886][ T6391] team0 (unregistering): Port device team_slave_1 removed [ 185.578181][ T6414] 0x000000000000-0x000000020000 : "" [ 185.587211][ T6414] ftl_cs: FTL header not found. [ 186.581691][ T6420] udevd[6420]: failed to execute '/lib/udev/mtd_probe' 'mtd_probe /dev/mtd3ro': Input/output error [ 190.715880][ T6434] netlink: 'syz.2.158': attribute type 10 has an invalid length. [ 190.917325][ T6440] netlink: 'syz.3.161': attribute type 10 has an invalid length. [ 194.501880][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.508797][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 198.224041][ T6477] netlink: 'syz.1.171': attribute type 10 has an invalid length. [ 198.353480][ T6481] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 198.353480][ T6481] [ 198.368260][ T6481] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 198.383325][ T6481] CIFS: Attempting to mount //127.0.0.1/share [ 199.306634][ T6477] team0 (unregistering): Port device team_slave_0 removed [ 199.335303][ T6481] CIFS: VFS: Error connecting to socket. Aborting operation. [ 199.342955][ T6481] CIFS: VFS: cifs_mount failed w/return code = -4 [ 199.384274][ T6477] team0 (unregistering): Port device team_slave_1 removed [ 199.816364][ T6491] netlink: 'syz.0.170': attribute type 10 has an invalid length. [ 199.955124][ T6491] team0 (unregistering): Port device team_slave_0 removed [ 199.967700][ T6491] team0 (unregistering): Port device team_slave_1 removed [ 200.158746][ T6493] loop2: detected capacity change from 0 to 1024 [ 201.685297][ T6504] 0x000000000000-0x000000020000 : "" [ 202.271450][ T6504] ftl_cs: FTL header not found. [ 205.795138][ T6524] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 206.304973][ T5819] IPVS: starting estimator thread 0... [ 206.517890][ T6527] udevd[6527]: failed to execute '/lib/udev/mtd_probe' 'mtd_probe /dev/mtd4ro': Input/output error [ 206.564467][ T6525] IPVS: using max 20 ests per chain, 48000 per kthread [ 206.699193][ T6529] loop2: detected capacity change from 0 to 512 [ 206.770048][ T6529] EXT4-fs (loop2): 1 truncate cleaned up [ 208.380088][ T5792] Bluetooth: hci0: command 0x0406 tx timeout [ 208.380110][ T5785] Bluetooth: hci3: command 0x0406 tx timeout [ 208.389820][ T5792] Bluetooth: hci1: command 0x0406 tx timeout [ 208.401682][ T6529] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 208.992257][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 212.936468][ T6553] netlink: 'syz.3.188': attribute type 10 has an invalid length. [ 218.692475][ T6575] netlink: 'syz.2.208': attribute type 10 has an invalid length. [ 220.005582][ T6581] netlink: 'syz.2.201': attribute type 13 has an invalid length. [ 220.039549][ T6581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.201'. [ 220.060583][ T6581] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 222.807049][ T6607] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 11 (only 8 groups) [ 229.653260][ T6645] netlink: 'syz.2.210': attribute type 10 has an invalid length. [ 232.652493][ T6664] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 237.216518][ T6700] netlink: 'syz.3.232': attribute type 10 has an invalid length. [ 246.728367][ T6734] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 246.728367][ T6734] [ 246.742492][ T6734] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 246.755844][ T6734] CIFS: Attempting to mount //127.0.0.1/share [ 247.200734][ T6736] netlink: 'syz.0.244': attribute type 10 has an invalid length. [ 247.587273][ T6734] CIFS: VFS: cifs_mount failed w/return code = -512 [ 251.740022][ T6753] Trying to write to read-only block-device nullb0 [ 255.716328][ T6772] netlink: 'syz.0.250': attribute type 10 has an invalid length. [ 256.345233][ T6782] loop1: detected capacity change from 0 to 1024 [ 256.739272][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.754815][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.290235][ T6788] loop0: detected capacity change from 0 to 512 [ 257.339090][ T6788] EXT4-fs (loop0): 1 truncate cleaned up [ 257.346792][ T6788] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 257.388576][ T6792] syzkaller0: entered promiscuous mode [ 257.396394][ T6792] syzkaller0: entered allmulticast mode [ 259.210898][ T6794] EXT4-fs error (device loop0): ext4_validate_block_bitmap:439: comm ext4lazyinit: bg 0: block 465: padding at end of block bitmap is not set [ 259.590906][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 262.384490][ T971] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 262.455258][ T6815] netlink: 'syz.0.262': attribute type 10 has an invalid length. [ 264.094746][ T971] usb 4-1: Using ep0 maxpacket: 8 [ 264.120814][ T971] usb 4-1: device descriptor read/all, error -71 [ 269.144502][ T5842] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 269.224234][ T6839] kvm_pr_unimpl_wrmsr: 44 callbacks suppressed [ 269.224256][ T6839] kvm: kvm [6836]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x100000000 [ 269.267770][ T6839] kvm: kvm [6836]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0xffffffff00000000 [ 269.311285][ T6839] kvm: kvm [6836]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 269.339123][ T5842] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 269.360666][ T6839] kvm: kvm [6836]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 269.400373][ T5842] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 269.433196][ T5842] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 269.464449][ T5842] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.518789][ T6838] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 269.562000][ T5842] usb 4-1: Quirk or no altest; falling back to MIDI 1.0 [ 269.837755][ T6852] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 269.837755][ T6852] [ 269.852581][ T6852] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 269.866164][ T6852] CIFS: Attempting to mount //127.0.0.1/share [ 270.087779][ T8] usb 4-1: USB disconnect, device number 4 [ 272.515390][ T6852] CIFS: VFS: Error connecting to socket. Aborting operation. [ 272.522860][ T6852] CIFS: VFS: cifs_mount failed w/return code = -4 [ 273.795029][ T6859] nvmet_rdma: malformed ip/port passed: 127.0.0.1: [ 279.624884][ T6895] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 279.624884][ T6895] [ 279.639193][ T6895] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 279.652142][ T6895] CIFS: Attempting to mount //127.0.0.1/share [ 281.145327][ T6895] CIFS: VFS: Error connecting to socket. Aborting operation. [ 281.152780][ T6895] CIFS: VFS: cifs_mount failed w/return code = -4 [ 283.020607][ T6909] netlink: 'syz.2.281': attribute type 10 has an invalid length. [ 287.950297][ T6934] syzkaller0: entered promiscuous mode [ 288.003607][ T6934] syzkaller0: entered allmulticast mode [ 288.105355][ T6936] tipc: Started in network mode [ 288.110472][ T6936] tipc: Node identity ea39507d7455, cluster identity 4711 [ 288.151700][ T6936] tipc: Enabled bearer , priority 0 [ 288.166997][ T6934] tipc: Resetting bearer [ 288.342018][ T6932] tipc: Resetting bearer [ 288.449731][ T6932] tipc: Disabling bearer [ 303.166129][ T7006] loop2: detected capacity change from 0 to 164 [ 312.720803][ T7045] syz.2.318 uses obsolete (PF_INET,SOCK_PACKET) [ 312.759270][ T7045] loop2: detected capacity change from 0 to 1024 [ 312.772809][ T7045] EXT4-fs: Ignoring removed bh option [ 312.845582][ T7045] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 312.963727][ T7045] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2858: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 313.917606][ T7057] binder: 7055:7057 ioctl c0306201 200000000080 returned -14 [ 314.165284][ T7057] binder: 7055:7057 ioctl c0306201 2000000003c0 returned -14 [ 314.280597][ T7057] binder_alloc: 7055: binder_alloc_buf size -240 failed, no address space [ 314.368982][ T7057] binder_alloc: allocated: 4160 (num: 1 largest: 4160), free: 8128 (num: 1 largest: 8128) [ 314.779939][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.214664][ T5783] Bluetooth: hci1: command 0x0406 tx timeout [ 317.384951][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.391360][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.121399][ T7087] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 318.319783][ T7089] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 318.438410][ T7091] loop0: detected capacity change from 0 to 512 [ 318.514536][ T7091] EXT4-fs (loop0): couldn't mount as ext2 due to feature incompatibilities [ 318.557619][ T7082] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 319.475486][ T7093] __vm_enough_memory: pid: 7093, comm: syz.0.331, not enough memory for the allocation [ 319.995852][ T7096] configfs-gadget.g1 gadget.0: HOST MAC 52:8a:3e:9b:56:bf [ 320.006199][ T7101] loop0: detected capacity change from 0 to 512 [ 320.025105][ T7096] configfs-gadget.g1 gadget.0: MAC da:d2:08:12:eb:7f [ 320.693619][ T7106] netlink: 'syz.1.333': attribute type 1 has an invalid length. [ 320.701959][ T7106] netlink: 224 bytes leftover after parsing attributes in process `syz.1.333'. [ 321.939353][ T5818] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 322.166594][ T5818] usb 1-1: Dual-Role OTG device on HNP port [ 322.184395][ T5818] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.06 [ 322.209213][ T5818] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.224511][ T5818] usb 1-1: SerialNumber: 1234567890 [ 322.328276][ T5818] cdc_ether 1-1:1.0 usb1: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 52:8a:3e:9b:56:bf [ 328.032458][ T7168] loop1: detected capacity change from 0 to 164 [ 328.453835][ T7173] rock: directory entry would overflow storage [ 328.460566][ T7173] rock: sig=0x4f50, size=4, remaining=3 [ 328.466355][ T7173] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 329.277279][ T7179] loop0: detected capacity change from 0 to 164 [ 330.580039][ T7186] rock: directory entry would overflow storage [ 330.586434][ T7186] rock: sig=0x4f50, size=4, remaining=3 [ 330.592102][ T7186] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 333.415307][ T7196] loop3: detected capacity change from 0 to 256 [ 334.634613][ T7208] loop3: detected capacity change from 0 to 512 [ 334.642136][ T7208] EXT4-fs: Ignoring removed nomblk_io_submit option [ 334.674556][ T7208] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 334.772769][ T7208] EXT4-fs (loop3): 1 truncate cleaned up [ 334.832494][ T7208] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 334.952332][ T7208] capability: warning: `syz.3.356' uses deprecated v2 capabilities in a way that may be insecure [ 335.024189][ T7208] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 358.855104][ T7317] loop3: detected capacity change from 0 to 4096 [ 362.145212][ T7331] overlayfs: missing 'lowerdir' [ 371.281479][ T7362] syzkaller0: entered promiscuous mode [ 371.297481][ T7362] syzkaller0: entered allmulticast mode [ 372.066300][ T7367] loop2: detected capacity change from 0 to 32768 [ 372.127799][ T7367] XFS (loop2): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 372.445375][ T7367] XFS (loop2): Ending clean mount [ 372.861057][ T7367] XFS (loop2): Quotacheck needed: Please wait. [ 372.984884][ T7367] XFS (loop2): Quotacheck: Done. [ 373.506129][ T27] audit: type=1800 audit(1790275947.168:4): pid=7386 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.395" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop2" ino=4429 res=0 errno=0 [ 374.448307][ T5776] XFS (loop2): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 375.733754][ T27] audit: type=1326 audit(1790275948.878:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7391 comm="syz.0.402" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f568b99e159 code=0x7ffc0000 [ 375.811411][ T27] audit: type=1326 audit(1790275948.878:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7391 comm="syz.0.402" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f568b99e159 code=0x7ffc0000 [ 377.645142][ T27] audit: type=1326 audit(1790275948.878:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7391 comm="syz.0.402" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f568b99e159 code=0x7ffc0000 [ 377.672561][ T27] audit: type=1326 audit(1790275948.878:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7391 comm="syz.0.402" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f568b99e159 code=0x7ffc0000 [ 377.713172][ T27] audit: type=1326 audit(1790275948.898:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7391 comm="syz.0.402" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f568b99e159 code=0x7ffc0000 [ 377.799216][ T27] audit: type=1326 audit(1790275948.898:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7391 comm="syz.0.402" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f568b99e159 code=0x7ffc0000 [ 377.892916][ T27] audit: type=1326 audit(1790275948.898:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7391 comm="syz.0.402" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f568b99e159 code=0x7ffc0000 [ 378.028952][ T27] audit: type=1326 audit(1790275948.898:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7391 comm="syz.0.402" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f568b99e159 code=0x7ffc0000 [ 378.088043][ T7400] block device autoloading is deprecated and will be removed. [ 378.114627][ T27] audit: type=1326 audit(1790275948.898:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7391 comm="syz.0.402" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f568b99e159 code=0x7ffc0000 [ 378.821896][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.828787][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 385.744414][ T7438] workqueue: Failed to create a rescuer kthread for wq "kdmflush/248:255": -EINTR [ 388.361334][ T7451] loop3: detected capacity change from 0 to 512 [ 388.526881][ T7024] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 393.153681][ T7473] loop3: detected capacity change from 0 to 8 [ 393.189996][ T7473] squashfs: Unknown parameter 't' [ 393.552057][ T7473] loop3: detected capacity change from 0 to 4096 [ 393.604572][ T7473] EXT4-fs: Ignoring removed mblk_io_submit option [ 393.650717][ T7473] EXT4-fs (loop3): Test dummy encryption mode enabled [ 393.715778][ T7481] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 394.141634][ T7473] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 394.434895][ T7473] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 395.176832][ T7488] tipc: Enabled bearer , priority 0 [ 395.225378][ T7488] tipc: Resetting bearer [ 395.388780][ T5774] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 395.404606][ T7487] tipc: Disabling bearer [ 402.324565][ T5818] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 402.539696][ T5818] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 0, changing to 4 [ 402.658706][ T5818] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 402.673519][ T5818] usb 4-1: config 0 interface 0 has no altsetting 0 [ 402.710138][ T5818] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 402.744651][ T5818] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 402.752917][ T5818] usb 4-1: Product: syz [ 402.784695][ T5818] usb 4-1: Manufacturer: syz [ 402.789581][ T5818] usb 4-1: SerialNumber: syz [ 402.805782][ T5818] usb 4-1: config 0 descriptor?? [ 402.835953][ T5818] usb 4-1: selecting invalid altsetting 0 [ 403.509536][ T7539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.520798][ T7539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.542223][ T5818] usb 4-1: USB disconnect, device number 5 [ 403.773382][ T7545] loop2: detected capacity change from 0 to 512 [ 403.832275][ T7545] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 403.904708][ T7545] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 404.137468][ T7545] EXT4-fs (loop2): 1 truncate cleaned up [ 404.189952][ T7545] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 405.140382][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 407.703093][ T7567] loop0: detected capacity change from 0 to 16 [ 407.766743][ T7568] netlink: 'syz.2.441': attribute type 10 has an invalid length. [ 407.792824][ T7567] erofs: (device loop0): mounted with root inode @ nid 36. [ 408.355496][ T7570] erofs: (device loop0): z_erofs_readahead: readahead error at folio 3 @ nid 89 [ 408.371804][ T7570] syz.0.440: attempt to access beyond end of device [ 408.371804][ T7570] loop0: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 408.557893][ T27] kauditd_printk_skb: 58 callbacks suppressed [ 408.557989][ T27] audit: type=1800 audit(1790275982.288:72): pid=7570 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.440" name="file2" dev="loop0" ino=89 res=0 errno=0 [ 409.614584][ T7574] Bluetooth: MGMT ver 1.22 [ 411.481453][ T7583] ipvlan2: entered allmulticast mode [ 411.487176][ T7583] macvlan1: entered allmulticast mode [ 411.492743][ T7583] veth1_vlan: entered allmulticast mode [ 411.505205][ T7583] batman_adv: batadv0: Adding interface: ipvlan2 [ 411.511939][ T7583] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 411.537817][ T7583] batman_adv: batadv0: Interface activated: ipvlan2 [ 412.975329][ T5787] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 412.983341][ T5787] Bluetooth: hci2: command 0x0406 tx timeout [ 415.069036][ T7609] netlink: 'syz.1.451': attribute type 10 has an invalid length. [ 415.452966][ T7612] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 419.021856][ T7629] No source specified [ 421.027594][ T7635] netlink: 'syz.2.461': attribute type 10 has an invalid length. [ 421.872890][ T7639] sctp: [Deprecated]: syz.0.459 (pid 7639) Use of struct sctp_assoc_value in delayed_ack socket option. [ 421.872890][ T7639] Use struct sctp_sack_info instead [ 427.264156][ T7671] netlink: 'syz.0.470': attribute type 10 has an invalid length. [ 429.244484][ T5764] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 429.441356][ T5764] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 145, changing to 7 [ 429.467457][ T5764] usb 4-1: New USB device found, idVendor=0763, idProduct=2001, bcdDevice= 0.40 [ 429.487077][ T5764] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.502521][ T5764] usb 4-1: Product: syz [ 429.535785][ T5764] usb 4-1: Manufacturer: syz [ 429.540498][ T5764] usb 4-1: SerialNumber: syz [ 432.658254][ T5764] usb 4-1: 1:1: invalid format type 0x1002 is detected, processed as PCM [ 432.739228][ T5764] usb 4-1: 1:1 : sample bitwidth 128 in over sample bytes 2 [ 432.774437][ T5764] usb 4-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 432.806321][ T5764] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 432.867508][ T5764] usb 4-1: USB disconnect, device number 6 [ 433.009265][ T7024] udevd[7024]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 434.428321][ T7693] netlink: 48 bytes leftover after parsing attributes in process `syz.3.476'. [ 434.685538][ T7693] netlink: 'syz.3.476': attribute type 11 has an invalid length. [ 435.793943][ T27] audit: type=1800 audit(1790276009.518:73): pid=7702 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.478" name="idProduct" dev="configfs" ino=15133 res=0 errno=0 [ 435.898862][ T27] audit: type=1800 audit(1790276009.548:74): pid=7702 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.478" name="max_speed" dev="configfs" ino=15134 res=0 errno=0 [ 436.554752][ T7716] loop0: detected capacity change from 0 to 128 [ 436.609133][ T7716] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 436.646821][ T7716] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 436.806165][ T27] audit: type=1800 audit(1790276010.518:75): pid=7716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.480" name="file1" dev="loop0" ino=94 res=0 errno=0 [ 437.376630][ T7720] netlink: 'syz.3.481': attribute type 10 has an invalid length. [ 437.565667][ T7725] syzkaller0: entered promiscuous mode [ 437.571221][ T7725] syzkaller0: entered allmulticast mode [ 437.608347][ T7725] tipc: Started in network mode [ 437.613346][ T7725] tipc: Node identity c69d005aa1b, cluster identity 4711 [ 437.642523][ T7725] tipc: Enabled bearer , priority 0 [ 437.684958][ T7725] tipc: Resetting bearer [ 437.693851][ T7724] tipc: Resetting bearer [ 437.732409][ T7724] tipc: Disabling bearer [ 438.274759][ T7731] netlink: 'syz.0.493': attribute type 10 has an invalid length. [ 438.384510][ T5787] Bluetooth: hci1: command 0x0406 tx timeout [ 440.422849][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.429785][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 447.955430][ T8] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 448.188083][ T8] usb 3-1: Using ep0 maxpacket: 32 [ 448.199038][ T8] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 448.217970][ T8] usb 3-1: config 0 has no interface number 0 [ 448.224189][ T8] usb 3-1: config 0 interface 12 has no altsetting 0 [ 448.261235][ T8] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 448.279244][ T8] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.301086][ T8] usb 3-1: Product: syz [ 448.318300][ T8] usb 3-1: Manufacturer: syz [ 448.323101][ T8] usb 3-1: SerialNumber: syz [ 448.356417][ T8] usb 3-1: config 0 descriptor?? [ 449.049315][ T7783] xt_policy: output policy not valid in PREROUTING and INPUT [ 449.364464][ T8] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 449.372242][ T8] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 449.395175][ T8] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 449.403039][ T8] f81534: probe of 3-1:0.12 failed with error -71 [ 449.432216][ T8] usb 3-1: USB disconnect, device number 4 [ 451.458463][ T7791] zram0: detected capacity change from 0 to 8 [ 470.268904][ T5787] Bluetooth: hci0: Invalid handle: 0x20c9 > 0x0eff [ 470.503503][ T7885] netlink: 'syz.3.521': attribute type 10 has an invalid length. [ 480.912353][ T7922] [ 480.914782][ T7922] ====================================================== [ 480.921825][ T7922] WARNING: possible circular locking dependency detected [ 480.928864][ T7922] syzkaller #0 Not tainted [ 480.933300][ T7922] ------------------------------------------------------ [ 480.940422][ T7922] syz.1.536/7922 is trying to acquire lock: [ 480.946337][ T7922] ffff88802f8780b8 (&hdev->lock){+.+.}-{3:3}, at: l2cap_chan_connect+0xfc/0xe30 [ 480.955613][ T7922] [ 480.955613][ T7922] but task is already holding lock: [ 480.963001][ T7922] ffffffff8e562248 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_open+0x95/0xec0 [ 480.971972][ T7922] [ 480.971972][ T7922] which lock already depends on the new lock. [ 480.971972][ T7922] [ 480.982404][ T7922] [ 480.982404][ T7922] the existing dependency chain (in reverse order) is: [ 480.991471][ T7922] [ 480.991471][ T7922] -> #2 (rfcomm_mutex){+.+.}-{3:3}: [ 480.998901][ T7922] __mutex_lock+0x135/0xc80 [ 481.004087][ T7922] rfcomm_security_cfm+0x41/0x550 [ 481.009678][ T7922] hci_encrypt_cfm+0x363/0x4d0 [ 481.015063][ T7922] hci_encrypt_change_evt+0x5c3/0xe30 [ 481.021036][ T7922] hci_event_packet+0x807/0x1280 [ 481.026544][ T7922] hci_rx_work+0x43a/0xd60 [ 481.031579][ T7922] process_scheduled_works+0xa60/0x1600 [ 481.037739][ T7922] worker_thread+0xa5e/0xfe0 [ 481.042894][ T7922] kthread+0x2fa/0x390 [ 481.047547][ T7922] ret_from_fork+0x48/0x80 [ 481.052554][ T7922] ret_from_fork_asm+0x11/0x20 [ 481.057908][ T7922] [ 481.057908][ T7922] -> #1 (hci_cb_list_lock){+.+.}-{3:3}: [ 481.065697][ T7922] __mutex_lock+0x135/0xc80 [ 481.070775][ T7922] hci_remote_features_evt+0x535/0x900 [ 481.076795][ T7922] hci_event_packet+0x807/0x1280 [ 481.082295][ T7922] hci_rx_work+0x43a/0xd60 [ 481.087281][ T7922] process_scheduled_works+0xa60/0x1600 [ 481.093397][ T7922] worker_thread+0xa5e/0xfe0 [ 481.098558][ T7922] kthread+0x2fa/0x390 [ 481.103215][ T7922] ret_from_fork+0x48/0x80 [ 481.108220][ T7922] ret_from_fork_asm+0x11/0x20 [ 481.113552][ T7922] [ 481.113552][ T7922] -> #0 (&hdev->lock){+.+.}-{3:3}: [ 481.120912][ T7922] __lock_acquire+0x37ef/0x7d80 [ 481.126392][ T7922] lock_acquire+0x19e/0x420 [ 481.131497][ T7922] __mutex_lock+0x135/0xc80 [ 481.136568][ T7922] l2cap_chan_connect+0xfc/0xe30 [ 481.142078][ T7922] l2cap_sock_connect+0x586/0x760 [ 481.147668][ T7922] kernel_connect+0x142/0x1c0 [ 481.152999][ T7922] rfcomm_dlc_open+0xa1f/0xec0 [ 481.158321][ T7922] rfcomm_sock_connect+0x2ed/0x600 [ 481.164125][ T7922] __sys_connect+0x3da/0x470 [ 481.169299][ T7922] __x64_sys_connect+0x7a/0x90 [ 481.174658][ T7922] do_syscall_64+0x55/0xb0 [ 481.179692][ T7922] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 481.186241][ T7922] [ 481.186241][ T7922] other info that might help us debug this: [ 481.186241][ T7922] [ 481.196534][ T7922] Chain exists of: [ 481.196534][ T7922] &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex [ 481.196534][ T7922] [ 481.209199][ T7922] Possible unsafe locking scenario: [ 481.209199][ T7922] [ 481.216678][ T7922] CPU0 CPU1 [ 481.222078][ T7922] ---- ---- [ 481.227476][ T7922] lock(rfcomm_mutex); [ 481.231699][ T7922] lock(hci_cb_list_lock); [ 481.238793][ T7922] lock(rfcomm_mutex); [ 481.245567][ T7922] lock(&hdev->lock); [ 481.249776][ T7922] [ 481.249776][ T7922] *** DEADLOCK *** [ 481.249776][ T7922] [ 481.257973][ T7922] 1 lock held by syz.1.536/7922: [ 481.262963][ T7922] #0: ffffffff8e562248 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_open+0x95/0xec0 [ 481.272357][ T7922] [ 481.272357][ T7922] stack backtrace: [ 481.278398][ T7922] CPU: 1 PID: 7922 Comm: syz.1.536 Not tainted syzkaller #0 [ 481.285738][ T7922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 481.295847][ T7922] Call Trace: [ 481.299241][ T7922] [ 481.302273][ T7922] dump_stack_lvl+0x18c/0x250 [ 481.307352][ T7922] ? load_image+0x420/0x420 [ 481.311991][ T7922] ? show_regs_print_info+0x20/0x20 [ 481.317247][ T7922] ? print_circular_bug+0x12b/0x1a0 [ 481.322489][ T7922] check_noncircular+0x2fc/0x400 [ 481.327476][ T7922] ? print_deadlock_bug+0x5d0/0x5d0 [ 481.332720][ T7922] ? lockdep_lock+0xf5/0x230 [ 481.337366][ T7922] ? _find_first_zero_bit+0xd6/0x100 [ 481.342737][ T7922] __lock_acquire+0x37ef/0x7d80 [ 481.347640][ T7922] ? is_bpf_text_address+0x28f/0x2a0 [ 481.353030][ T7922] ? verify_lock_unused+0x140/0x140 [ 481.358393][ T7922] ? __lock_acquire+0x1336/0x7d80 [ 481.363482][ T7922] ? verify_lock_unused+0x140/0x140 [ 481.368749][ T7922] lock_acquire+0x19e/0x420 [ 481.373303][ T7922] ? l2cap_chan_connect+0xfc/0xe30 [ 481.378462][ T7922] ? __might_sleep+0xe0/0xe0 [ 481.383623][ T7922] ? read_lock_is_recursive+0x20/0x20 [ 481.389054][ T7922] ? hci_get_route+0x3a5/0x4d0 [ 481.393859][ T7922] ? __lock_acquire+0x7d80/0x7d80 [ 481.398928][ T7922] __mutex_lock+0x135/0xc80 [ 481.403472][ T7922] ? l2cap_chan_connect+0xfc/0xe30 [ 481.408634][ T7922] ? do_raw_read_unlock+0x3d/0x80 [ 481.413724][ T7922] ? _raw_read_unlock+0x28/0x40 [ 481.418619][ T7922] ? hci_get_route+0x3a5/0x4d0 [ 481.423432][ T7922] ? l2cap_chan_connect+0xfc/0xe30 [ 481.428582][ T7922] ? mutex_lock_nested+0x20/0x20 [ 481.433565][ T7922] ? print_unlock_imbalance_bug+0x160/0x160 [ 481.439509][ T7922] ? mark_lock+0x94/0x320 [ 481.443897][ T7922] l2cap_chan_connect+0xfc/0xe30 [ 481.448877][ T7922] ? lock_chain_count+0x20/0x20 [ 481.453772][ T7922] ? l2cap_chan_le_send_credits+0x4e0/0x4e0 [ 481.459702][ T7922] ? __local_bh_enable_ip+0x13a/0x1c0 [ 481.465136][ T7922] ? _local_bh_enable+0xa0/0xa0 [ 481.470026][ T7922] ? bacmp+0xe/0x30 [ 481.473876][ T7922] l2cap_sock_connect+0x586/0x760 [ 481.478942][ T7922] ? l2cap_sock_bind+0x940/0x940 [ 481.483916][ T7922] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 481.489937][ T7922] ? __lock_acquire+0x7d80/0x7d80 [ 481.495022][ T7922] ? kernel_connect+0xf2/0x1c0 [ 481.499846][ T7922] kernel_connect+0x142/0x1c0 [ 481.504571][ T7922] ? kernel_accept+0x350/0x350 [ 481.509429][ T7922] ? rfcomm_dlc_open+0x9e3/0xec0 [ 481.514422][ T7922] rfcomm_dlc_open+0xa1f/0xec0 [ 481.519226][ T7922] ? rfcomm_sock_connect+0x2c6/0x600 [ 481.524560][ T7922] ? __local_bh_enable_ip+0x13a/0x1c0 [ 481.529995][ T7922] ? rfcomm_dlc_free+0x50/0x50 [ 481.534802][ T7922] ? __local_bh_enable_ip+0x13a/0x1c0 [ 481.540217][ T7922] ? _local_bh_enable+0xa0/0xa0 [ 481.545108][ T7922] ? do_raw_spin_unlock+0x121/0x230 [ 481.550358][ T7922] rfcomm_sock_connect+0x2ed/0x600 [ 481.555524][ T7922] __sys_connect+0x3da/0x470 [ 481.560178][ T7922] ? __sys_connect_file+0x170/0x170 [ 481.565431][ T7922] __x64_sys_connect+0x7a/0x90 [ 481.570242][ T7922] do_syscall_64+0x55/0xb0 [ 481.574705][ T7922] ? clear_bhb_loop+0x40/0x90 [ 481.579432][ T7922] ? clear_bhb_loop+0x40/0x90 [ 481.584167][ T7922] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 481.590111][ T7922] RIP: 0033:0x7fcf6d79e159 [ 481.594644][ T7922] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 481.614326][ T7922] RSP: 002b:00007fcf6e67e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 481.622777][ T7922] RAX: ffffffffffffffda RBX: 00007fcf6da25fa0 RCX: 00007fcf6d79e159 [ 481.630799][ T7922] RDX: 000000000000000a RSI: 0000200000000040 RDI: 0000000000000005 [ 481.638792][ T7922] RBP: 00007fcf6d83506b R08: 0000000000000000 R09: 0000000000000000 [ 481.646803][ T7922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 481.654802][ T7922] R13: 00007fcf6da26038 R14: 00007fcf6da25fa0 R15: 00007ffd47ac0fc8 [ 481.662820][ T7922] [ 482.495566][ T7926] loop1: detected capacity change from 0 to 512 [ 482.559791][ T7926] EXT4-fs: Ignoring removed i_version option [ 482.741815][ T7926] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 482.772304][ T7926] ext4 filesystem being mounted at /136/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 482.986608][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 484.424360][ T5787] Bluetooth: hci1: command 0x0406 tx timeout