last executing test programs: 27.171462746s ago: executing program 2 (id=587): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSBRK(r0, 0x5409, 0x0) 27.153867187s ago: executing program 2 (id=590): r0 = socket$inet(0x2, 0x2, 0x1) bind$inet(r0, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) r1 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f00000000c0), 0x4) bind$inet(r1, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) 27.075406102s ago: executing program 2 (id=593): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x195) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/bridge/bridge-nf-call-iptables\x00', 0x1, 0x0) write$cgroup_int(r0, &(0x7f0000000340)=0x10, 0x12) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000bc0)={0x5, 0x10, 0xfa00, {0x0}}, 0x18) 27.074980923s ago: executing program 2 (id=595): syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000003240)='./bus\x00', 0xe, &(0x7f0000000240)={[{@jqfmt_vfsold}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x4000}}]}, 0x43, 0x47a, &(0x7f00000028c0)="$eJzs28tvFdUfAPDvTF/0Bz97RXzwUKtobHy0FHyQ6EKJJi4wMdGF26YtBCnU0JoIIQrG4Mq4cW9057/gSjfGuDJxq3tDQgwbwNU1c+9M2/ukvdz2Fu7nkww9Z+YM53zvzLlzZs7cAPrWePZPErErIv6MiLFqtrbAePXPzesXZ29dvzibRLn83j9JpdyN6xdni6LFfjvzzEQakX6RxP4m9S6dv3B6ZmFh/lyen1o+89HU0vkLL5w6M3Ny/uT82cNHj754ZPqVlw+/1JU4szbd2Pfp4oG9byeD7xz/KluXFvHXxdEl4+02Pl0ud7m63vr/mnQy2MOGsCEDEZEdrqFK/x+LgVg9eGPx1uc9bRywqcrlcrlyva58AzS4VAbuYUnU5nV56BfFhT67/y2W+kHA65s7BOmpa29Ub4CyuG/mS3XLYKQxWkkN1d3fdtN4RHxw6d9vsyU25zkEAECNn7Lxz/PNxn9pPLSm3H353FApIu6PiN0R8UBE7ImIByMqZR+OiEfy8qPrrL9+kqRx/JNe7Ti4dcjGf6/lc1u147+0KFIaqORGKmPAUgwlJ04tzB/KP5OJGBrJ8tNt6vj5zT++brVt7fgvW7L6i7Fg3o6rgyO1+8zNLM9UUyMdx124djli32Cz+JOVmYAkIvZGxL4O6zj17A8HWm27ffxtdGGeqfxdxDPV438p6uIvJO3nJ6d2xML8oanirGj02+9X3m1V/x3F3wXXShH/a3r+r8RfStbO1y5tvI4rf33Z8p6m0/N/OHm/kh7O130ys7x8bjpiODlebfTa9YdX9y3yRfns/J842Lz/747VT2J/RGQn8aMR8VhEPJ63/YmIeDIiDraJ/9djT33YefybK4t/bkPHfzUxHPVrmicGTv/yY02lpYb4b7U5/iupifzv6vdfYaAhrvW0q7OzGQAAAO4+2d31rkjSyZV0mk5OVt+X3xORLiwuLT93YvHjs3PV3wiUItLiSdfYmueh0/ltfTV/OSKqrxYU24/kz42/GRit5CdnFxfmeh089LmdLfp/5u/Gx2rAvcbvtaB/te//O7asHcDWu931/7Mtagew9TY6/v/+1SJ1bL3veQLbVJP+r19DXxhpev035of+UNf/TftBH6nr/x74Qx/pfP5/uKvtALae93+gLy2Nxu1/JN82UfxPHe5+zyZiqNWm4W3Swjs87um2aMa2TQzd5f2id99JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3fRfAAAA//8Nkdx1") mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f0000000240)='./file0/file1\x00', &(0x7f0000000280), 0x0, 0x0, 0x0) 26.98218299s ago: executing program 2 (id=601): syz_mount_image$ext4(&(0x7f0000000340)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000500)={[{@test_dummy_encryption}, {@nogrpid}]}, 0xfd, 0x4b2, &(0x7f0000000e40)="$eJzs3M1rHOUfAPDvbDZJ35Nff/WltdpoFYsvSZNWLShUBcGDgqCHepKYpKU2baSJ0JZgo5R6EbTgXQQvon+BJ0+ingSvepdC0VxaPa1MZma7SXe3ed+8fD4w2Xl2npnn+c4zL8/M7CSATasn/ZNE7IiI3yOiKyJKtRm2ZkOa79b05NA/05NDSVQqb/6VpLPFzenJoSJrkn9uzxLldEGlK0m8WKfc8YuXzgyOjo6cz9N9E2ff7xu/eOnp02cHT42cGjk3cOzY0SP9zz078MyyxJnW6ea+D8f273317WuvD5249u7P3yUR24rptXEs0fNd1dHJ6jqZ67FlKmyt2FkznpRbWBEWpDMi0uZqn9n/u6Ltyq7qtK545eOWVg5YUZVKpTLQePJUBdjAkljMXG35sQNYv4oTfXr9Wwyr1PVYE268lF0ApXHfyodsSjm7D9KZXRvtXKHyeyLixNS/X6ZDLPg+RPsK1QoA2Mh+SPs/T9Xp/5Uj7s2y/H08Inblz4a6I+J/EbE7Iv4fEXsi4p7I8t4XEffXL6bnnQbl98xJ39n/KV1faozNpP2/F/JnW7P7f9WnYN1teWrnTPztycnToyOH83VyKNo703R/3aUnEVPp52+fNSq/tv+XDmn5RV8wr8f1cufseYYHJwaXHHjuxkcR+8r14k+ifDuK2BsR+xZZxuknvtk/+5u26tjd429iGZ4zVb6KeDxr/6mYE38haf58sm9LjI4c7iu2iojpOWX88uvVNxqVn8Vfiubxb116oA2k7b+t3vZ/vBp/d1L7vHb8jkV03K2Mq3980vCaZrHbf0fy1qzCLwxOTJzvj+hIXrvz+5ob3EX6wvC3M/nT+A8drL//787nSeN/ICLSjfjBiHgoIg7kdX84Ih6JiINN4v/p5Uffaxj/gflv/1PZx7I+XU3jH657/GvU/gsY2ZIv4cyP3zeMv2j/osHqtv/RIjFTqfkc/+Zb08WsMwAAAFhvShGxI5JSb3W8VOrtzX4vvye2lUbHxieePDn2wbnh7B2B7mgvFXe6umruh/bn94aL9ECevpynj+T3jb9o2zqT7h0aGx1udfCwyW1vsP+n/mxrde2AFVee+5papatVVQFWmfc1YfNa/P7vyAHr3V324tJq1QNYfc7isHnV2/8v1yaSyH4lD2w4zv+weVX3/8/nkbnmda+5L28C60+z87+fAsDGpv8Pm9Ki3utfSyPxdUTzPMlaqeqCRj5dyuzllapY5+1votTC9dPRkkYZaIto4SZRnu9/tYiLlctLLrTVRyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDl8V8AAAD//3Y422k=") fsmount(0xffffffffffffffff, 0x0, 0x82) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket(0x2, 0x2, 0x1) bind$unix(r0, &(0x7f0000000000)=@abs, 0x6e) 26.735101264s ago: executing program 2 (id=616): timer_create(0x0, 0x0, &(0x7f0000000300)) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_1\x00', 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x810) 26.674966498s ago: executing program 32 (id=616): timer_create(0x0, 0x0, &(0x7f0000000300)) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_1\x00', 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x810) 12.075459792s ago: executing program 4 (id=891): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000007, 0x40032, 0xffffffffffffffff, 0x40000000) write$cgroup_subtree(r1, &(0x7f0000000380)=ANY=[@ANYRES64=r1, @ANYRESOCT=r1, @ANYBLOB], 0x31) listns(0x0, &(0x7f0000000040), 0x0, 0x0) mmap(&(0x7f00007b6000/0x2000)=nil, 0x2000, 0x0, 0x12, r1, 0x17837000) sendmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0xc8844) 11.761851067s ago: executing program 5 (id=897): socket(0x40000000015, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8169, 0x2000, 0x800, 0x0, 0x2}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bind$xdp(r0, &(0x7f00000003c0)={0x2c, 0x2, 0x0, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="20000000100027042abd"], 0x20}, 0x1, 0x0, 0x0, 0x4080}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0x4, 0x8, 0xfe, 0xfffffffe, 0x80000000, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x7, 0x9, 0xffff2d36, 0x101, 0x4, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xfeffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c70, 0x80000000, 0x242, 0x8, 0xe, 0x4, 0x80008071, 0xffffb8f3, 0x17, 0x6, 0x7, 0x5, 0x3e, 0x8f, 0x8, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x114, 0x9, 0x4, 0x4, 0x0, 0xfffffffa], [0x1000, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0x46, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x0, 0x7, 0xc2bf, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c7, 0xd, 0x4, 0x0, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x389, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c9368d, 0x80, 0x3], [0x4, 0xc08, 0x4, 0x5, 0xfffffffd, 0xd, 0x31b, 0x9, 0x5, 0x7fff, 0x9, 0x6, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xe, 0x5, 0x0, 0x2, 0xda6, 0xc, 0x4, 0x6d01, 0x2, 0x38, 0x800003, 0x200, 0x80, 0x7, 0x4, 0x2950bfb1, 0x1000, 0x400000a2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0x80, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x80, 0x938, 0x3, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x9, 0x3, 0x0, 0x10000, 0x104, 0x37f3, 0xffff, 0xa622, 0x1, 0x5, 0x1, 0xffffffff, 0x14f, 0x4, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x4, 0x4, 0x4c7, 0x1, 0xfffff000, 0x7, 0x5, 0x7e, 0x100, 0x3173, 0x40000047, 0xb2, 0x8, 0x6, 0x10, 0x5, 0x5, 0x8, 0x30b1d693, 0x4008a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0x0, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd) 11.695356228s ago: executing program 4 (id=898): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f00000000c0)={0x1, 0x1, 0x10, "d3621ff7573ed717492abb5fd104af555bde5025141d9788aa8f268e9b9ff462", 0x56544943}) 11.664766737s ago: executing program 5 (id=900): socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='file net/sctp/* +p', 0x12) syz_open_dev$vim2m(0x0, 0x400000000000003, 0x2) pipe2$9p(0x0, 0x80) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x714) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x20, 0x17, &(0x7f0000000100)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8800}, 0x260000d0) 11.479339879s ago: executing program 5 (id=904): mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./dev\x00', 0x1ff) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/console\x00', 0x1, 0x0) ioctl$USBDEVFS_GET_SPEED(r1, 0x545c) open_tree(0xffffffffffffff9c, 0x0, 0x89901) 10.609135508s ago: executing program 3 (id=909): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000000)=0x1, 0x4) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) mount(0x0, &(0x7f0000000100)='sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='sys/class/net/bridge_slave_0/brport/multicast_to_unicast\x00', 0x1, 0x0) write(r5, &(0x7f0000000200)='1', 0x1) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000054000106010000000000000007000000", @ANYRES32=r3, @ANYBLOB="20000100", @ANYRES32=r4, @ANYBLOB="0100000001005e01010100"/24], 0x38}}, 0x0) sendto$packet(r2, &(0x7f0000000500)="01005e0101010011223344558888aabbccdd", 0x12, 0x0, &(0x7f0000000600)={0x11, 0x8888, r3, 0x1, 0x0, 0x6, @random}, 0x14) ioctl$OCFS2_IOC_RESVSP64(r1, 0x4030582a, &(0x7f0000000000)={0x1, 0x2, 0x4, 0x7, 0xdaf3, 0x7fffffff}) 10.499095179s ago: executing program 3 (id=912): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xb}, {}, {0xfff2, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}, @TCA_CHAIN={0x8, 0xb, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r9, {0xf000, 0xffff}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) 10.480168496s ago: executing program 0 (id=913): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x11, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x6, &(0x7f0000000600)=@raw=[@map_fd={0x18, 0x1, 0x1, 0x0, r3}, @generic={0xb7, 0x2}, @generic={0xb7, 0x3}, @generic={0x85, 0x0, 0x0, 0x0, 0x33}, @generic={0x95}], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 8.21898573s ago: executing program 5 (id=915): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000001140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3000000000080002400000000350000000120a01010000000000000000020000000900010073797a3000000000070002006f303000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323900080003400000000720000480060001000002000005000200110000000c000300080001000000001e14000000110001"], 0xcd0}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000002200)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002000)=ANY=[@ANYBLOB="28000000130a0103000000000000000002000000"], 0x28}}, 0x0) 7.003283565s ago: executing program 0 (id=917): syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) write(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SCHED_CORE(0x4d, 0x8, 0x0, 0x0, 0x0) 6.956623118s ago: executing program 3 (id=918): socket$packet(0x11, 0x3, 0x300) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x5005}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xfff1, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x2, 0x0, 0x10000000}, @empty, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="03030800030016000c004557005c006700000611"], 0x66) 6.575528371s ago: executing program 4 (id=919): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x280000000, 0x4000000000089}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffd000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) setns(0xc9, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xe, '\x00', 0x0, @cgroup_sock_addr=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x94) 6.545483485s ago: executing program 3 (id=920): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x10b442, 0x79) openat(0xffffffffffffff9c, 0x0, 0x42, 0xe) lsm_set_self_attr(0x64, 0x0, 0x0, 0x0) 4.562994575s ago: executing program 1 (id=922): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000540)={@rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4400046, r2}) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r5, 0x400448dc, 0x0) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000540)={@empty, @rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@ipv6_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc8, 0x9}}, 0x1c}}, 0x0) pread64(0xffffffffffffffff, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) 4.54186316s ago: executing program 1 (id=923): socket(0x40000000015, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8169, 0x2000, 0x800, 0x0, 0x2}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth0_virt_wifi\x00'}) bind$xdp(r0, 0x0, 0x0) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="20000000100027042abd"], 0x20}, 0x1, 0x0, 0x0, 0x4080}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0x4, 0x8, 0xfe, 0xfffffffe, 0x80000000, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x7, 0x9, 0xffff2d36, 0x101, 0x4, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xfeffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c70, 0x80000000, 0x242, 0x8, 0xe, 0x4, 0x80008071, 0xffffb8f3, 0x17, 0x6, 0x7, 0x5, 0x3e, 0x8f, 0x8, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x114, 0x9, 0x4, 0x4, 0x0, 0xfffffffa], [0x1000, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0x46, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x0, 0x7, 0xc2bf, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c7, 0xd, 0x4, 0x0, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x389, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c9368d, 0x80, 0x3], [0x4, 0xc08, 0x4, 0x5, 0xfffffffd, 0xd, 0x31b, 0x9, 0x5, 0x7fff, 0x9, 0x6, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xe, 0x5, 0x0, 0x2, 0xda6, 0xc, 0x4, 0x6d01, 0x2, 0x38, 0x800003, 0x200, 0x80, 0x7, 0x4, 0x2950bfb1, 0x1000, 0x400000a2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0x80, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x80, 0x938, 0x3, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x9, 0x3, 0x0, 0x10000, 0x104, 0x37f3, 0xffff, 0xa622, 0x1, 0x5, 0x1, 0xffffffff, 0x14f, 0x4, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x4, 0x4, 0x4c7, 0x1, 0xfffff000, 0x7, 0x5, 0x7e, 0x100, 0x3173, 0x40000047, 0xb2, 0x8, 0x6, 0x10, 0x5, 0x5, 0x8, 0x30b1d693, 0x4008a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0x0, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd) 3.566183356s ago: executing program 1 (id=924): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0x8}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff44, 0x3, 0x2, 0x8, 0x3, 0x6, 0xffffffc0, 0xb, 0x688, 0xffff, 0x0, 0x2, 0xfffffeff, 0x0, 0xb, 0x5, 0x0, 0x5, 0xffffadc0, 0x8001, 0xf, 0x1, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x1, 0x80, 0xffff, 0x1, 0x7, 0x0, 0x400, 0xe5, 0x93, 0x2, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x59, 0x3, 0x80, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x2, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x10, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xecc, 0x6, 0x4, 0x8, 0x3fc, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x0, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0xbdb, 0x1, 0x8, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x6, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0x5, 0x4, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0xff, 0x4, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x6, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x1, 0x98de, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x800, 0xfffffffb, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x11d, 0x7fff, 0xf, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020000, 0x0, 0x0, 0x7f, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0x4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000000, 0x2, 0x7, 0x4, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x14, 0x80, 0x1ff, 0x1109, 0x9, 0x1, 0x0, 0x2, 0x0, 0x8, 0x3, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) 3.271260572s ago: executing program 4 (id=925): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x200, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_LIMIT={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x1c1100, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e105000000890600001144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 3.270877336s ago: executing program 0 (id=926): syz_mount_image$fuse(0x0, 0x0, 0x210a055, 0x0, 0x0, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x404, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000008200)={0x2020}, 0x2020) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/console\x00', 0x1, 0x0) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0xffffffffffffffda, 0x0, {0x7, 0x2d, 0x7, 0x10c4404, 0x2, 0x6, 0x7, 0x6, 0x0, 0x0, 0x4}}, 0xff18) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000006200)="0e24ac7705237246fc1db898fda0c7f95d375ea7f4bc7a07517a51095880f2219d9e4329f6c4e734f2bb34564a1c2e298d7eb8844d8af7b30e1a71750a2511e44b368fc6e9ae65e40e64e4b5fd3d0f87009b5727519df1ddbcbb38ef00871f00ed2543b7f2990a44482bf3d7478c3c2799dd8120fc3258cfeccf648fe15128c54d1d4272bfd44950915afd3aa0abb5b04d4dbec287df0816c3e43c2503cac6e95041aa205c5958f51a9c4c8214ae2108401b08ae7ff8440988c93424422f06c628077d767432521fefa0f8d0f387e685e4af54bdd7f931c3eace52ca7a6ba2d0fd701e5d77393e6268f52e68d97087f87edd2ae49180028bf08ab7e02c3ef12aec2f286d1bf40fd3a5f337b0f0b63d701c60bae36a5e1644bc90f34165049ac5c4fc8a0ada90e345df1420a58c92cfcc6973d3fa532b8b4088592e0f2c36f7e756139b272fc99104a93c5cf2599c683b60910af98a55b17bf646ddddb13e73d0bfdcfb3e3d261d84f83270832708f6e5b3fd2bb98e135b914e21681b409d717afa8f65dc9d3ab6a78b9b026b6aa1f1ee5872426b4bd4fd652072f86dfb96ef79649396a0f19239b0ce6ba9a8ff49f8f4820579a3169fe54b6f060a69236d57a1a13f033054fb22dbfb3f72861acc7ed51ebed60a8a03c3e16030e7a114d0690c268713d8206b34a005fb89d5123103d36ab57594fc731e8a6353ab3be3af22faa6f85b54ba78b90aba30e17dad90c31a20cc5f39c8ff50097bb310535efd6ecbc49dfc2d547bee78d5c5ebfe0d4bd3c093413e12cfefbfdb5f38c437ce831b209f3337979f6e0c46d8bf272a3ac6076c7940f905536167d2285d2a7d0e75f1765f0c080f1dfd9bae98afdfda7e7837d1081d83effab72e6eff493cc9031a299383f726227d75474e4c8378b2376fc7fef8b213b26794edc4c2fc110d917b863d25e7382b19b1b90cc90428f6aa0b1df015bcbbe83de36ff56c065ba92f1f49e61ac6bc6b3c20e42e7763dd52f66095f07e235f0062accb0eab60ce54d84391cbf2613096ded353543b5d6a884cc981b759e4499ab72881f88542208c9fd81b541514d6d2ed54683926b0d6bfe904b76215aea6db4cff8242d3ee5524acb456ec219e42d46c1b1e3fa9748404db4583537b195ad326853ed9472790656ab01bd031b19fb64b0e5227d18ea09ea7557c9afdc918c918a1fafdd18f9f54682bf0f49ba2ae14f963340dc6600e1b344ce50ed61af0726e3441583f8cf045df193dfbce93285d7fddfc0d831fefc85cd3e7920757f27a4e09b5cfa77b93a5e82f571d1293d9437cf89997011eee6ba9f9b7e6ce2fe1c381cb2db053a6e2d9351edbddcc10faf80f5b686727dd8982b12604fde3467f4a7e98b13250df7e1eef67da8f7fe3fffd3a185457aaaecb38f5ca31ea3e35cc7c6adc3873c734cb661e3c43e64bf0843b2cf1d950642eeb20d698cc9e598eb7ec71d3a0d83f311afa2d40a659a219defad76fdb7e8146756ff02a8a74abf8a8ccd72ffd7f70911698d54552aada8ef27b3f5b2644d4d0fda2976d838686a7469b296a98b67b7cc9834dc94f2292581dd242d1abb42db30d4de42c4611c0fbdc77134a6cb0c0d7b36d18a217aaabd34744ed5cac171e2a8bfe90b2dad03d0ca5f74d3eb95c454757be4c77f386c63fee91e95a508d8fcea5cd6bef9bd05e0b992da4e4cbc2f52c9cfde09b6f17f3d73fffc01d7ac55f328061516cf0e4fa50fff5b03dca67b163a68d9ddbb988f50a68fdbfc6e6feb6c892b58eb766d3429396669228dd1653bcbb5cb47c0857d27660e62d23e90178ef2b75713c2c58a207d8c21e9ce64556bfd71b40207ee76416f9f40c5601173b1d84105ac331247c021941a6a27e86de4f9a4db382f67dd6dc8e86a02a8438ddda1a636256fcac8e2328aaa3c054ab86f55c9d7bb2c2999a5c7933f092a3bf66523cb388052c65d138346ad1c5137fa383d7b9023b1868af02cf48923289162544db8fb29cf592c306a76ec92b35f33fae90f5aeac830b82dcc3f0069f668aebe6e5fe13c811f150de080632e357221d2f220ef95ce436730d1f9390d9f192220347d04ac5a94631e349ad330276b9524f775f7a8f68be7823ad7ed3ac4b4d87a12c0261846ec1dfe785b60675968e79496d7ae4e5d478661bd7125f2cc0de35422764556b63d687b339e2b25ad43ca85bc861944d19f9689dffe71d87030d23e0428942441d622de361778cbe8952f7b93c74783552b0087bff535afaf92935aa889018e46d34b2a258f863d89e4b6da841389fa63d489d135e559b7d11b8d97215323548501c275248eb07916ae3f0814c6af32f5ece7eb0330bdaac4394c518f3c8e48cafc36057cfa7788fb2f9a73bddb1d40546cf21b681e6c9ef6f0ac43c512762323209b2c878ed5a9f55e207b56a33c863eaa34a6eb14ad8de9885d52a7c073a406ea4324f8433ddfd89b269d6716072627054197928370ae01a94e3dd4d07125560a5cb1d1bfbbd8c099194de5f787a550a3400ce796e115702255d1f17d96a7fb63384ff497cf72beeb50bd24008ffc58256aec6b2faff2c20336e29bc1acd853214496893af25e8efb571c96edf64fbcd136c95e1213e73bc3f1a896fca2bde0894449ee2927c38114de5f1063d0c203c3fab1389861c4cda173a991eb275ccffe04f75d67ff181c26777b18e5552b42fb4332046554109a9a6007592a62d2553dbd098f1daae593322e45f66a64bdb09869feede70d1fcc88fd4c19f4008d1b1d5f34a6025a71d9bf6ff20daccda25cbcc662cfc687ffe5ebc344468f338f4c9bbdc7ed9820feb5e3b09ace47f4253a81da7029816656613aef7456524fc68f4345bc0e7f26240d4594374d2fcb39560e2828e0e219b2417f5787add73418b465b1308d5ac5169791f55802d11354eb62940a492d955e8bd11b952a28acea90cb43af774e6fc75e57383e68937aa3643aa37f7e7665c703576579dcccf63d2bdadfbf14be796d4023689880453b0ff576fb01bb141be3c17478f0d555ca96ff7c3f3e4f53be1f088827203fab2008ec6687e4f5df305f58fe647b93ad09a70165c989498d313ca5ba05f3ce90adc80d55b56d0ec4cd5a78268cc6def7e8bb810bc29f8e742487048363815fa3fe645194ee8529ffba2b8d6756915530f142b42f31eae1703faeae14f3d81ae5c2297c3476b0f89b32f53802453fc74c80bf217097577a910a51860bbead4f73a29423816eadca7b1e2d24a9895949b352fe59f13abfa7b69c0f0061eaae2ada6d72b2f90c9c553ad8be9ee4e4ad2876851a3f3e979c4d770d7df9a27e72ab215ec3efd252d622e7ec6160ac951d1ee9b8c0adc0fc853f2a4f36602c955b61646246e07bd7b745f5d3e99f95f55a1616ed36633db6efa97a96dacf12219cf1555222cc6a589a6def5680124f7ac2f1ec83832a30fd011ff02dbf4ab01afb5989fcc678383f179b5d647cf0a762acf0714e9e4151afa39626884e6f56859d3aafc9fc7f7bbcfb27e038e238783cf56c86f0be52568c4bed0917d651f4d26f76ba6c343e075146504590da391e1c4d028dc81767294df5de9370d62756584baa3bfa31578b6f754e77b0d6ea7357d8915ff0bda182b604b014ecf7dc94ab97061765bfab2053fa863fb671fad3b6312d6e59ba0e70b0ea2476399e925f8fa2e51c9bbfac19aeb11db3dd6ea8d916c4d4eae7de17259e6155591be9b704d3e24cda131eded5e9dd6758dc90a5c7a43332957d26ac91bc65120b1c6b7b94fdf83b397bd8990747f01d3ed912abeab74bb5ae3ff2ee0009cfe8cdb6b4e75a7de3566c8ff7bdddb06b7775cf3116b029e7c85fb7189147e753d614caa490594ff2e22b7144153c635ac7b20a49c2d8575af2f546b968bea9fc4ee5ff417a6fa86ca09c8fed14ea4b721b2d5870d4b670761c70516daa07809ac3817246844f01eadda045c57d1c864cbaabedf90cb42d374392e77b3d1a1afdf962feb55a4e04a77c8fb452429007e0046a406a5f2325f0c7f75a19deed1b456ac5de6486eebbc126ff97c5ee8531a975676b61a0d79f56ff75cbcd20337119422815537a57766648777f1b5f75d358dc63764083406e2d95afd87d00099581940367ed029065df0d9008301fb92e019feac9bb406032167eb053ab07309385771aacc2c52a5d526d14721fd530e63cb7c53f27518c679ccd0f3d2db8aa52ef95c6ac3f5dac0b9b5c3a96a794690f3d49aa0e5a4a95b36609cf61d471cc2c0cd55e8cd96be47558b055280313b15907eba5761180f5229a59341faa1e11eb5b6a48ec9320efb1d9f00936d9a5d91f2bf837fe72edf6ec025c1c4e87171cc02c7342fa5d4f825157d70d8f66f6fa0542de2255373d8743612e7d4e16b8ceebf4e92c40926f21929cab343b981120236b8b0b900772a33bbe4eef06feff3c7b104cf63d92c7f9233982f9b713489fb8bf80f2feffd6c22007b63925209e158a837dc95b42d52ed764350b5f83ad54041bc15a7552c0b8c1933d674a16b0c0934277d9895c1ad01327231a7fffc4b5e1a1495489559bebff324d54f2894563a23b85d3bef62c356eb476e01e0c039287ca38626751f701ef4e20d951433940ce1138660589ff389dee9f85a7faebb9cc494bbe7138b413303af6e05806032d8131d5a25a5d7c0ed87906d92bdd87ce7d62c13989f3435ad77a29b721d8219d2cf530c2ec9edc3de9ce2dcd5053c38a6797de8d8cbd3596ed545d2dc6f825a0e65428dd73df96d5f3e40dbe5a62f0f440f712419d1558ef97bf1d0ca1d59fa1caf6ed0d422456848e196e94b4741b757935bc3aef3a46f53066dc7a74f42d539da2228fb8593ddb79ac977a8b67c0a6058efdbe23ba75fb2faf5b9f152e60b8a96ee19fbf0c417c89f882c53d389bf27a18b9e34b2a33aa27029cfed7a03335cf33d95ea803ad125237a9cc70520f18bc7e9f0c1432368a5304544f5d1e1599242bcd905f69f25cd0fcde391960fc57426e0bf22155ea315f0caee330bf3b7f4f4363f87146531175ad4f69002d46e95a48f714c9bbd9e39b95783406d477dabe03397d68e7af5ee623b4c05eb64120ca76af4f1d37348f93f39d8fa1d22fef874ce65b66f8a1aaff9db97520dab97eb8d1f99efef4d4c9704d181d687874ec4fbb400ed4ce050ac997c843e647bebeddc33eeb70201b3286ea25ad1bdb80dba1fc78a6883ecca84d17645be16bee32967bd487c6f5e0714ca819d5913436ac9aeeab4e5092ec1897dad39737365e8414246a81a731bf7d3ad8d789b42c651702b70ee786032356e3b9fc4402104ffbe55026c84e8ec5dd2a1860cefd0e7789ac2a47fa5ee9610dee980fa3c2fa7219b4e57642f31012b3e00e64285fda219fa9ca37955e3c25fd5872172ed2f5651d208897ed4e1d224243b2f241f24580e924e02cb60af5e14898028596400a770f94e67590df5fe99e9d170d061397f71f4202eca4c91c7fc27e2379358a8d9bfc28c2fb67842b0bd1e5e68e017b34084aa08e7453fc6b03bd42772643eae036f25f10e4da022818dc84f35eea2c07e4dbb41e861b8a4c6df4f0b4b785f0df55f863707a0563cdd5b9fcaa352b54071cd486cf4948575ddbe4654a566438922887a3bd304853a98283c7a4d7757cc6e8298b0121aca5fdb64d86996d8c0ddfa1ee4ccef1ee21dcf853bdb02471383f73ddae17dfef217c6a3f79b182fc36bdb47d1899e87bb4c4e490ad4a2724d223b31b889685355f349ca8bc62d39150ebccaba863bd72bf91d65cffe560eecf162b2440f9d74fe0fb3f8479fd8f6293f16e4d67b3ec30e83180444cec51d2b455a3ab2b6286d4fac1acba8b7b5026671fef497d5e050e0aa34dcecf2d06a9e4b60cdb3f9cbb7cadd73c817f255f8e2eb22d6283a7934e0fd64eaf52caab2d1862baf505889e4db1a1870f0049b3ada06d38af52535da352bedbf1e88e34595820cedd4559cbe0fe0578c557a62f56060d75c5a6806e384d3c274c218d57beecbd8e7832f3cc050668b44c1b8ff8cdcd2b85b5ecb9eca1dcc1204d27bc3689578eab43dac5658a1cfe75456b221c15ed26720a49829f96d501fda6d7839724207d6a5f6bb3d8390e90dd7c6b80e15e6b20b7c74ff3282c770eb1c77583fc97bdb5f2df62a74b3385e2e8ba06fc39730f1f02107477c215deb6c8599cdacc7c710b7b1a77afbe3b2a593f6eec5c8014dd366f5890a1a579e51d858cc8ef93aff098af9903b4e3633a3090a630e64be99f49d32d63d779f989d0198044717741d3bfab4242a05dae33f11ed6b1d850fb379f725fdb7b296d9d9b3024160d4fd735a77c8ab23f0816bfc2715a2561c3cee6e41cf79030c1500c09e75ebbd5a7aa8a0e4826542ad46a9350e969b357c142af13afdd8927cdce3d1f35493f6a7a14c5a20739d462d566fe3ab620f1ef323768bd871eb454dad947f2a871efa05d601cf9fb08d992caf6f4b0f652e13df7dfc658f50e0c9bfc3bf28114a51142f65e25435a32c8719fde2a3d5c4850e31ffa675fa44f9e54957d108e46a67a3b7d71b272ecb0385466e39238f6421b2fd6f33a258883a4501b63001ee9ecb9137162488051f7ff15e6f4be81ca31ffac70f48bcd3457fcb137a2f5108d908ba1d51b0fca7e14273b176af4b954837dc3d40b4341fd03063ee145dfc4456bb303bb0540db3aadb26240242f4a55cb9f6623b6e724e0f9d8b73d02c9fd9140873c0bb884e3cf4c844bad6f27388b56840b63d65ca760dbddf778e430e1f03c246e74e9b56a08a56617658f7fc42e3582f3181a720e51598d22062815ca3caebf36389a58278acc788035d8deb0b800180ef6537d92bfa18947cb18232bfd27e048fcd49d44c137f1d8a10294a6dd20251a00c379bb0936fcb5137c9f5a7a7404976c778912a37f1503deb27b85d3b1d886415a98348d3632c7eb4bf58fdfddd5b24407709474e4478c991a03ed8b456d9a71ec82f05791eb17425e0360493fb5ec343eba7e9c970f47f4cd85edda849cc524d42a11eaf29be950e6200d12e16e3a304516ce5c74a2b47a1baf1f3321b84318883bb023cb5f67dc3541a4d72ebb3316244f96cde4aebc1a77336a93d226c315ab02581123140e45373f40c8cfc7fb5d478607f9b38c2b95bcd55fb8a2047569ac7927b9e4208f75032abfe83442d2ca5db1ee8903888548b5fa9724520083052f8e652f1b0d39d031d2c61f63e5cfb98061b5b913dc6da26e690c85b07fa19b9bf83d124a5fcf96de21d9f00c9aaf2ec66580e4dd99c21c01b7557b7c6336cec525003157d3efdd16a52407b35225f65e44933d56c90dbeeffcfbe2b10bdd921a507592817043c88bab1882ac8863f8a73fed3310138ae56c9b5fb8aa22d5d6ab9e5ece2afb94c5054bdc8444b00a46d74716c21346f2dce31f180f3e01453d7a7aaf4200c4be278a2a88fbec4529a551189da822d1365c8ac70bd6c6cb3c3791e183eeba95e65f1f87c10b2f740bee2575807c486e3b7939f093d44693ac069089830afff26d7165712abb7ba5bf8aaa87a3d57c5670b3a45d707b87aa7689b18292d851cac59802b38bd7ab8e1c3b8a134db1a366aaa8f77a6e2c937f49961637d291970b4541e3405948ba2ef49b40f600e28861c54f06a2400f82ffb2b9a0d4c6da720f9fea31dbe3f42aa29bd126fcbfccb9d809c8bbd76d241fc2588963f10434b69e9415d20bea13c30a08b22f5f21bd945a11466d228848b7b68927725239142fc536f784b705d3bd318f5d5fce31ddd32eca57309b1f9e5cdb0164df0bc45d04db323ed272fef5e4e0554cbe0eef83999d6dd82b67a5de6986b7063851602f833a23946ffb004b9cb30f6af2108e2aee029aa3e4fd525597f4a8d0184750731821bf21aaf703753270d3f12d5ed5f7bdb47c891074a44c63bebe47c66aab7f24e422b5f549249f26cab0aac9484087871de53cdb6d575e0e7ea3c73de23460c5b1bbe1e838433de48ecc812c1e21861dc290f22733090b5d3f88910478bff51307e6d869b68a745255ca007b9f5dda63074845d4d8f03604ada7cb5f8c1bcad9f3a84bab71e6c109ef7bd8eb29ba18011430f28eee91aa83749594aa5c717c0d53e0ff68372284e356e55f9cf33716ade1e148beda327236f4005472600f99a1c2fbe10c5492d2e082d15fa962492b16029a222bce55a001b2726fad239160f3ed55e98343fa5266cd7f5e36158480430e2f802fbfa3aa6e7299ab0940eea91682c79fffb171a705a23b70173f0973ca0b0ea230b306418677be4e6bcca0e6cc7bdbf6a3a96090819d541f505402ce505b40bd7d012ffb6a62f2528c5d370b2d6d6cf4b49c6886d20a5cc94cbe5e7cdf012af5d27c0c89c190956d1aaf1911888b33f67341fe74a10cba3328b84e3c4b83bb8b25da32122ed8df7b831e77bf9528af4b0960a0abb420e931eead4dcf31849cafc6099e8a3053758200bdbb411346662442e8274bc9780fd69abb4ef9ddd292f791b846a5849610862453cdb9263ddc232492de5d24c2c52751223cb961bb9ba7c86988b2a5490c3540ada6ffb9ba287c3e15d228aa0a6491ceced135cb1533b31c0b8ca218ffe4e1a07f29b4557a05b447358350ebfdcff9793b2eb1d7e0ea082b1f4fde8207071a8beb8c1e5efc49e1153fb8fb21ebc46c4d5b404a743a54076e4987da1748a39c70c083960873ffa0b88d4cccae69cdf4630a78250db81141e216e2007b7aea7500ad3176ae8e22c5fce5f14f0aa581bbe520a6d6c5f504547b178e62236f54809dd43763107e49b0d44a7968dcdf73a8c3c395fecd8a557ab850bebf1a67e82714131e0380fd6684e8094783190ce491a03243d903b4488d574be3847b4219145f5aa05201b4bafcbe2c2c98fb4e968c15822e20c06e83b0fc24d8d30acc9e24b36cfd06ad1a073719bf3a92922111e76efac5a813faaca76acfb065ad4faf1efe403aee89bc149bfa4e907008fe5f81d4e795c7a646c2b48e79b7ba54ec42425978c4d084c3c1f66ccdf230515366b08cd506a210e92e75bf7adfbaada44b619feecc4427ca23e74b68abfe9796a6e9a1f540d6a438042f506c27bb4f4814c73541b38eb7d548010363cdf7b2b6faf1a41a10fb71bd206388f32777c6b8e3fd7f6cd76342a1fba80deba8100f878eb4e4a09287ce513bb6b1f445e3cbdf220ff5faceb36c3a7f1a1710e780b9772124e5728fed14bbe348f0f4831913ae69ff40c953cc6447babbcf55b08491357531dc9d86fbe5cd4fd0d6e03e5b71daca299a8d31c3596fb98d21acc09d03e3fe7cc1f13c3e8b49b9dd40b8397ae617b322951a4bd8fe8a1eff9f920b79ddad1639da4d4a18c12ca3b65430e41506198483d5a2a0bc058269e7575cd6dc8d1a0393748622369c107b8a5fe570a7795d98b75e23d4c05c39655c8b81a389b512461a20711487695b8d4ff2d81ab4fe8c884768cbb99640a9ec5b54d3cd13a90f318e0264038b7f91dd73205342400eb9d186ed30286ff7cb9e459341ee59638b253148cfa74bada6b959f185b5cf68a313ff75783ec0f44d99c3950a6e2fdc6b7d8c6120f921630b93ec31c216e93e6b3781d02ef2339dbea56125ffe79019b1689c25d35db7d3f3e5c613060400977a2f7e142b50591b2ae5738dfd208c0f4daeda71edd05beaf4fc0b128fd004bd2bf1cea1d6883b4287cab96354e8f34f9d3707763b731686cbe6c175848a9f4bdd7c2961d270d9ef63ac95aa0603d3612a8933660c303fd1a91b3eb700718cdf40a34795399a7812c89b44f7b223dbe8bb08e0c01c4bf740c95431445a6b6fae337df7778e834813b34e0e6d3f0e935fdd136e6ac50c8e11fffb518b06c734985f31884a411293a3a3757a6e5be3d2495916314dc072fc9c0dbefcb5100513df15c18e04b2ad744d660f9cb5f4c64eead30fdd52507bba003c625108e6cdfcd7a1b38e8fd4fef0d419f695904be3026aeb9bab1ad3566a0a46a2a2d092c75ae2cbad109a117b7db76b729aaab3a89bcef8a5e63008613414fa5ce56988bbe3e839ccb8e192c56115522620e0851fbd19790f3acf9669915ef0f1ca0a2ca8a5578747f2d6cbec07a7bc4128ae131b7685191d5cf05210cc4bca2dc6303747c72cc0e4165512cccd43c5a79800b84ca018190a70984d73056e2a8bbdea91fdfcda72d9f8705227c5c4fdef9e0b81948420cae7344ba872a85e2d47c1e40fefcaa8d246fac5c7abe90b2bf39ec601390dd0a8cacbe82fc1ba0cf13c3cd89220a42e82ce62ccdf63fcb1be53c91d36349c7d3aa30170dccd5262d9ee570581ae5c9f84cf5b32261d8f531f6df0636cea496c698f36aee3274f0f9dfb7d72c074530a2679d13e5cc1bfcd957be3eba04a12f8897507122fc74ad66a7f621012ea43878cfa9a2a3ed95581aebdf1ffd7a8985f65c63de9eab4286cb94e57e3076e4e2850faef69b1d9f75ff45227b9e1bcc256c0236dc63483cffb8d72543eb213b2e0a487217850ab3bf7213dabb360c35714dbab5604357ea7b23fc0ba27d0bd09dc09e7ac471088c58d28e3ef12c3054d8a017a5023f378ae81bbbf55228620e061ace44906cc82520bfac2e1d7f7e340f53215bcf6f6078d82266abaaf479e084e73f0600572a7d482a84633eefc6e196f27638e8f08c6a4c615ef98238895d2cffb221a800424e115b0e84b960424fe39a2f33a203eb42f7f5e70e8f73aa172a8adf1d977b176cae2750859c96692bdac1067b7a1b1496dbd7c8220f3f0b42938ba0779c9bfa414a0e6073556d651d526875a4cfa95e8e981f40fc6d8bdd4704a12f44612e8eb8842535edea3d609d929b3fc05c2b02bd44e02a732ba814caf9e03e0bd7f41a24b3b6e282d07d74de2ab968ac739e994c0265416a7347f44bb80d1948cf8c9a69409e850b13f379dd672eb34a732b0b1d7b67ef2ee1bcb686cc4d1f4512c1ffb105ad2e46d783e0ca5f97ef9e4ab2798ce1c29b0f3292fbf1001d9487adfc3b34b4329be6b72ebf7a62158e488bd7888060f1e562045ecf9388c492fe3e0a6ce9b92b5a3eb29c80cc69da72f7dc2f2ac730e5d82cc5b75cecdd0809db8f1cc17bf5b72ed46fa3038722b6369d9f9497b83cc2ea1d0ebea0ac1306a83249705ae0b1c0145af67388d2153dbcb8856971216ee8f3d0cc6f532f159e5e28c6308154bf8efe46333b30740e9d94993393a27eb263dc0d19f182913ffa3953a52847fe979b9e682d304944529131b02ed468c88b5aac0483ff22ad56f9630b4f6134f266ee446068edd079411571f7e77acf2035d483043b8ad85b6277dca9e590ca801dc1896acdfc88dcf3cf83fca85afefe6addd27131f8be0fd5a80a0723556639fff59d56453ec76d3ebad3f5cb04e7b758b13e3d64c2ff5c3b018f52ba9363e053ee2fd78e35b2a834a069953e759455047521ad6615ab87e6381f0363a4554b86dd14f5ab43eb6b3fff64d94af0949a9e5c63d8c8e883886e61bd36f5ca11dfe2c025290cd49f369f8a3f9023d5daa7410fba96927fd0b5d2c75e00", 0x2000, 0x0) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000300)=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e21, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7f}}, 0x24) mount$overlay(0x0, 0x0, 0x0, 0x8, 0x0) bind$unix(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, 0x0) 2.346107362s ago: executing program 5 (id=927): r0 = socket$inet_sctp(0x2, 0x1, 0x84) mbind(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x6002, 0x0, 0x1, 0x9) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @loopback}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000000)="fd", 0x1}], 0x1, 0x0, 0x0, 0x804c044}, 0x881) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001082abd62000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004004400000008001b"], 0x30}}, 0x0) r2 = dup(r0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106}}, 0x20) accept(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x6f3e7a39}}, 0x34000) 2.320701602s ago: executing program 1 (id=928): ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, 0x0) fsopen(0x0, 0x0) write$nci(0xffffffffffffffff, 0x0, 0x14) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) ioctl$VIDIOC_SUBDEV_S_SELECTION(r0, 0xc040563e, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept4(r1, 0x0, 0x0, 0x800) 1.907349843s ago: executing program 3 (id=929): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000300), 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x14}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x0) 1.841614172s ago: executing program 0 (id=930): r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x2c020400) r2 = msgget$private(0x0, 0x0) msgsnd(r2, &(0x7f00000016c0)=ANY=[@ANYBLOB="0200000000000000ee42821b1c4caaea41c37605858c2e4c333010004b2773d118d62b48c6c10972d002976bf44c1659163f1b1081ce5a07d4d2d11bdd55d6f3e78c5eb10491714b3397fb0217f6c0c7b381dbe591ec8a3a33f0df6b52ad2e14e2299f80d221cb5733ba378bb7b51305e23b03a33bc2a5a1d57177e8849c536d3d45b227f400ad7f690e08448eee45487595ffe7f3cd371a7ad1c75dca24cb4ccc2deff5830aef85429ea7db2c798108c7893d3227e76f043389a61f74e65f9d23da4706383f6af635215d8c6b7a408d1161d0b7b42a177b3c3007e1741f21140a20f2e7310b34ad06707746b818759bf3738f7fe054c0c092e4094e6f2028494683e55e4cac29ce9a19d4279337b8f05ce105a2d8dd3441769673a35f77bffd0bcba53441b12e9482121627f96c61281f180f66fa39003047a09cc037a5969ac0fabd25e9246a419e5cdcb2c5db788d9c1d32f00ce428497b299dadc5959336de73833aff4633bb79d36168db980ce8cdee71e568d68e37023827a81bc4b80aba19c6972807ca8097091b1aa3c501f94ebaabf3a31cc773e651e65c5e0267f201bf46590c35483f01fd13a0e063797ac987d00430629f029b0f7b3d902c2249bd41f3ef366e06115503e64ba466d9b1ce6661817b45313096551dcb3e11bf1775f0777864ddd9960d843bbed0fa0c9b38de88ca7d54d4982895b235452d10ff9edfa3ddddd45a6e4673994cd06e9e62998f9984959dfe45229b688f38a4d2ecc0f6e9d5e27e136eb1727e6e4ce6d15360df07e8f608e35bf325d0751437e9da28b41c1b6ab5f0174165857c125e4a052221589a9e7dc44517fe19026e53e6d1ea03551c06f905178bfe44b9fa707fd5f9547808c72d9267eb89d3ad8f4e6a25bef93737a671485f3a9aa41bf4321ece49d62a4765820f9f526924f8707ab9e886ad6baf841467fa0be154fe531ec91a74dca5d74597707b30e069664d0f775ca36907a225fcbad3bdd39a32f2a4310584c1e52eb2db10db83cdeb6be8f7d316f7808e558129c59a3f9e99acba845935ac74d86b459bf75367d4e106e39c47d9c928d30bd56dda1736d070dfaec636d788db11cac44cd88df8ed930e322f0cc23ce095d1c4ff9333668027d4097832e44d90ae9dfffafa4f9eb953f38e6efadc7353c638f32ab6eacc6a6b888e8ad3dc4db734fc6f2a7682fc4bb3f49d3ba890890880a546c84b5e5fec26ad3a274342b2efa62efa3a3b7baeffa2a430b96d8aa09f89b9baf6c2157901b0cd19f1778a3ece5f3171a6a290ffd65adbc08accdfc807fb136ccfc4adfb2f1ce9d4e8085506b99d7794ad5ee323a98f1a93e655a88df717a41e7852e94e914944fe5af7454b144f7079b433bd0be47bb6f6abaeec1e4a580d367d5ca7e59fe78f30e9f122d1a2743172489dabec25fbf7ae21775af4f3cde4a18ddbf8517b75c2695d161160992c036e74707526b10e010cd10ff3197cca4839ca5e2e91de3837750ce1da299e621117f5302a89844b65e5c890a7d5c508127bd99008d4da7724ed9a0933bafb1d448cc8c3de807e9fb0b69e8971bcf09511d0ca99bdf6969784633b9d411f228d1542450d6ef9c77b5f510c1303389cc588ad0da8eced2c6eee8a020cce6aa8877fc29d52b53a4977c50402cb9f3f5aeacae761bee4f685536d390b90ef0021a29a903015dbac15318a3dbabaf2595bd6a37199c5eae26862898b13bc4ffd0500dfd2b1e03e72223ed992697fb63e824cf6e2c2136e57b0ff6fe81579f8c24892bd8f461caf110a97580ae9d278cf3c52f846da43a88d40234e16783beb379acb137b11090bd9bbe1c3d2e1b9b97b683c51ff28472d48c1e400a53ed694b5feab7d2449a6e2fb7c4a202f4923d85bb7f3e33add906fc9223105ea3efd3c1bad314dae722df8ddb6e05bc03573d25b8e06f3b266dff9aff15e4e77ec75124cceba595ea95891aa89a5cab46ffeda22b5f45115d57874ee219b84d884f16193e63ac482a75d47a5411ffc5c85df802131e07baa78881e20a5d10650d8df1957735759f55ee3ba2faa7af0a9e19b1af881c6e963db8f74c8d3c26bb281fc6ce2ff89d0dead1573e9840c9343f99e5cee86bfbad595c6594023ef58cb09f3be849eb4bd9d85531244b28bbffab5f44200be5bff8d53f418de2df46b41123ed8326db4e6a6a4be67521c5bb7356c21c8e34e3fe98ccefb589d23ffe01dca2705cecad8b60533e65311c477dbac542af5df0d0be2fa80f18b81e30c7a0a206bf47bd0e9662cd7897c94c41adf266199f22fe991d2da8a6b7f7452794ab8d646d46c8892756722dc06abbdf26a1f87e08f8f1716f424bdd7e970e3c01ad6954a287884c60c47450001f93987814d682bc7279cf9b59e13b032221d650d9766b9997b3f766d436d57089dbf5688a4da4a9b09ec8527248e1bd951c62edd2c4623bb3c8597082e7149893c43331478c6853509a78836de879903a05772979550c7080475068158274b01a2b8e9f45a96a932186f689b1f5b6949989820c5cb8aa5f563a259ec30a22fa02d0fb73126fb059834081126806b8ea0cfb4a6e6caf1bb1ecee42d119b6c0c6d7adbfc91499d8065871bc0ba7819a13e03103460f0264ded3d72cb9a29172f0296193b1663dd993b31cdc92f406f8016bdb8123158624cd08cfafc0de4e496443a55164b2c7290c23ca8da929daf4f25c890bd98a8f61b958d3b953a3dcb9fd266ba04ef63f96ea6df6c6801e9d7b5c9242a3f71c04ba5477459e9a827cb0c8de8027825430b381528823228d3236706f9fb0ecd751aed976ac446e3d07d20c662f690e24d2b20457031d6acdea6e638aad8c80b986a27191c436c0bde3cce3f44bf53cf1d74d0e93ae5f1b1fae1456ba674be39cd39b000a66fc95ef9021698f31288c9a666a59d76298bbdc7bf16f774f07b6ab22267e797bed9efd395de7724dc47e9df684eaaa48d9f03a761c54c916a33c79b3d5b05033bd95d3fcb2ce6f08fd02e15e5684eac997158ed1d300e2f8a857c29a2b6cba9e5b36fd3fed6d233196f489d7a2b301fcbe488dbdf3c33683936341553775f8c145ee0c6840260e93f6c69edd2ebfba3981e90bb2f5720b673340f10cfeee976c8d295d972544a8d3f0a66d2593ed530062cc432934b80e0614d31fc8adfa59dbaf79a4ab02a13c3ec662e5556a97cae80b86ba1a86790a923116778985399c9373d1df2dea8df7232591674c3314fb515f80a1e8e6ef05daacdea35d60e4c29b052341f51eae22afcfd621417d5b9ed2b97edec15dc675f22f0b40fca22e1220d32b92e1149523aa704f3303758718f1ff5b8766d987ecf9774dd39a771521fab0ff82af26268047a5e8e5e447074746cd7f8b9a915c47e10549bb9bbdaccf10685a1fb1cbd5d1ee7bbab772e3aebd4ba0c33da629ea687d9ff3a395898f9144ddd7ff4e84db70f64cb80d196b9fe7a4dcfd7f967c206701da05d8f3bc0286d6f3347a7ea31ed3af28998edaa0a1fb63ff812045a891202a07063c81f2acacf2d1410a8c8d885d6f6ac79a38c4c1b4e774c954999d6f2a481840e2471ec36b843bbf636417bce4bae137461e73e3205313827f5a7a8cd09b1a31961190ba6a89ebe20d62a1c56f3d6cf10f56eec36ce5cd826588658e3de39ca727d01ae3f7e330f686b0ddb3e5eef053ddf300f9213f9ba1060144af32a03b39c5d585074b4fb2ad4f445acdd3e226791520a91ab38115c09d96f5d09ddc3b42cc80e4516e43dcad0facf4108d707d9fa015e5851f67dc34d611113324d99516ecedf16d2aaada9dfc9b9dac383cfc2dfa287023d87b35084e1ba34df21432c66bd2d9bbd3954aa0fa3254eb395404cb542f8896dc2dfc72064d7f86177bf6eb23ba375b3056aaecc10db2dbc2b72e80dddf34f4a96b4b5f0f0e4fb40bf0c2ac2cd1aecd82fad57131a4bfabf3110eb72e10f6c8fcfd6d476258d62314180bd23444fd1b5fbd7c6129949f1350c131876739fee3badd462f0b321abfcb84007cc9bd41489f1c6f623d6829a1bd044671fc8267e5dc0379eb011d29e85626f567ed532c9d8ca5017acef09f4bc26841927608fa7058aad064962623609870c0d9c686156bb5c8a457b5bc3528806da25c8439dc832417c2bb7e6d637a02bc7bce9c523407b5e2836f25faa644ed9528d81a62651a6f29f66204c6237a95af8adfc8714da22e897ab7b764422395a80d18bab2da11029104c63b8b8eacdc3e9dc05711cc57b734780c23d22351648336ae6e0768f4a6e119d892eaf82b4952aac226675ed64977434aad83d9b0ba48a8cfc5887196725ff84517bdc516addd16d7bada138dafe021e7b61577b9c23ca18aacd4f6f87f5f4eacb6c235bf4d67c76e0959d6abe68c1e50ab88ba681f365baab58e7f062013e5c40bdad743e9c54528b90b45d36a17b2dd5f18ca0e93375e4b7651465cf0a03770c5497d6fd6ec99e7b406b3550a448cddd747fb929df571d030b5498251735b09e02b3a731c1d04ca2c9f2dd476650e496c4c215959030059b1ad4b6537419399707a99e8f528ceeead9f69b05a11c745a65f93f76ccc18aff0618bf133345a185ead44efffc0eac9a9af143864ef4e14733f9c1c1d49de4dd64c96dbbf83695e1d4515483b09aa138c6f74839f717f0674209720684580a4faa69b27518e8f915650c1dbc4ed1f14a29f34453bbd00e2876c98fe7ab2a87b073370ffbb9c62283535ab8f25b927c544e430274f2a4c0fba799df8666bf8a54d4e5e701721eb1d5efb4cb658e1d2788c645bf200f5951768cb76ca64f88c7349bfd432c0d75f2536353bee169f099280736c961a7d115115545cde211863f111b2ea7e225063980fe1f7b726ae723b8d81fde89eb0e5887209dcf777528f014c947509d7e0400f66862487805e7aedbcee3ad81a48bc528a0fb66c4146cb34e7981fc26b2a866d7bd9b02c782da5ef2605cd31c9d79c1fc493d5c54da22d7f0376323850279abc81e6a9aec889087a901a445cce42f29f58c39a02ed53d1b475f179d3ad95e373dc9c4fc8985be8f24e55256f5ecf161411c1d07124ad7ed44d671d7688d66f4ee90484f769140acde2ad9db22d61129cd3bad27708a"], 0xe05, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x12) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="3082010c3081baa003020102020101300a06082a85030701010302300c310a30080603550403130141301e170d3230303130313030303030305a170d3330303130313030303030305a300c310a300806035504031301413068302106082a85030701010101301506092a850307010201010106082a85030701010202034300044001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101300a06082a8503070101030203410002020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202", 0x110, 0xfffffffffffffffd) 1.57493232s ago: executing program 1 (id=931): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r2 = socket(0xa, 0x3, 0xff) recvmmsg(r2, &(0x7f0000002040), 0x400000000000233, 0x10022, 0x0) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000100)=0x9, 0x4) syz_emit_ethernet(0x3e, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c370c8900082b01fec400000000000000000000000000bbfe8000000000000000000000000000aaff"], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) socket$packet(0x11, 0x2, 0x300) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640), 0x0, 0x0, 0x0}) 1.371298356s ago: executing program 4 (id=932): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xb}, {}, {0xfff2, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}, @TCA_CHAIN={0x8, 0xb, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r5, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r8, {0xf000, 0xffff}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) 1.225148493s ago: executing program 1 (id=933): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/i2c-dev/i2c-0/device/new_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='maxtcpc 0x20\x00', 0xd) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000000)='trusted.overlay.upper\x00', 0x18100, &(0x7f0000000040)={@align=0x4, {0x47d, 0x6, 0x3, 0x4}}, 0x6, &(0x7f0000000080), &(0x7f00000000c0)=0x1000}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="f4000000", @ANYRES16=r3, @ANYBLOB="010000000000000000000a000000c40004801300010062726f6164636173742d6c696e6bb7"], 0xf4}}, 0x0) sendmsg$TIPC_NL_KEY_FLUSH(r1, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)=ANY=[@ANYBLOB="6c010000", @ANYRES16=r3, @ANYBLOB="00082cbd7000fedbdf25180000003c0004801c00078008000400010000000800030061000000080001001c0000001c000780080001001600000008000300328f0000080002000800000060000280080002000d000000140003800800010005000000080001000400000004000400080001000100000008000100050000002c00038008000100a0ff000008000100340d000008000200ffffffff0800010003000000080002007f000000bc0004800900010073796a3000000000040007800900010073797a30000000000900010073797a30000000004c0007800800020002000000080003000100000008000200a100000008000400070000000800040003af0000080002000200000008000400f2ffffff0800020009000000080001007f00000009007a31000000000900010073797a30000000000900010073797a30000000000900010073797a31000000001400078008000300080000000800040009000000"], 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x4048890) setxattr$trusted_overlay_upper(0x0, &(0x7f0000000280), 0x0, 0x90f, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'sit0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="5400000013000100000000000000000007000000", @ANYRES32=r5, @ANYBLOB="000000000000000034001a8006000000020000002800058024000180080001000100000008000200010000000800030001000000080004"], 0x54}}, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = dup(r6) chdir(&(0x7f0000000180)='./file0\x00') write$UHID_INPUT(r7, &(0x7f0000001300)={0xc, {"a2e3ad214fc752f9502547f70e06d038e7ff7fc6e5539b3471078b089b3b083848090890e0878f0e1ac6e7049b3372959b669a240d5b67f3988f7e0319520100ffe8d178708c523c921b1b5b31360d095d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4040d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a4975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8a92fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a4d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d606495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07840900000000000000f5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18834dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b8dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c000003716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00fd104d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff752613d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443eab40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f22b625d64931cd4ffe6738dd7b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a23dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c848a605fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333aed0418c0b44412d041259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b611fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b45030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf475af3d3060eac38dcaea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47afed367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) 1.215569354s ago: executing program 0 (id=934): syz_emit_ethernet(0x36, &(0x7f0000000540)=ANY=[@ANYBLOB], 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) write(0xffffffffffffffff, &(0x7f0000000240)="d59241", 0x3) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) ioctl$XFS_IOC_FSGEOMETRY_V1(0xffffffffffffffff, 0x80705864, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x0, 0x0) r1 = syz_io_uring_setup(0x7408, &(0x7f0000000400)={0x0, 0x2346, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x2000, @fd_index=0x4, 0x0, &(0x7f0000000300)=[{&(0x7f0000000480)=""/92, 0x5c}, {0x0}], 0x2, 0x0, 0x0, {0x0, 0x0, 0x4, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 1.189245457s ago: executing program 5 (id=935): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f00000000c0)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x18}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = syz_io_uring_setup(0x10f, &(0x7f0000000340)={0x0, 0x0, 0x2, 0x4}, &(0x7f00000003c0), &(0x7f00000000c0), &(0x7f0000000000)) io_uring_enter(r0, 0x66a8, 0x4000, 0xf, 0x0, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000001, 0x31, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) 1.025790217s ago: executing program 3 (id=936): socket(0x1e, 0x4, 0x0) timer_create(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x6}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0xa, 0x4, 0x1, 0x0, r2}, 0x50) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r4}, &(0x7f0000000840), &(0x7f0000000880)=r3}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r4, &(0x7f0000000900)}, 0x20) 1.025040053s ago: executing program 4 (id=937): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x41, 0x0) listns(0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, 0xfffffffffffffffe) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x16f0d8, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000040)='?', 0x1}], 0x1) 0s ago: executing program 0 (id=938): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xb}, {}, {0xfff2, 0xffe0}}, [@TCA_CHAIN={0x8, 0xb, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.37' (ED25519) to the list of known hosts. [ 29.091208][ T4694] cgroup: Unknown subsys name 'net' [ 29.261349][ T4694] cgroup: Unknown subsys name 'cpuset' [ 29.262961][ T4694] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 29.411706][ T4694] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 30.247539][ T4708] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.268567][ T4718] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.268906][ T4718] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 30.269494][ T4718] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 30.270017][ T4720] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 30.271266][ T4719] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 30.271598][ T4719] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 30.271790][ T4719] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 30.272009][ T4719] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 30.272155][ T4719] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 30.272823][ T4719] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 30.272950][ T4719] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 30.273185][ T4719] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 30.273590][ T4719] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 30.275460][ T4711] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.280294][ T4711] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 30.291755][ T4707] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 30.291819][ T4711] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 30.292177][ T4711] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 30.292429][ T4711] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.292807][ T4707] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 30.293204][ T4707] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 30.293517][ T4707] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 30.293814][ T4711] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 30.294544][ T4717] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 30.628867][ T4712] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.629145][ T4712] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.629209][ T4712] bridge_slave_0: entered allmulticast mode [ 30.629862][ T4712] bridge_slave_0: entered promiscuous mode [ 30.630987][ T4712] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.631012][ T4712] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.631059][ T4712] bridge_slave_1: entered allmulticast mode [ 30.631494][ T4712] bridge_slave_1: entered promiscuous mode [ 30.638650][ T4712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.639624][ T4712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.648302][ T4712] team0: Port device team_slave_0 added [ 30.680601][ T4712] team0: Port device team_slave_1 added [ 30.691240][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.691250][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.691262][ T4712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.711420][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.711431][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.711444][ T4712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.742913][ T4712] hsr_slave_0: entered promiscuous mode [ 30.743271][ T4712] hsr_slave_1: entered promiscuous mode [ 30.776030][ T4709] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.776101][ T4709] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.776157][ T4709] bridge_slave_0: entered allmulticast mode [ 30.776602][ T4709] bridge_slave_0: entered promiscuous mode [ 30.783029][ T4709] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.783061][ T4709] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.783118][ T4709] bridge_slave_1: entered allmulticast mode [ 30.783673][ T4709] bridge_slave_1: entered promiscuous mode [ 30.812726][ T4715] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.812783][ T4715] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.812845][ T4715] bridge_slave_0: entered allmulticast mode [ 30.813292][ T4715] bridge_slave_0: entered promiscuous mode [ 30.825743][ T4705] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.825768][ T4705] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.825835][ T4705] bridge_slave_0: entered allmulticast mode [ 30.826278][ T4705] bridge_slave_0: entered promiscuous mode [ 30.830283][ T4705] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.830309][ T4705] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.830402][ T4705] bridge_slave_1: entered allmulticast mode [ 30.830822][ T4705] bridge_slave_1: entered promiscuous mode [ 30.832710][ T4709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.834200][ T4709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.840793][ T4709] team0: Port device team_slave_0 added [ 30.840884][ T4715] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.840907][ T4715] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.840959][ T4715] bridge_slave_1: entered allmulticast mode [ 30.841355][ T4715] bridge_slave_1: entered promiscuous mode [ 30.847817][ T4709] team0: Port device team_slave_1 added [ 30.847867][ T4704] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.847896][ T4704] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.847996][ T4704] bridge_slave_0: entered allmulticast mode [ 30.848415][ T4704] bridge_slave_0: entered promiscuous mode [ 30.859990][ T4704] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.860019][ T4704] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.860075][ T4704] bridge_slave_1: entered allmulticast mode [ 30.860489][ T4704] bridge_slave_1: entered promiscuous mode [ 30.867062][ T4715] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.879932][ T4704] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.883324][ T4704] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.889525][ T4715] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.896154][ T4705] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.902026][ T4705] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.902322][ T4709] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.902331][ T4709] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.902344][ T4709] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.905343][ T4709] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.905351][ T4709] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.905361][ T4709] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.930693][ T4715] team0: Port device team_slave_0 added [ 30.934247][ T4715] team0: Port device team_slave_1 added [ 30.934979][ T4704] team0: Port device team_slave_0 added [ 30.935632][ T4705] team0: Port device team_slave_0 added [ 30.945054][ T4709] hsr_slave_0: entered promiscuous mode [ 30.945344][ T4709] hsr_slave_1: entered promiscuous mode [ 30.945565][ T4709] debugfs: 'hsr0' already exists in 'hsr' [ 30.945601][ T4709] Cannot create hsr debugfs directory [ 30.946281][ T4705] team0: Port device team_slave_1 added [ 30.947051][ T4704] team0: Port device team_slave_1 added [ 30.955186][ T4715] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.955196][ T4715] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.955208][ T4715] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.968645][ T4715] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.968656][ T4715] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.968673][ T4715] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.978233][ T4705] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.978241][ T4705] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.978253][ T4705] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.989564][ T4704] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.989573][ T4704] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.989587][ T4704] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.990336][ T4704] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.990343][ T4704] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.990358][ T4704] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.991866][ T4715] hsr_slave_0: entered promiscuous mode [ 30.992201][ T4715] hsr_slave_1: entered promiscuous mode [ 30.992371][ T4715] debugfs: 'hsr0' already exists in 'hsr' [ 30.992381][ T4715] Cannot create hsr debugfs directory [ 31.002987][ T4705] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.002998][ T4705] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.003012][ T4705] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.026099][ T4704] hsr_slave_0: entered promiscuous mode [ 31.026373][ T4704] hsr_slave_1: entered promiscuous mode [ 31.026557][ T4704] debugfs: 'hsr0' already exists in 'hsr' [ 31.026566][ T4704] Cannot create hsr debugfs directory [ 31.029664][ T4705] hsr_slave_0: entered promiscuous mode [ 31.032514][ T4705] hsr_slave_1: entered promiscuous mode [ 31.032702][ T4705] debugfs: 'hsr0' already exists in 'hsr' [ 31.032712][ T4705] Cannot create hsr debugfs directory [ 31.060995][ T4712] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 31.062907][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.081280][ T4712] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 31.082563][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.084310][ T4712] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 31.085444][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.100800][ T4712] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 31.103210][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.143843][ T4709] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 31.145202][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.154466][ T4709] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 31.155764][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.163357][ T4709] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 31.164763][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.172524][ T4712] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.172556][ T4712] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.172713][ T4712] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.172742][ T4712] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.178693][ T4709] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 31.179638][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.202885][ T4709] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.202915][ T4709] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.202990][ T4709] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.203018][ T4709] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.211265][ T4715] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 31.213488][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.213817][ T4715] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 31.216084][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.219235][ T4712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.227132][ T1187] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.227552][ T1187] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.229115][ T1187] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.229357][ T1187] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.239528][ T4715] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 31.243832][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.244247][ T4715] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 31.245073][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.248985][ T4705] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 31.253349][ T4705] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.253657][ T4705] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 31.254615][ T4705] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.255466][ T4705] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.257201][ T4705] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.258070][ T4712] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.262387][ T1139] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.262446][ T1139] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.271239][ T4705] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.272605][ T4705] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.279638][ T4709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.289200][ T1187] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.289228][ T1187] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.304204][ T4709] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.313839][ T1187] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.313867][ T1187] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.314245][ T1187] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.314269][ T1187] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.331679][ T4704] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 31.332723][ T4704] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.333065][ T4704] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 31.333872][ T4704] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.334266][ T4704] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 31.335152][ T4704] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.345562][ T4704] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 31.346793][ T4704] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.371369][ T4715] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.376935][ T4715] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.381483][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.381509][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.401864][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.401891][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.416143][ T4715] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.416158][ T4715] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.419149][ T4705] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.454444][ T4704] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.477365][ T4705] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.482043][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.482068][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.482434][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.482452][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.486267][ T4704] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.501923][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.501955][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.507932][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.507955][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.535408][ T4705] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.535424][ T4705] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.562571][ T4712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.565949][ T4704] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.595927][ T4709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.610916][ T4709] veth0_vlan: entered promiscuous mode [ 31.613327][ T4709] veth1_vlan: entered promiscuous mode [ 31.623651][ T4709] veth0_macvtap: entered promiscuous mode [ 31.625284][ T4709] veth1_macvtap: entered promiscuous mode [ 31.630068][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.631109][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.671760][ T1187] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.671903][ T1187] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.672090][ T1187] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.672098][ T1187] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.693584][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.693598][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.693721][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.711992][ T1139] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.716783][ T4715] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.745897][ T4709] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.765727][ T4715] veth0_vlan: entered promiscuous mode [ 31.768420][ T4715] veth1_vlan: entered promiscuous mode [ 31.777551][ T4712] veth0_vlan: entered promiscuous mode [ 31.802565][ T4712] veth1_vlan: entered promiscuous mode [ 31.809470][ T4715] veth0_macvtap: entered promiscuous mode [ 31.814852][ T4715] veth1_macvtap: entered promiscuous mode [ 31.820714][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.828576][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.835768][ T179] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.836505][ T179] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.845743][ T4712] veth0_macvtap: entered promiscuous mode [ 31.847714][ T4704] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.847902][ T4877] syzkaller0: entered promiscuous mode [ 31.847918][ T4877] syzkaller0: entered allmulticast mode [ 31.850346][ T59] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.850372][ T59] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.865569][ T4712] veth1_macvtap: entered promiscuous mode [ 31.884872][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.886227][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.887364][ T4705] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.898259][ T179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.898270][ T179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.922939][ T4704] veth0_vlan: entered promiscuous mode [ 31.924746][ T4704] veth1_vlan: entered promiscuous mode [ 31.938292][ T179] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.938303][ T179] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.948117][ T4705] veth0_vlan: entered promiscuous mode [ 31.957878][ T4704] veth0_macvtap: entered promiscuous mode [ 31.959008][ T4704] veth1_macvtap: entered promiscuous mode [ 31.966935][ T4705] veth1_vlan: entered promiscuous mode [ 31.969890][ T49] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.969915][ T49] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.969933][ T49] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.969949][ T49] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.974593][ T4705] veth0_macvtap: entered promiscuous mode [ 31.975806][ T4705] veth1_macvtap: entered promiscuous mode [ 31.982979][ T4705] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.985942][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.985950][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.006199][ T4705] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.009394][ T4704] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.011052][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.011062][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.032572][ T179] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.032664][ T179] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.033390][ T4704] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.038083][ T40] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.150726][ T179] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.151705][ T179] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.151734][ T179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.151742][ T179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.152970][ T179] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.152981][ T179] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.153103][ T179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.153109][ T179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.153173][ T179] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.153178][ T179] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.153326][ T179] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.185969][ T1187] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.186114][ T1187] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.467552][ T4902] loop4: detected capacity change from 0 to 256 [ 32.638966][ T51] Bluetooth: hci2: command tx timeout [ 32.639123][ T51] Bluetooth: hci1: command tx timeout [ 32.639190][ T51] Bluetooth: hci3: command tx timeout [ 32.639255][ T51] Bluetooth: hci0: command tx timeout [ 32.639325][ T51] Bluetooth: hci4: command tx timeout [ 32.743981][ T4904] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1'. [ 32.878667][ T4913] Zero length message leads to an empty skb [ 33.342860][ T4926] syzkaller0: entered promiscuous mode [ 33.342882][ T4926] syzkaller0: entered allmulticast mode [ 34.659870][ T4708] Bluetooth: hci4: command tx timeout [ 34.659896][ T4708] Bluetooth: hci0: command tx timeout [ 34.659911][ T4708] Bluetooth: hci3: command tx timeout [ 34.659925][ T4708] Bluetooth: hci1: command tx timeout [ 34.659938][ T4708] Bluetooth: hci2: command tx timeout [ 34.662891][ T4948] loop4: detected capacity change from 0 to 512 [ 34.677760][ T4948] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 34.704258][ T4948] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.709237][ T4950] binder: 4949:4950 tried to acquire reference to desc 0, got 1 instead [ 34.711218][ T4950] binder: 4949:4950 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 34.711232][ T4950] binder: 4950 RLIMIT_NICE not set [ 34.711273][ T4950] binder: 4950 RLIMIT_NICE not set [ 34.712134][ T4950] binder: release 4949:4950 transaction 12 out, still active [ 34.712145][ T4950] binder: release 4949:4950 transaction 5 in, still active [ 34.712154][ T4950] binder: undelivered TRANSACTION_COMPLETE [ 34.712372][ T4950] binder: 4950 RLIMIT_NICE not set [ 34.713188][ T4950] binder_alloc: 4949: binder_alloc_buf, no vma [ 34.713195][ T4950] binder: cannot allocate buffer: vma cleared, target dead or dying [ 34.713214][ T4950] binder: 4949:4950 transaction call to 4949:0 failed 13/29189/-3, code 0 size 0-0 line 3408 [ 34.725627][ T55] binder: release 4949:4950 transaction 12 in, still active [ 34.725647][ T55] binder: release 4949:4950 transaction 5 out, still active [ 34.725660][ T55] binder: send failed reply for transaction 12, target dead [ 34.725673][ T55] binder: send failed reply for transaction 5, target dead [ 34.725683][ T55] binder: undelivered TRANSACTION_ERROR: 29189 [ 35.096988][ T4963] warning: `syz.0.24' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 35.855977][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.751430][ T51] Bluetooth: hci2: command tx timeout [ 36.751465][ T51] Bluetooth: hci1: command tx timeout [ 36.751483][ T51] Bluetooth: hci3: command tx timeout [ 36.751499][ T51] Bluetooth: hci0: command tx timeout [ 36.751515][ T51] Bluetooth: hci4: command tx timeout [ 37.885376][ T5025] netlink: 72 bytes leftover after parsing attributes in process `syz.2.39'. [ 38.510332][ T5035] syzkaller0: entered promiscuous mode [ 38.510350][ T5035] syzkaller0: entered allmulticast mode [ 38.515688][ T5035] tipc: Started in network mode [ 38.516193][ T5035] tipc: Node identity 96c734756386, cluster identity 4711 [ 38.516310][ T5035] tipc: Enabled bearer , priority 0 [ 38.811547][ T4708] Bluetooth: hci4: command tx timeout [ 38.811577][ T4708] Bluetooth: hci0: command tx timeout [ 38.811596][ T4708] Bluetooth: hci1: command tx timeout [ 38.812554][ T4708] Bluetooth: hci2: command tx timeout [ 38.813612][ T4719] Bluetooth: hci3: command tx timeout [ 38.885873][ T5034] tipc: Resetting bearer [ 38.889315][ T5034] tipc: Disabling bearer [ 38.954484][ T5042] loop2: detected capacity change from 0 to 512 [ 38.979309][ T5042] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.828828][ T5058] loop4: detected capacity change from 0 to 256 [ 40.056790][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.117310][ T5064] syzkaller0: entered promiscuous mode [ 40.117326][ T5064] syzkaller0: entered allmulticast mode [ 41.021784][ T5084] loop3: detected capacity change from 0 to 128 [ 41.448010][ T5084] mmap: syz.3.58 (5084) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 41.558966][ T5102] syzkaller0: entered promiscuous mode [ 41.558983][ T5102] syzkaller0: entered allmulticast mode [ 43.421952][ T5140] loop3: detected capacity change from 0 to 8 [ 43.425034][ T5140] squashfs: Bad value for 'errors' [ 43.556614][ T5142] netlink: 8 bytes leftover after parsing attributes in process `syz.0.71'. [ 43.674261][ T5145] overlay: Unknown parameter 'appraise_type' [ 43.844788][ T5142] syz.0.71 uses obsolete (PF_INET,SOCK_PACKET) [ 43.868031][ T5149] fuse: Unknown parameter 'group_id00000000000000000000' [ 44.313843][ T5158] FAULT_INJECTION: forcing a failure. [ 44.313843][ T5158] name failslab, interval 1, probability 0, space 0, times 1 [ 44.313868][ T5158] CPU: 1 UID: 0 PID: 5158 Comm: syz.0.76 Not tainted syzkaller #0 PREEMPT [ 44.313880][ T5158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 44.313886][ T5158] Call trace: [ 44.313889][ T5158] show_stack+0x2c/0x3c (C) [ 44.313911][ T5158] __dump_stack+0x30/0x40 [ 44.313924][ T5158] dump_stack_lvl+0xd8/0x12c [ 44.313935][ T5158] dump_stack+0x1c/0x28 [ 44.313946][ T5158] should_fail_ex+0x418/0x58c [ 44.313959][ T5158] should_failslab+0xc4/0x120 [ 44.313972][ T5158] __kvmalloc_node_noprof+0x160/0x7fc [ 44.313981][ T5158] allocate_hook_entries_size+0x50/0xb8 [ 44.313994][ T5158] nf_hook_entries_grow+0x1b0/0x560 [ 44.314008][ T5158] __nf_register_net_hook+0x22c/0x624 [ 44.314020][ T5158] nf_register_net_hook+0xc0/0x19c [ 44.314031][ T5158] nf_register_net_hooks+0x54/0xf0 [ 44.314041][ T5158] nf_defrag_ipv4_enable+0x9c/0x12c [ 44.314052][ T5158] nf_ct_netns_do_get+0x268/0x4d0 [ 44.314064][ T5158] nf_ct_netns_get+0xa4/0xd8 [ 44.314076][ T5158] xt_ct_tg_check+0xe4/0x74c [ 44.314087][ T5158] xt_ct_tg_check_v0+0x158/0x268 [ 44.314098][ T5158] xt_check_target+0x554/0xb24 [ 44.314107][ T5158] translate_table+0x1194/0x17f8 [ 44.314118][ T5158] do_ipt_set_ctl+0x908/0xc38 [ 44.314129][ T5158] nf_setsockopt+0xa0/0xe4 [ 44.314140][ T5158] ip_setsockopt+0x118/0x128 [ 44.314151][ T5158] udp_setsockopt+0xa8/0xc0 [ 44.314161][ T5158] sock_common_setsockopt+0xb0/0xcc [ 44.314170][ T5158] do_sock_setsockopt+0x1f0/0x330 [ 44.314181][ T5158] __sys_setsockopt+0x104/0x170 [ 44.314190][ T5158] __arm64_sys_setsockopt+0xc8/0xe4 [ 44.314200][ T5158] invoke_syscall+0x98/0x244 [ 44.314212][ T5158] el0_svc_common+0xec/0x23c [ 44.314224][ T5158] do_el0_svc+0x4c/0x5c [ 44.314235][ T5158] el0_svc+0x60/0x1d8 [ 44.314247][ T5158] el0t_64_sync_handler+0x44/0x104 [ 44.314257][ T5158] el0t_64_sync+0x198/0x19c [ 45.087153][ T5172] syzkaller0: entered promiscuous mode [ 45.087170][ T5172] syzkaller0: entered allmulticast mode [ 45.134676][ T5172] netlink: 4 bytes leftover after parsing attributes in process `syz.2.80'. [ 45.138393][ T5172] tipc: Started in network mode [ 45.138407][ T5172] tipc: Node identity 82eaf60f409d, cluster identity 4711 [ 45.138475][ T5172] tipc: Enabled bearer , priority 0 [ 45.359646][ T5176] netlink: 60 bytes leftover after parsing attributes in process `syz.1.78'. [ 45.378802][ T5171] tipc: Resetting bearer [ 45.386285][ T5171] tipc: Disabling bearer [ 45.392998][ T5179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.393266][ T5179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.814600][ T5179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.815172][ T5179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.819329][ T5179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.819501][ T5179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.821596][ T5179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.821752][ T5179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.162545][ T5202] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 47.267981][ T5209] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 48.111894][ T5229] loop3: detected capacity change from 0 to 1024 [ 48.116467][ T5229] ======================================================= [ 48.116467][ T5229] WARNING: The mand mount option has been deprecated and [ 48.116467][ T5229] and is ignored by this kernel. Remove the mand [ 48.116467][ T5229] option from the mount to silence this warning. [ 48.116467][ T5229] ======================================================= [ 48.149325][ T5229] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 49.074677][ T5251] tmpfs: Using encoding : utf8-12.1.0 [ 49.122694][ T4704] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 49.463283][ T5260] FAULT_INJECTION: forcing a failure. [ 49.463283][ T5260] name failslab, interval 1, probability 0, space 0, times 0 [ 49.463306][ T5260] CPU: 1 UID: 0 PID: 5260 Comm: syz.3.101 Not tainted syzkaller #0 PREEMPT [ 49.463316][ T5260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 49.463322][ T5260] Call trace: [ 49.463325][ T5260] show_stack+0x2c/0x3c (C) [ 49.463347][ T5260] __dump_stack+0x30/0x40 [ 49.463359][ T5260] dump_stack_lvl+0xd8/0x12c [ 49.463370][ T5260] dump_stack+0x1c/0x28 [ 49.463381][ T5260] should_fail_ex+0x418/0x58c [ 49.463394][ T5260] should_failslab+0xc4/0x120 [ 49.463406][ T5260] __kvmalloc_node_noprof+0x160/0x7fc [ 49.463415][ T5260] alloc_fdtable+0x15c/0x290 [ 49.463423][ T5260] dup_fd+0x614/0x848 [ 49.463430][ T5260] __arm64_sys_close_range+0x194/0x808 [ 49.463438][ T5260] invoke_syscall+0x98/0x244 [ 49.463450][ T5260] el0_svc_common+0xec/0x23c [ 49.463461][ T5260] do_el0_svc+0x4c/0x5c [ 49.463472][ T5260] el0_svc+0x60/0x1d8 [ 49.463483][ T5260] el0t_64_sync_handler+0x44/0x104 [ 49.463494][ T5260] el0t_64_sync+0x198/0x19c [ 49.479278][ T5263] loop2: detected capacity change from 0 to 256 [ 50.352362][ T5284] loop1: detected capacity change from 0 to 256 [ 50.848754][ T5296] loop4: detected capacity change from 0 to 512 [ 50.866515][ T5296] Quota error (device loop4): do_check_range: Getting dqdh_entries 1536 out of range 0-14 [ 50.866570][ T5296] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 50.866585][ T5296] EXT4-fs error (device loop4): ext4_acquire_dquot:7069: comm syz.4.113: Failed to acquire dquot type 1 [ 50.866648][ T5296] loop4: lost filesystem error report for type 5 error -117 [ 50.869724][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 50.869740][ C0] EXT4-fs (loop4): last error at time 50: ext4_acquire_dquot:7069 [ 50.874286][ T5296] EXT4-fs (loop4): 1 truncate cleaned up [ 50.880355][ T5296] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 50.923195][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.166241][ T5312] ip_tables: iptables: counters copy to user failed while replacing table [ 51.288969][ T5314] 9p: Bad value for 'wfdno' [ 51.909109][ T5312] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 51.910189][ T5312] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 51.915401][ T5312] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 51.919825][ T5312] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 51.919912][ T5312] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 51.925459][ T5312] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 51.925504][ T5312] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 51.926447][ T5312] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 51.929023][ T5312] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 51.929207][ T5312] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 51.939348][ T5312] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 51.943084][ T5312] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 51.943122][ T5312] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 51.944445][ T5312] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 52.379111][ T5341] xt_cgroup: invalid path, errno=-2 [ 52.819097][ T5352] loop1: detected capacity change from 0 to 512 [ 52.821207][ T5352] EXT4-fs: Ignoring removed oldalloc option [ 52.899149][ T5352] EXT4-fs (loop1): Test dummy encryption mode enabled [ 52.920549][ T5352] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 52.931312][ T5362] null_blk: rnullb0: using native zone append [ 53.130306][ T5367] No such timeout policy "syz1" [ 53.289861][ T4719] Bluetooth: hci0: command 0x0c1a tx timeout [ 53.293138][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.325787][ T5362] null_blk: disk rnullb0 created [ 53.396600][ T5373] loop2: detected capacity change from 0 to 128 [ 53.406460][ T5373] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 53.496662][ T5377] netlink: 'syz.1.132': attribute type 2 has an invalid length. [ 53.497364][ T5377] netlink: 'syz.1.132': attribute type 2 has an invalid length. [ 53.497375][ T5377] netlink: 'syz.1.132': attribute type 2 has an invalid length. [ 53.953959][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 53.954006][ T51] Bluetooth: hci1: command 0x0c1a tx timeout [ 53.954171][ T4719] Bluetooth: hci3: command 0x0c1a tx timeout [ 54.282779][ T4719] Bluetooth: hci4: command 0x0c1a tx timeout [ 54.304603][ T4715] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 54.329992][ T5391] loop3: detected capacity change from 0 to 512 [ 54.381056][ T5391] FAT-fs (loop3): error, fat_get_cluster: detected the cluster chain loop (i_pos 548) [ 54.381078][ T5391] FAT-fs (loop3): Filesystem has been set read-only [ 54.381322][ T5391] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 54.535004][ T5402] misc userio: Invalid payload size [ 54.573347][ T5398] loop4: detected capacity change from 0 to 8192 [ 54.585170][ T5398] syz.4.142: attempt to access beyond end of device [ 54.585170][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.585207][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 54.593314][ T5398] syz.4.142: attempt to access beyond end of device [ 54.593314][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.593335][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 54.593358][ T5398] syz.4.142: attempt to access beyond end of device [ 54.593358][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.593370][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 54.594213][ T5398] syz.4.142: attempt to access beyond end of device [ 54.594213][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.594231][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 54.594254][ T5398] syz.4.142: attempt to access beyond end of device [ 54.594254][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.594266][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 54.594287][ T5398] syz.4.142: attempt to access beyond end of device [ 54.594287][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.594298][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 54.594317][ T5398] syz.4.142: attempt to access beyond end of device [ 54.594317][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.594327][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 54.594345][ T5398] syz.4.142: attempt to access beyond end of device [ 54.594345][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.594355][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 54.594372][ T5398] syz.4.142: attempt to access beyond end of device [ 54.594372][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.594381][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 54.594398][ T5398] syz.4.142: attempt to access beyond end of device [ 54.594398][ T5398] loop4: rw=8388608, sector=57847, nr_sectors = 1 limit=8192 [ 54.594408][ T5398] Buffer I/O error on dev loop4, logical block 57847, async page read [ 55.369981][ T4719] Bluetooth: hci0: command 0x0c1a tx timeout [ 56.010638][ T4708] Bluetooth: hci1: command 0x0c1a tx timeout [ 56.010842][ T4708] Bluetooth: hci2: command 0x0c1a tx timeout [ 56.015913][ T4719] Bluetooth: hci3: command 0x0c1a tx timeout [ 56.226571][ T5435] netlink: 12 bytes leftover after parsing attributes in process `syz.1.151'. [ 56.233911][ T5435] ipvlan2: entered allmulticast mode [ 56.233927][ T5435] syz_tun: entered allmulticast mode [ 56.539359][ T4719] Bluetooth: hci4: command 0x0c1a tx timeout [ 57.449900][ T4719] Bluetooth: hci0: command 0x0c1a tx timeout [ 57.537387][ T5467] loop4: detected capacity change from 0 to 256 [ 58.099796][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 58.099837][ T4719] Bluetooth: hci3: command 0x0c1a tx timeout [ 58.624027][ T4719] Bluetooth: hci4: command 0x0c1a tx timeout [ 59.399773][ T5497] tipc: Cannot configure node identity twice [ 60.013149][ T1187] IPVS: starting estimator thread 0... [ 60.025100][ T5512] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 60.101143][ T5511] IPVS: using max 60 ests per chain, 144000 per kthread [ 60.557145][ T5525] loop4: detected capacity change from 0 to 4096 [ 60.643452][ T5527] loop4: detected capacity change from 0 to 512 [ 60.647161][ T5527] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 60.666887][ T5527] EXT4-fs (loop4): 1 truncate cleaned up [ 60.667453][ T5527] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 61.550407][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 61.607371][ T5547] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 61.807996][ T5550] loop4: detected capacity change from 0 to 512 [ 61.808819][ T5550] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 61.815706][ T5550] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4223: comm syz.4.179: Allocating blocks 41-42 which overlap fs metadata [ 61.815724][ T5550] loop4: lost filesystem error report for type 5 error -117 [ 61.819031][ T5550] EXT4-fs (loop4): Remounting filesystem read-only [ 61.819125][ T5550] Quota error (device loop4): write_blk: dquota write failed [ 61.819134][ T5550] Quota error (device loop4): find_free_dqentry: Can't write quota data block 5 [ 61.819203][ T5550] Quota error (device loop4): write_blk: dquota write failed [ 61.819241][ T5550] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 61.819339][ T5550] EXT4-fs (loop4): 1 truncate cleaned up [ 61.819855][ T5550] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 62.528584][ T5563] loop1: detected capacity change from 0 to 1024 [ 62.920263][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.973756][ T5563] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (32298!=35945) [ 62.973987][ T5563] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 63.711311][ T5567] loop4: detected capacity change from 0 to 128 [ 63.715335][ T5563] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 63.715451][ T5563] EXT4-fs (loop1): orphan cleanup on readonly fs [ 63.716750][ T5567] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 63.745394][ T5563] EXT4-fs error (device loop1): ext4_read_inode_bitmap:169: comm syz.1.180: Inode bitmap for bg 0 marked uninitialized [ 63.745415][ T5563] loop1: lost filesystem error report for type 5 error -117 [ 63.746208][ T5563] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 64.292737][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.299318][ T4712] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 64.322620][ T5583] loop1: detected capacity change from 0 to 512 [ 64.326545][ T5583] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 64.326561][ T5583] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 64.328640][ T5583] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8002c018, mo2=0082] [ 64.331872][ T5583] EXT4-fs (loop1): 1 truncate cleaned up [ 64.332320][ T5583] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 64.435661][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.492326][ T1594] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.492386][ T1594] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.519654][ T5591] netlink: 8 bytes leftover after parsing attributes in process `syz.4.188'. [ 64.522940][ T5591] netlink: 8 bytes leftover after parsing attributes in process `syz.4.188'. [ 64.524108][ T5591] netlink: 8 bytes leftover after parsing attributes in process `syz.4.188'. [ 64.525680][ T5591] netlink: 8 bytes leftover after parsing attributes in process `syz.4.188'. [ 64.726053][ T26] cfg80211: failed to load regulatory.db [ 65.397309][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397326][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397333][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397340][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397346][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397352][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397357][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397363][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397369][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397374][ T5602] tc action pedit unable to extract header offset for header type (0x5) [ 65.397388][ T5602] 0: reclassify loop, rule prio 0, protocol 800 [ 66.710765][ T5639] md: could not open device unknown-block(1,0). [ 66.710799][ T5639] md: error, md_import_device() returned -16 [ 66.711578][ T5638] md: array md0 already has disks! [ 67.405216][ T5659] netlink: 4 bytes leftover after parsing attributes in process `syz.4.202'. [ 67.410565][ T5659] netlink: 4 bytes leftover after parsing attributes in process `syz.4.202'. [ 68.199103][ T5673] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20002 [ 68.200356][ T5673] loop1: detected capacity change from 0 to 128 [ 68.226294][ T5673] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 69.509149][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 71.386705][ T5708] can0: slcan on ttyS3. [ 71.480480][ T5708] can0 (unregistered): slcan off ttyS3. [ 71.485510][ T5701] fuse: Unknown parameter '0x0000000000000007' [ 71.499020][ T10] lg-g15 0003:046D:0A07.0001: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 71.502166][ T10] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0001/input/input2 [ 71.548544][ T5708] capability: warning: `syz.1.212' uses 32-bit capabilities (legacy support in use) [ 72.554753][ T5717] fido_id[5717]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 72.710718][ T5725] netlink: 32 bytes leftover after parsing attributes in process `syz.3.213'. [ 72.710739][ T5725] netlink: 20 bytes leftover after parsing attributes in process `syz.3.213'. [ 73.012835][ T5731] loop2: detected capacity change from 0 to 512 [ 73.014841][ T5731] journal_path: Non-blockdev passed as './file1' [ 73.014858][ T5731] EXT4-fs: error: could not find journal device path [ 73.531501][ T5747] FAULT_INJECTION: forcing a failure. [ 73.531501][ T5747] name fail_futex, interval 1, probability 0, space 0, times 1 [ 73.531526][ T5747] CPU: 0 UID: 0 PID: 5747 Comm: syz.4.222 Not tainted syzkaller #0 PREEMPT [ 73.531537][ T5747] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 73.531542][ T5747] Call trace: [ 73.531545][ T5747] show_stack+0x2c/0x3c (C) [ 73.531566][ T5747] __dump_stack+0x30/0x40 [ 73.531580][ T5747] dump_stack_lvl+0xd8/0x12c [ 73.531591][ T5747] dump_stack+0x1c/0x28 [ 73.531602][ T5747] should_fail_ex+0x418/0x58c [ 73.531616][ T5747] should_fail+0x14/0x24 [ 73.531627][ T5747] get_futex_key+0x1ec/0x12b0 [ 73.531637][ T5747] futex_wait_setup+0x58/0x674 [ 73.531648][ T5747] __futex_wait+0x108/0x25c [ 73.531659][ T5747] futex_wait+0x108/0x2c0 [ 73.531669][ T5747] do_futex+0x320/0x378 [ 73.531679][ T5747] __arm64_sys_futex+0x2e4/0x418 [ 73.531689][ T5747] invoke_syscall+0x98/0x244 [ 73.531701][ T5747] el0_svc_common+0xec/0x23c [ 73.531712][ T5747] do_el0_svc+0x4c/0x5c [ 73.531723][ T5747] el0_svc+0x60/0x1d8 [ 73.531734][ T5747] el0t_64_sync_handler+0x44/0x104 [ 73.531744][ T5747] el0t_64_sync+0x198/0x19c [ 73.596355][ T5750] loop4: detected capacity change from 0 to 512 [ 73.597607][ T5750] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 73.606321][ T5750] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:487: comm syz.4.223: Invalid block bitmap block 0 in block_group 0 [ 73.606809][ T5750] loop4: lost filesystem error report for type 5 error -117 [ 73.608747][ T5750] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 73.608787][ T5750] loop4: lost filesystem error report for type 5 error -117 [ 73.608950][ T5750] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #11: comm syz.4.223: attempt to clear invalid blocks 983261 len 1 [ 73.609026][ T5750] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 73.612529][ T5750] EXT4-fs error (device loop4): __ext4_get_inode_loc:4916: comm syz.4.223: Invalid inode table block 0 in block_group 0 [ 73.612552][ T5750] loop4: lost filesystem error report for type 5 error -117 [ 73.620460][ C0] EXT4-fs (loop4): error count since last fsck: 4 [ 73.620472][ C0] EXT4-fs (loop4): initial error at time 73: ext4_read_block_bitmap_nowait:487 [ 73.620483][ C0] EXT4-fs (loop4): last error at time 73: __ext4_get_inode_loc:4916 [ 73.654854][ T5750] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 73.656634][ T5750] loop4: lost filesystem error report for type 5 error -117 [ 73.682390][ T5753] netlink: 8 bytes leftover after parsing attributes in process `syz.2.221'. [ 73.689044][ T5750] EXT4-fs error (device loop4) in ext4_orphan_del:304: Corrupt filesystem [ 73.689305][ T5750] loop4: lost filesystem error report for type 5 error -117 [ 73.692475][ T5750] EXT4-fs error (device loop4): __ext4_get_inode_loc:4916: comm syz.4.223: Invalid inode table block 0 in block_group 0 [ 73.692625][ T5750] loop4: lost filesystem error report for type 5 error -117 [ 73.694114][ T5750] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 73.694127][ T5750] loop4: lost filesystem error report for type 5 error -117 [ 73.694343][ T5750] EXT4-fs error (device loop4): ext4_truncate:4721: inode #11: comm syz.4.223: mark_inode_dirty error [ 73.694367][ T5750] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 73.694687][ T5750] EXT4-fs error (device loop4) in ext4_process_orphan:346: Corrupt filesystem [ 73.694701][ T5750] loop4: lost filesystem error report for type 5 error -117 [ 73.694851][ T5750] EXT4-fs error (device loop4): __ext4_get_inode_loc:4916: comm syz.4.223: Invalid inode table block 0 in block_group 0 [ 73.694865][ T5750] loop4: lost filesystem error report for type 5 error -117 [ 73.695015][ T5750] EXT4-fs (loop4): 1 truncate cleaned up [ 73.695864][ T5750] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 74.574624][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 74.619249][ T5775] loop2: detected capacity change from 0 to 1024 [ 74.621138][ T5775] EXT4-fs: Mount option(s) incompatible with ext3 [ 75.644850][ T5791] loop4: detected capacity change from 0 to 512 [ 75.654851][ T5791] EXT4-fs warning (device loop4): ext4_multi_mount_protect:287: Invalid MMP block in superblock [ 75.715234][ T5795] netlink: 'syz.3.231': attribute type 1 has an invalid length. [ 76.801333][ T5812] Bluetooth: MGMT ver 1.23 [ 77.585935][ T5828] loop2: detected capacity change from 0 to 512 [ 77.588179][ T5828] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 77.588288][ T5828] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 0 not in group (block 2)! [ 77.588298][ T5828] EXT4-fs (loop2): group descriptors corrupted! [ 77.814051][ T5855] loop2: detected capacity change from 0 to 8192 [ 78.376752][ T30] audit: type=1326 audit(78.360:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5901 comm="syz.0.274" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff88b79368 code=0x0 [ 78.469882][ T5911] lo speed is unknown, defaulting to 1000 [ 78.470170][ T5911] lo speed is unknown, defaulting to 1000 [ 78.474310][ T5911] lo speed is unknown, defaulting to 1000 [ 78.479407][ T5911] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 78.487441][ T5911] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 78.509304][ T5911] lo speed is unknown, defaulting to 1000 [ 78.512497][ T5911] lo speed is unknown, defaulting to 1000 [ 78.515180][ T5911] lo speed is unknown, defaulting to 1000 [ 78.517623][ T5911] lo speed is unknown, defaulting to 1000 [ 78.520140][ T5911] lo speed is unknown, defaulting to 1000 [ 79.007434][ T5936] Cannot find add_set index 0 as target [ 79.179869][ T4719] Bluetooth: hci1: unexpected event for opcode 0x0003 [ 79.214443][ T5942] netlink: 32 bytes leftover after parsing attributes in process `syz.4.286'. [ 79.443999][ T5967] loop4: detected capacity change from 0 to 256 [ 79.561867][ T5974] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 79.643170][ T5978] loop2: detected capacity change from 0 to 512 [ 79.649785][ T5978] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 79.656903][ T5976] loop4: detected capacity change from 0 to 4096 [ 79.668327][ T5978] FAT-fs (loop2): error, invalid access to FAT (entry 0x0fffff00) [ 79.668342][ T5978] FAT-fs (loop2): Filesystem has been set read-only [ 79.668399][ T5976] EXT4-fs (loop4): Test dummy encryption mode enabled [ 79.682535][ T5976] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 79.709021][ T5976] fscrypt: AES-256-XTS using blk-crypto-fallback [ 79.733374][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 80.451634][ T6037] netlink: 20 bytes leftover after parsing attributes in process `syz.4.326'. [ 80.476189][ T6039] loop4: detected capacity change from 0 to 512 [ 80.476687][ T6039] EXT4-fs: Ignoring removed oldalloc option [ 80.477034][ T6039] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 80.501958][ T6039] EXT4-fs (loop4): 1 orphan inode deleted [ 80.501975][ T6039] EXT4-fs (loop4): 1 truncate cleaned up [ 80.502724][ T6039] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 80.508492][ T6039] EXT4-fs error (device loop4): empty_inline_dir:1796: inode #12: block 7: comm syz.4.327: bad entry in directory: directory entry overrun - offset=4, inode=13, rec_len=784, size=60 fake=0 [ 80.527476][ T6039] EXT4-fs (loop4): Remounting filesystem read-only [ 80.527495][ T6039] EXT4-fs warning (device loop4): empty_inline_dir:1803: bad inline directory (dir #12) - inode 13, rec_len 784, name_len 5inline size 60 [ 80.557940][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 81.141589][ T6059] loop2: detected capacity change from 0 to 512 [ 81.147035][ T6059] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 81.149776][ T6059] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:487: comm syz.2.333: Invalid block bitmap block 0 in block_group 0 [ 81.149796][ T6059] loop2: lost filesystem error report for type 5 error -117 [ 81.155449][ T6059] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 81.155470][ T6059] loop2: lost filesystem error report for type 5 error -117 [ 81.159721][ C0] EXT4-fs (loop2): error count since last fsck: 2 [ 81.159737][ C0] EXT4-fs (loop2): initial error at time 81: ext4_read_block_bitmap_nowait:487 [ 81.159750][ C0] EXT4-fs (loop2): last error at time 81: ext4_mb_clear_bb:6680 [ 81.161832][ T6059] EXT4-fs error (device loop2): ext4_clear_blocks:876: inode #11: comm syz.2.333: attempt to clear invalid blocks 983261 len 1 [ 81.161857][ T6059] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 81.162046][ T6059] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz.2.333: Invalid inode table block 0 in block_group 0 [ 81.162059][ T6059] loop2: lost filesystem error report for type 5 error -117 [ 81.162902][ T6059] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 81.162924][ T6059] loop2: lost filesystem error report for type 5 error -117 [ 81.163073][ T6059] EXT4-fs error (device loop2) in ext4_orphan_del:304: Corrupt filesystem [ 81.163083][ T6059] loop2: lost filesystem error report for type 5 error -117 [ 81.163195][ T6059] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz.2.333: Invalid inode table block 0 in block_group 0 [ 81.163207][ T6059] loop2: lost filesystem error report for type 5 error -117 [ 81.163312][ T6059] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 81.163321][ T6059] loop2: lost filesystem error report for type 5 error -117 [ 81.163424][ T6059] EXT4-fs error (device loop2): ext4_truncate:4721: inode #11: comm syz.2.333: mark_inode_dirty error [ 81.163435][ T6059] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 81.163544][ T6059] EXT4-fs error (device loop2) in ext4_process_orphan:346: Corrupt filesystem [ 81.163552][ T6059] loop2: lost filesystem error report for type 5 error -117 [ 81.163662][ T6059] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz.2.333: Invalid inode table block 0 in block_group 0 [ 81.163672][ T6059] loop2: lost filesystem error report for type 5 error -117 [ 81.163900][ T6059] EXT4-fs (loop2): 1 truncate cleaned up [ 81.164350][ T6059] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 81.238583][ T6059] EXT4-fs error (device loop2): ext4_read_inode_bitmap:141: comm syz.2.333: Invalid inode bitmap blk 0 in block_group 0 [ 81.249968][ T6059] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz.2.333: Invalid inode table block 0 in block_group 0 [ 81.255415][ T6059] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz.2.333: Invalid inode table block 0 in block_group 0 [ 81.257266][ T6059] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz.2.333: Invalid inode table block 0 in block_group 0 [ 81.714819][ T6083] siw: device registration error -23 [ 81.986484][ T6090] netlink: 44 bytes leftover after parsing attributes in process `syz.3.345'. [ 82.022708][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 82.037560][ T6094] loop4: detected capacity change from 0 to 1024 [ 82.037889][ T6094] EXT4-fs: Ignoring removed i_version option [ 82.059087][ T6094] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 82.068444][ T6094] EXT4-fs error (device loop4): ext4_xattr_block_get:608: inode #15: comm syz.4.347: corrupted xattr block 128: overlapping e_value [ 82.078630][ T6094] EXT4-fs error (device loop4): ext4_xattr_block_get:608: inode #15: comm syz.4.347: corrupted xattr block 128: overlapping e_value [ 82.079649][ T6094] EXT4-fs error (device loop4): ext4_xattr_block_get:608: inode #15: comm syz.4.347: corrupted xattr block 128: overlapping e_value [ 82.113126][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 82.114385][ T6107] loop2: detected capacity change from 0 to 256 [ 82.261501][ T6120] loop4: detected capacity change from 0 to 1024 [ 82.266706][ T6120] EXT4-fs (loop4): warning: mounting unchecked fs, running e2fsck is recommended [ 82.277878][ T6120] EXT4-fs (loop4): Errors on filesystem, clearing orphan list. [ 82.278329][ T6120] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 82.375486][ T6129] loop2: detected capacity change from 0 to 1024 [ 82.376708][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 82.398409][ T6091] loop1: detected capacity change from 0 to 1024 [ 82.413647][ T6091] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (32298!=35945) [ 82.413704][ T6091] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 82.415495][ T6129] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 82.416453][ T6129] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 82.424687][ T6091] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 82.424812][ T6091] EXT4-fs (loop1): orphan cleanup on readonly fs [ 82.425014][ T6091] EXT4-fs error (device loop1): ext4_read_inode_bitmap:169: comm syz.1.338: Inode bitmap for bg 0 marked uninitialized [ 82.425027][ T6091] loop1: lost filesystem error report for type 5 error -117 [ 82.425604][ T6091] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 82.436801][ T6129] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 82.436914][ T6129] EXT4-fs (loop2): orphan cleanup on readonly fs [ 82.448475][ T6129] EXT4-fs error (device loop2): ext4_map_blocks:832: inode #3: block 3: comm syz.2.361: lblock 3 mapped to illegal pblock 3 (length 1) [ 82.448504][ T6129] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 82.449722][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 82.449741][ C0] EXT4-fs (loop2): initial error at time 82: ext4_map_blocks:832: inode 3: block 3 [ 82.449773][ C0] EXT4-fs (loop2): last error at time 82: ext4_map_blocks:832: inode 3: block 3 [ 82.458567][ T4719] Bluetooth: hci0: unexpected cc 0x0c05 length: 4 > 1 [ 82.458586][ T4719] Bluetooth: hci0: unexpected event for opcode 0x0c05 [ 82.465096][ T6129] Quota error (device loop2): write_blk: dquota write failed [ 82.465117][ T6129] Quota error (device loop2): find_free_dqentry: Can't write quota data block 3 [ 82.465177][ T6129] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 82.465205][ T6129] EXT4-fs error (device loop2): ext4_acquire_dquot:7069: comm syz.2.361: Failed to acquire dquot type 0 [ 82.468040][ T6129] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 3: comm syz.2.361: lblock 3 mapped to illegal pblock 3 (length 1) [ 82.468059][ T6129] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 82.468978][ T6129] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 82.469006][ T6129] EXT4-fs error (device loop2): ext4_acquire_dquot:7069: comm syz.2.361: Failed to acquire dquot type 0 [ 82.469894][ T6129] EXT4-fs error (device loop2): ext4_free_blocks:6719: comm syz.2.361: Freeing blocks not in datazone - block = 0, count = 4096 [ 82.483004][ T6129] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 3: comm syz.2.361: lblock 3 mapped to illegal pblock 3 (length 1) [ 82.483029][ T6129] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 82.487217][ T6129] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 82.487247][ T6129] EXT4-fs error (device loop2): ext4_acquire_dquot:7069: comm syz.2.361: Failed to acquire dquot type 0 [ 82.488119][ T6129] EXT4-fs (loop2): 1 orphan inode deleted [ 82.495097][ T6129] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 82.527098][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 82.655906][ T6146] EXT4-fs (loop2): Test dummy encryption mode enabled [ 82.923682][ T6146] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 82.948064][ T6146] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-ce" [ 83.011763][ T30] audit: type=1326 audit(83.000:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6149 comm="syz.0.370" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff88b79368 code=0x0 [ 83.288528][ T6152] evm: overlay not supported [ 84.067127][ T6155] netlink: 32 bytes leftover after parsing attributes in process `syz.0.370'. [ 84.138948][ T6161] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 84.240905][ T6161] EXT4-fs error (device loop4): ext4_validate_block_bitmap:445: comm syz.4.373: bg 0: block 400: padding at end of block bitmap is not set [ 84.246269][ T6161] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 84.248073][ T6161] EXT4-fs error (device loop4): ext4_xattr_inode_iget:437: inode #12: comm syz.4.373: missing EA_INODE flag [ 84.248905][ T6161] EXT4-fs error (device loop4): ext4_xattr_inode_iget:442: comm syz.4.373: error while reading EA inode 12 err=-117 [ 84.251649][ T6161] EXT4-fs error (device loop4): ext4_xattr_inode_iget:437: inode #12: comm syz.4.373: missing EA_INODE flag [ 84.251878][ T6161] EXT4-fs error (device loop4): ext4_xattr_inode_iget:442: comm syz.4.373: error while reading EA inode 12 err=-117 [ 84.273434][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.283061][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.618657][ T6173] set_capacity_and_notify: 2 callbacks suppressed [ 84.618671][ T6173] loop4: detected capacity change from 0 to 256 [ 84.828511][ T6192] loop2: detected capacity change from 0 to 256 [ 84.942817][ T6205] ip_tables: iptables: counters copy to user failed while replacing table [ 84.943869][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 85.017504][ T49] nvmet: connect request for invalid subsystem testsubsys! [ 85.018033][ T6215] nvme nvme1: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 85.043682][ T6218] netlink: 36 bytes leftover after parsing attributes in process `syz.1.398'. [ 85.184182][ T6236] openvswitch: netlink: Flow actions attr not present in new flow. [ 85.278652][ T6257] loop4: detected capacity change from 0 to 128 [ 85.291888][ T6257] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 85.303659][ T6257] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 85.315663][ T6261] netlink: 20 bytes leftover after parsing attributes in process `syz.1.418'. [ 85.327818][ T6255] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.328373][ T6255] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.338221][ T6263] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 85.431580][ T6255] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 85.436812][ T6255] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 85.462803][ T6275] block nbd1: NBD_DISCONNECT [ 85.575158][ T6287] loop4: detected capacity change from 0 to 2048 [ 85.593788][ T6287] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 85.632950][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 85.680866][ T5056] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.680898][ T5056] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.680916][ T5056] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.680931][ T5056] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.084570][ T6335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 86.084744][ T6335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.139397][ T6342] loop1: detected capacity change from 0 to 256 [ 87.266614][ T4719] Bluetooth: hci2: unexpected event for opcode 0x0c03 [ 87.630329][ T6402] netlink: 36 bytes leftover after parsing attributes in process `syz.2.477'. [ 88.214376][ T6446] loop4: detected capacity change from 0 to 128 [ 88.573103][ T6488] fuse: Unknown parameter 'fd0xffffffffffffffff' [ 88.631191][ T12] IPVS: starting estimator thread 0... [ 88.709729][ T6514] loop4: detected capacity change from 0 to 512 [ 88.712560][ T6514] EXT4-fs (loop4): Test dummy encryption mode enabled [ 88.716377][ T6512] fuse: Unknown parameter 'fd0xffffffffffffffff' [ 88.719816][ T6498] IPVS: using max 59 ests per chain, 141600 per kthread [ 88.743587][ T6514] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 88.784673][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.832148][ T6526] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.533'. [ 88.838183][ T6526] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.533'. [ 88.880388][ T6535] loop4: detected capacity change from 0 to 8 [ 88.895896][ T6537] Driver unsupported XDP return value 0 on prog (id 15) dev N/A, expect packet loss! [ 88.903658][ T6535] SQUASHFS error: Unable to read directory block [6aa:8] [ 89.123135][ T6572] netlink: 8 bytes leftover after parsing attributes in process `syz.1.554'. [ 90.159590][ T6616] loop4: detected capacity change from 0 to 256 [ 90.231937][ T6623] netlink: 16 bytes leftover after parsing attributes in process `syz.2.578'. [ 90.282632][ T6631] netlink: 4 bytes leftover after parsing attributes in process `syz.0.581'. [ 90.396911][ T6651] process 'syz.3.589' launched './file0' with NULL argv: empty string added [ 90.479262][ T6664] loop2: detected capacity change from 0 to 512 [ 90.498081][ T6664] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 90.506405][ T6664] EXT4-fs error (device loop2): ext4_free_branches:1023: inode #11: comm syz.2.595: invalid indirect mapped block 9 (level 0) [ 90.506430][ T6664] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 90.508473][ T6664] EXT4-fs (loop2): 1 truncate cleaned up [ 90.509024][ T6664] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 90.528702][ T6664] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 90.536028][ T6664] overlayfs: failed to set uuid (/file0, err=-28); falling back to uuid=null. [ 90.546942][ T4715] EXT4-fs error (device loop2): htree_dirblock_to_tree:1080: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 90.642181][ T6685] sctp: [Deprecated]: syz.0.605 (pid 6685) Use of struct sctp_assoc_value in delayed_ack socket option. [ 90.642181][ T6685] Use struct sctp_sack_info instead [ 90.730026][ T4719] block nbd0: Receive control failed (result -32) [ 90.730646][ T51] block nbd0: Receive control failed (result -32) [ 90.798392][ T6416] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 90.844800][ T6084] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.882648][ T6716] md: md0 stopped. [ 90.910227][ T4708] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 90.911121][ T4708] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 90.911503][ T4708] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 90.912271][ T4708] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 90.912609][ T4708] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 90.943738][ T6084] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.022482][ T6084] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.031298][ T6735] input: syz0 as /devices/virtual/input/input3 [ 91.031337][ T6735] input: failed to attach handler leds to device input3, error: -6 [ 91.098804][ T6084] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.127356][ T6719] lo speed is unknown, defaulting to 1000 [ 91.180420][ T6753] netlink: 104 bytes leftover after parsing attributes in process `syz.4.632'. [ 91.262490][ T6764] loop4: detected capacity change from 0 to 512 [ 91.273541][ T6084] bridge_slave_1: left allmulticast mode [ 91.273565][ T6084] bridge_slave_1: left promiscuous mode [ 91.274556][ T6084] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.286916][ T6084] bridge_slave_0: left allmulticast mode [ 91.286932][ T6084] bridge_slave_0: left promiscuous mode [ 91.287012][ T6084] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.294920][ T6764] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 91.333140][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 91.386729][ T6775] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 91.437002][ T6084] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 91.447515][ T6084] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 91.470901][ T6084] bond0 (unregistering): Released all slaves [ 91.494029][ T6719] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.494143][ T6719] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.494197][ T6719] bridge_slave_0: entered allmulticast mode [ 91.494712][ T6719] bridge_slave_0: entered promiscuous mode [ 91.501181][ T6719] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.501231][ T6719] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.501317][ T6719] bridge_slave_1: entered allmulticast mode [ 91.501745][ T6719] bridge_slave_1: entered promiscuous mode [ 91.526603][ T6719] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.530717][ T6719] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.537927][ T6719] team0: Port device team_slave_0 added [ 91.539219][ T6719] team0: Port device team_slave_1 added [ 91.547381][ T6719] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.547393][ T6719] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.547405][ T6719] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.551389][ T6719] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.551398][ T6719] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.551414][ T6719] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.573358][ T6719] hsr_slave_0: entered promiscuous mode [ 91.573650][ T6719] hsr_slave_1: entered promiscuous mode [ 91.575118][ T6719] debugfs: 'hsr0' already exists in 'hsr' [ 91.575129][ T6719] Cannot create hsr debugfs directory [ 91.578139][ T4396] 8021q: adding VLAN 0 to HW filter on device eth0 [ 91.578509][ T6084] tipc: Left network mode [ 91.978938][ T6719] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 91.981558][ T6719] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 91.981919][ T6719] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 92.000948][ T6719] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.002731][ T6719] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 92.005793][ T6719] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.036794][ T6719] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 92.053952][ T6719] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.081186][ T6820] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 92.095500][ T6719] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.095530][ T6719] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.203239][ T6719] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.218498][ T6084] hsr_slave_0: left promiscuous mode [ 92.223633][ T6084] hsr_slave_1: left promiscuous mode [ 92.223994][ T6084] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 92.224013][ T6084] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 92.227362][ T6084] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 92.227375][ T6084] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 92.253926][ T6084] veth1_macvtap: left promiscuous mode [ 92.253965][ T6084] veth0_macvtap: left promiscuous mode [ 92.254066][ T6084] veth1_vlan: left promiscuous mode [ 92.254110][ T6084] veth0_vlan: left promiscuous mode [ 92.269858][ T6844] xt_hashlimit: size too large, truncated to 1048576 [ 92.441264][ T6852] loop1: detected capacity change from 0 to 4096 [ 92.444092][ T6852] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 92.444104][ T6852] EXT4-fs (loop1): Test dummy encryption mode enabled [ 92.444853][ T6852] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a84ec018, mo2=0003] [ 92.444890][ T6852] System zones: 0-5 [ 92.446319][ T6852] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 92.553590][ T6084] team0 (unregistering): Port device team_slave_1 removed [ 92.560022][ T6084] team0 (unregistering): Port device team_slave_0 removed [ 92.563919][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 92.648877][ T4396] 8021q: adding VLAN 0 to HW filter on device eth1 [ 92.669583][ T1139] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.678197][ T6719] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.678424][ T6871] loop1: detected capacity change from 0 to 512 [ 92.689182][ T1139] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.689212][ T1139] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.696435][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.696463][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.723409][ T6871] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 92.843212][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 92.946311][ T6900] logitech-hidpp-device 0005:046D:B012.0002: received hid++ report of bad size (22) [ 92.947623][ T4889] logitech-hidpp-device 0005:046D:B012.0002: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 92.963584][ T6719] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.973196][ T51] Bluetooth: hci4: command tx timeout [ 92.977933][ T6084] IPVS: stop unused estimator thread 0... [ 92.997038][ T6904] fido_id[6904]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 93.014937][ T6905] FAULT_INJECTION: forcing a failure. [ 93.014937][ T6905] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 93.014954][ T6905] CPU: 0 UID: 0 PID: 6905 Comm: syz.4.664 Not tainted syzkaller #0 PREEMPT [ 93.014964][ T6905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 93.014969][ T6905] Call trace: [ 93.014972][ T6905] show_stack+0x2c/0x3c (C) [ 93.014992][ T6905] __dump_stack+0x30/0x40 [ 93.015004][ T6905] dump_stack_lvl+0xd8/0x12c [ 93.015015][ T6905] dump_stack+0x1c/0x28 [ 93.015026][ T6905] should_fail_ex+0x418/0x58c [ 93.015039][ T6905] should_fail+0x14/0x24 [ 93.015050][ T6905] should_fail_usercopy+0x20/0x30 [ 93.015062][ T6905] bpf_vlog_reverse_ubuf+0x370/0x578 [ 93.015076][ T6905] bpf_vlog_finalize+0x164/0x36c [ 93.015087][ T6905] bpf_log_attr_finalize+0x90/0x28c [ 93.015100][ T6905] btf_new_fd+0x3a8/0xa24 [ 93.015111][ T6905] bpf_btf_load+0x144/0x190 [ 93.015121][ T6905] __sys_bpf+0x7f0/0x82c [ 93.015130][ T6905] __arm64_sys_bpf+0xd0/0xec [ 93.015138][ T6905] invoke_syscall+0x98/0x244 [ 93.015151][ T6905] el0_svc_common+0xec/0x23c [ 93.015162][ T6905] do_el0_svc+0x4c/0x5c [ 93.015173][ T6905] el0_svc+0x60/0x1d8 [ 93.015185][ T6905] el0t_64_sync_handler+0x44/0x104 [ 93.015195][ T6905] el0t_64_sync+0x198/0x19c [ 93.030373][ T867] kernel write not supported for file bpf-prog (pid: 867 comm: kworker/0:2) [ 93.088787][ T6920] loop4: detected capacity change from 0 to 512 [ 93.089166][ T6920] EXT4-fs: Ignoring removed mblk_io_submit option [ 93.113608][ T6920] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 93.158461][ T4396] 8021q: adding VLAN 0 to HW filter on device eth2 [ 93.163929][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.172554][ T6719] veth0_vlan: entered promiscuous mode [ 93.177514][ T6719] veth1_vlan: entered promiscuous mode [ 93.211675][ T6719] veth0_macvtap: entered promiscuous mode [ 93.216424][ T6719] veth1_macvtap: entered promiscuous mode [ 93.232508][ T6719] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.237405][ T6719] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.254307][ T51] Bluetooth: hci0: unexpected cc 0x0c47 length: 2 > 1 [ 93.279825][ T5056] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.279940][ T5056] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.279956][ T5056] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.279971][ T5056] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.305907][ T6084] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.305919][ T6084] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.323336][ T6084] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.323349][ T6084] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.418454][ T4396] 8021q: adding VLAN 0 to HW filter on device eth3 [ 93.588863][ T6975] FAULT_INJECTION: forcing a failure. [ 93.588863][ T6975] name failslab, interval 1, probability 0, space 0, times 0 [ 93.588884][ T6975] CPU: 0 UID: 0 PID: 6975 Comm: syz.4.683 Not tainted syzkaller #0 PREEMPT [ 93.588894][ T6975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 93.588899][ T6975] Call trace: [ 93.588902][ T6975] show_stack+0x2c/0x3c (C) [ 93.588923][ T6975] __dump_stack+0x30/0x40 [ 93.588936][ T6975] dump_stack_lvl+0xd8/0x12c [ 93.588947][ T6975] dump_stack+0x1c/0x28 [ 93.588958][ T6975] should_fail_ex+0x418/0x58c [ 93.588971][ T6975] should_failslab+0xc4/0x120 [ 93.588984][ T6975] __kmalloc_node_track_caller_noprof+0x108/0x6e0 [ 93.588994][ T6975] kmemdup_noprof+0x44/0x8c [ 93.589003][ T6975] register_pidns_sysctls+0x50/0x1d0 [ 93.589016][ T6975] copy_pid_ns+0x53c/0x918 [ 93.589026][ T6975] create_new_namespaces+0x21c/0x50c [ 93.589037][ T6975] unshare_nsproxy_namespaces+0x120/0x170 [ 93.589047][ T6975] ksys_unshare+0x438/0x6cc [ 93.589057][ T6975] __arm64_sys_unshare+0x40/0x54 [ 93.589066][ T6975] invoke_syscall+0x98/0x244 [ 93.589079][ T6975] el0_svc_common+0xec/0x23c [ 93.589090][ T6975] do_el0_svc+0x4c/0x5c [ 93.589101][ T6975] el0_svc+0x60/0x1d8 [ 93.589113][ T6975] el0t_64_sync_handler+0x44/0x104 [ 93.589123][ T6975] el0t_64_sync+0x198/0x19c [ 93.933201][ T6992] loop4: detected capacity change from 0 to 512 [ 93.957322][ T6992] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.685: corrupted in-inode xattr: invalid ea_ino [ 93.957344][ T6992] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 93.957490][ T6992] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.685: couldn't read orphan inode 15 (err -117) [ 93.957502][ T6992] fserror_report: 4 callbacks suppressed [ 93.957507][ T6992] loop4: lost filesystem error report for type 5 error -117 [ 93.958095][ T6992] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 93.998155][ T6995] FAULT_INJECTION: forcing a failure. [ 93.998155][ T6995] name failslab, interval 1, probability 0, space 0, times 0 [ 93.998178][ T6995] CPU: 1 UID: 0 PID: 6995 Comm: syz.1.689 Not tainted syzkaller #0 PREEMPT [ 93.998189][ T6995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 93.998195][ T6995] Call trace: [ 93.998198][ T6995] show_stack+0x2c/0x3c (C) [ 93.998220][ T6995] __dump_stack+0x30/0x40 [ 93.998232][ T6995] dump_stack_lvl+0xd8/0x12c [ 93.998244][ T6995] dump_stack+0x1c/0x28 [ 93.998255][ T6995] should_fail_ex+0x418/0x58c [ 93.998268][ T6995] should_failslab+0xc4/0x120 [ 93.998280][ T6995] __kmalloc_node_noprof+0x10c/0x6e4 [ 93.998294][ T6995] load_msg+0x4c/0x270 [ 93.998302][ T6995] do_msgrcv+0x1e0/0x1024 [ 93.998311][ T6995] __arm64_sys_msgrcv+0xd0/0xe8 [ 93.998319][ T6995] invoke_syscall+0x98/0x244 [ 93.998331][ T6995] el0_svc_common+0xec/0x23c [ 93.998343][ T6995] do_el0_svc+0x4c/0x5c [ 93.998354][ T6995] el0_svc+0x60/0x1d8 [ 93.998366][ T6995] el0t_64_sync_handler+0x44/0x104 [ 93.998376][ T6995] el0t_64_sync+0x198/0x19c [ 94.026886][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 94.048459][ T6997] fuse: fd is not a fuse device [ 94.163126][ T6292] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 94.164251][ T6292] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 94.185550][ T7010] loop4: detected capacity change from 0 to 4096 [ 94.288221][ T7026] FAULT_INJECTION: forcing a failure. [ 94.288221][ T7026] name failslab, interval 1, probability 0, space 0, times 0 [ 94.288241][ T7026] CPU: 1 UID: 0 PID: 7026 Comm: syz.4.702 Not tainted syzkaller #0 PREEMPT [ 94.288252][ T7026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 94.288257][ T7026] Call trace: [ 94.288260][ T7026] show_stack+0x2c/0x3c (C) [ 94.288282][ T7026] __dump_stack+0x30/0x40 [ 94.288295][ T7026] dump_stack_lvl+0xd8/0x12c [ 94.288306][ T7026] dump_stack+0x1c/0x28 [ 94.288317][ T7026] should_fail_ex+0x418/0x58c [ 94.288330][ T7026] should_failslab+0xc4/0x120 [ 94.288344][ T7026] kmem_cache_alloc_noprof+0x94/0x5d4 [ 94.288358][ T7026] mpol_new+0x14c/0x264 [ 94.288367][ T7026] do_set_mempolicy+0xa4/0x280 [ 94.288376][ T7026] __arm64_sys_set_mempolicy+0x1a0/0x1f8 [ 94.288385][ T7026] invoke_syscall+0x98/0x244 [ 94.288398][ T7026] el0_svc_common+0xec/0x23c [ 94.288410][ T7026] do_el0_svc+0x4c/0x5c [ 94.288421][ T7026] el0_svc+0x60/0x1d8 [ 94.288433][ T7026] el0t_64_sync_handler+0x44/0x104 [ 94.288443][ T7026] el0t_64_sync+0x198/0x19c [ 94.379035][ T7032] loop4: detected capacity change from 0 to 128 [ 94.382044][ T7032] EXT4-fs (loop4): Test dummy encryption mode enabled [ 94.403622][ T7032] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 94.452682][ T4712] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 94.536437][ T7049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.536620][ T7049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.061439][ T51] Bluetooth: hci4: command tx timeout [ 95.148663][ T7057] FAULT_INJECTION: forcing a failure. [ 95.148663][ T7057] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 95.148736][ T7057] CPU: 0 UID: 0 PID: 7057 Comm: syz.1.713 Not tainted syzkaller #0 PREEMPT [ 95.148750][ T7057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 95.148756][ T7057] Call trace: [ 95.148763][ T7057] show_stack+0x2c/0x3c (C) [ 95.148786][ T7057] __dump_stack+0x30/0x40 [ 95.148799][ T7057] dump_stack_lvl+0xd8/0x12c [ 95.148810][ T7057] dump_stack+0x1c/0x28 [ 95.148821][ T7057] should_fail_ex+0x418/0x58c [ 95.148834][ T7057] should_fail_alloc_page+0xec/0x10c [ 95.148847][ T7057] prepare_alloc_pages+0x194/0x484 [ 95.148860][ T7057] __alloc_frozen_pages_noprof+0x180/0x578 [ 95.148873][ T7057] alloc_pages_mpol+0x1fc/0x3d0 [ 95.148882][ T7057] folio_alloc_mpol_noprof+0x4c/0x248 [ 95.148893][ T7057] alloc_migration_target_by_mpol+0x25c/0x494 [ 95.148903][ T7057] migrate_pages_batch+0x738/0x2bc4 [ 95.148915][ T7057] migrate_pages+0x185c/0x23e4 [ 95.148927][ T7057] __arm64_sys_mbind+0x73c/0x994 [ 95.148936][ T7057] invoke_syscall+0x98/0x244 [ 95.148947][ T7057] el0_svc_common+0xec/0x23c [ 95.148959][ T7057] do_el0_svc+0x4c/0x5c [ 95.148970][ T7057] el0_svc+0x60/0x1d8 [ 95.148981][ T7057] el0t_64_sync_handler+0x44/0x104 [ 95.148991][ T7057] el0t_64_sync+0x198/0x19c [ 95.229550][ T7074] device-mapper: ioctl: Invalid ioctl structure: name m, dev f801 [ 95.614619][ T7089] loop4: detected capacity change from 0 to 512 [ 95.619570][ T7089] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 95.626848][ T7089] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:487: comm syz.4.723: Invalid block bitmap block 0 in block_group 0 [ 95.626867][ T7089] loop4: lost filesystem error report for type 5 error -117 [ 95.627039][ T7089] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 95.627049][ T7089] loop4: lost filesystem error report for type 5 error -117 [ 95.629726][ C1] EXT4-fs (loop4): error count since last fsck: 2 [ 95.629739][ C1] EXT4-fs (loop4): initial error at time 95: ext4_read_block_bitmap_nowait:487 [ 95.629754][ C1] EXT4-fs (loop4): last error at time 95: ext4_mb_clear_bb:6680 [ 95.641514][ T7089] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #11: comm syz.4.723: attempt to clear invalid blocks 983261 len 1 [ 95.641543][ T7089] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 95.645819][ T7089] EXT4-fs error (device loop4): __ext4_get_inode_loc:4916: comm syz.4.723: Invalid inode table block 0 in block_group 0 [ 95.645836][ T7089] loop4: lost filesystem error report for type 5 error -117 [ 95.645972][ T7089] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 95.645982][ T7089] loop4: lost filesystem error report for type 5 error -117 [ 95.646092][ T7089] EXT4-fs error (device loop4) in ext4_orphan_del:304: Corrupt filesystem [ 95.646101][ T7089] loop4: lost filesystem error report for type 5 error -117 [ 95.646464][ T7089] EXT4-fs error (device loop4): __ext4_get_inode_loc:4916: comm syz.4.723: Invalid inode table block 0 in block_group 0 [ 95.646485][ T7089] loop4: lost filesystem error report for type 5 error -117 [ 95.667409][ T7089] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 95.667431][ T7089] loop4: lost filesystem error report for type 5 error -117 [ 95.668276][ T7089] EXT4-fs error (device loop4): ext4_truncate:4721: inode #11: comm syz.4.723: mark_inode_dirty error [ 95.668301][ T7089] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 95.668458][ T7089] EXT4-fs error (device loop4) in ext4_process_orphan:346: Corrupt filesystem [ 95.668468][ T7089] loop4: lost filesystem error report for type 5 error -117 [ 95.668590][ T7089] EXT4-fs error (device loop4): __ext4_get_inode_loc:4916: comm syz.4.723: Invalid inode table block 0 in block_group 0 [ 95.668602][ T7089] loop4: lost filesystem error report for type 5 error -117 [ 95.668744][ T7089] EXT4-fs (loop4): 1 truncate cleaned up [ 95.669317][ T7089] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.674243][ T7094] EXT4-fs error (device loop4): __ext4_get_inode_loc:4916: comm iou-wrk-7089: Invalid inode table block 0 in block_group 0 [ 95.718868][ T4712] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 96.362447][ T7126] fuse: fd is not a fuse device [ 96.666682][ T7138] fuse: fd is not a fuse device [ 96.683470][ T7140] overlayfs: failed to clone upperpath [ 97.077798][ T51] block nbd5: Receive control failed (result -107) [ 97.082932][ T7163] nbd5: detected capacity change from 0 to 8589934592 [ 97.084620][ T4383] block nbd5: Dead connection, failed to find a fallback [ 97.084632][ T4383] block nbd5: shutting down sockets [ 97.084656][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.084670][ T4383] buffer_io_error: 4710 callbacks suppressed [ 97.084675][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085408][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.085427][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085477][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.085487][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085531][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.085541][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085583][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.085593][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085639][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.085649][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085699][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.085709][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085747][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.085757][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085781][ T7163] ldm_validate_partition_table(): Disk read failed. [ 97.085819][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.085828][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085866][ T4383] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 97.085876][ T4383] Buffer I/O error on dev nbd5, logical block 0, async page read [ 97.085958][ T7163] Dev nbd5: unable to read RDB block 0 [ 97.086230][ T7163] nbd5: unable to read partition table [ 97.088183][ T5666] ldm_validate_partition_table(): Disk read failed. [ 97.088317][ T5666] Dev nbd5: unable to read RDB block 0 [ 97.088467][ T5666] nbd5: unable to read partition table [ 97.089746][ T5666] ldm_validate_partition_table(): Disk read failed. [ 97.089897][ T5666] Dev nbd5: unable to read RDB block 0 [ 97.090214][ T5666] nbd5: unable to read partition table [ 97.130410][ T51] Bluetooth: hci4: command tx timeout [ 97.164393][ T7168] syzkaller1: entered promiscuous mode [ 97.164410][ T7168] syzkaller1: entered allmulticast mode [ 97.295540][ T30] audit: type=1326 audit(97.280:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7171 comm="syz.5.755" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff87f79368 code=0x0 [ 98.182425][ T7194] FAULT_INJECTION: forcing a failure. [ 98.182425][ T7194] name failslab, interval 1, probability 0, space 0, times 0 [ 98.182446][ T7194] CPU: 0 UID: 0 PID: 7194 Comm: syz.5.763 Not tainted syzkaller #0 PREEMPT [ 98.182457][ T7194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 98.182462][ T7194] Call trace: [ 98.182465][ T7194] show_stack+0x2c/0x3c (C) [ 98.182487][ T7194] __dump_stack+0x30/0x40 [ 98.182499][ T7194] dump_stack_lvl+0xd8/0x12c [ 98.182511][ T7194] dump_stack+0x1c/0x28 [ 98.182522][ T7194] should_fail_ex+0x418/0x58c [ 98.182535][ T7194] should_failslab+0xc4/0x120 [ 98.182548][ T7194] kmem_cache_alloc_noprof+0x94/0x5d4 [ 98.182561][ T7194] alloc_empty_file+0x6c/0x1cc [ 98.182569][ T7194] alloc_file+0x58/0x98 [ 98.182577][ T7194] alloc_file_clone+0x34/0xac [ 98.182585][ T7194] create_pipe_files+0x30c/0x650 [ 98.182598][ T7194] __do_pipe_flags+0x5c/0x204 [ 98.182610][ T7194] do_pipe2+0xa0/0x250 [ 98.182617][ T7194] __arm64_sys_pipe2+0x64/0x7c [ 98.182629][ T7194] invoke_syscall+0x98/0x244 [ 98.182641][ T7194] el0_svc_common+0xec/0x23c [ 98.182653][ T7194] do_el0_svc+0x4c/0x5c [ 98.182664][ T7194] el0_svc+0x60/0x1d8 [ 98.182675][ T7194] el0t_64_sync_handler+0x44/0x104 [ 98.182685][ T7194] el0t_64_sync+0x198/0x19c [ 98.238347][ T7205] input: syz0 as /devices/virtual/input/input6 [ 98.328262][ T7212] loop5: detected capacity change from 0 to 8 [ 98.336534][ T7212] squashfs: SQUASHFS error: Xattrs in filesystem, these will be ignored [ 98.336546][ T7212] unable to read xattr id index table [ 98.336984][ T7212] SQUASHFS error: zlib decompression failed, data probably corrupt [ 98.336998][ T7212] SQUASHFS error: Failed to read block 0x9b: -5 [ 98.337005][ T7212] SQUASHFS error: Unable to read metadata cache entry [99] [ 98.337011][ T7212] SQUASHFS error: Unable to read inode 0x127 [ 98.338923][ T7214] batman_adv: batadv0: Adding interface: syzkaller0 [ 98.338934][ T7214] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.338951][ T7214] batman_adv: batadv0: Interface activated: syzkaller0 [ 98.358680][ T7212] tc_dump_action: action bad kind [ 98.362974][ T7212] loop5: detected capacity change from 0 to 512 [ 98.377444][ T7212] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 98.405228][ T7212] EXT4-fs warning (device loop5): ext4_update_dynamic_rev:1148: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 98.405939][ T7212] EXT4-fs error (device loop5): ext4_validate_block_bitmap:445: comm syz.5.769: bg 0: block 248: padding at end of block bitmap is not set [ 98.407112][ T7212] Quota error (device loop5): write_blk: dquota write failed [ 98.407140][ T7212] Quota error (device loop5): qtree_write_dquot: Error -28 occurred while creating quota [ 98.407159][ T7212] EXT4-fs error (device loop5): ext4_acquire_dquot:7069: comm syz.5.769: Failed to acquire dquot type 1 [ 98.407720][ T7212] EXT4-fs (loop5): 1 truncate cleaned up [ 98.408242][ T7212] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0008-000000000000 r/w without journal. Quota mode: writeback. [ 98.409599][ T7212] Quota error (device loop5): do_check_range: Getting dqdh_prev_free 1536 out of range 0-5 [ 98.409634][ T7212] Quota error (device loop5): qtree_write_dquot: Error -117 occurred while creating quota [ 98.409648][ T7212] EXT4-fs error (device loop5): ext4_acquire_dquot:7069: comm syz.5.769: Failed to acquire dquot type 1 [ 98.654803][ T7213] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 98.655453][ T6719] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0008-000000000000. [ 98.669435][ T7213] batman_adv: batadv0: Removing interface: syzkaller0 [ 98.868049][ T7112] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 98.901993][ T7232] loop4: detected capacity change from 0 to 128 [ 98.931494][ T7237] loop1: detected capacity change from 0 to 1024 [ 98.968142][ T7237] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 98.997293][ T7243] FAULT_INJECTION: forcing a failure. [ 98.997293][ T7243] name failslab, interval 1, probability 0, space 0, times 0 [ 98.997314][ T7243] CPU: 1 UID: 0 PID: 7243 Comm: syz.4.780 Not tainted syzkaller #0 PREEMPT [ 98.997324][ T7243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 98.997330][ T7243] Call trace: [ 98.997332][ T7243] show_stack+0x2c/0x3c (C) [ 98.997352][ T7243] __dump_stack+0x30/0x40 [ 98.997364][ T7243] dump_stack_lvl+0xd8/0x12c [ 98.997376][ T7243] dump_stack+0x1c/0x28 [ 98.997387][ T7243] should_fail_ex+0x418/0x58c [ 98.997400][ T7243] should_failslab+0xc4/0x120 [ 98.997413][ T7243] __kmalloc_cache_noprof+0x94/0x5fc [ 98.997422][ T7243] pty_common_install+0xe4/0x66c [ 98.997431][ T7243] pty_unix98_install+0x2c/0x3c [ 98.997439][ T7243] tty_init_dev+0xb4/0x3a4 [ 98.997447][ T7243] ptmx_open+0x100/0x2d8 [ 98.997455][ T7243] chrdev_open+0x398/0x3e8 [ 98.997465][ T7243] do_dentry_open+0x5c4/0xfbc [ 98.997476][ T7243] vfs_open+0x44/0x2dc [ 98.997486][ T7243] path_openat+0x1084/0x18f0 [ 98.997496][ T7243] do_file_open+0x1c8/0x2e8 [ 98.997505][ T7243] do_sys_openat2+0x114/0x1e8 [ 98.997516][ T7243] do_sys_open+0xb0/0xe0 [ 98.997527][ T7243] __arm64_sys_openat+0xa8/0xc4 [ 98.997538][ T7243] invoke_syscall+0x98/0x244 [ 98.997550][ T7243] el0_svc_common+0xec/0x23c [ 98.997561][ T7243] do_el0_svc+0x4c/0x5c [ 98.997573][ T7243] el0_svc+0x60/0x1d8 [ 98.997584][ T7243] el0t_64_sync_handler+0x44/0x104 [ 98.997594][ T7243] el0t_64_sync+0x198/0x19c [ 99.040257][ T7236] netlink: 8 bytes leftover after parsing attributes in process `syz.0.778'. [ 99.083961][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 99.208076][ T7272] lo speed is unknown, defaulting to 1000 [ 99.211327][ T51] Bluetooth: hci4: command tx timeout [ 99.265118][ T7282] FAULT_INJECTION: forcing a failure. [ 99.265118][ T7282] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 99.265140][ T7282] CPU: 1 UID: 0 PID: 7282 Comm: syz.5.793 Not tainted syzkaller #0 PREEMPT [ 99.265151][ T7282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 99.265157][ T7282] Call trace: [ 99.265160][ T7282] show_stack+0x2c/0x3c (C) [ 99.265181][ T7282] __dump_stack+0x30/0x40 [ 99.265195][ T7282] dump_stack_lvl+0xd8/0x12c [ 99.265206][ T7282] dump_stack+0x1c/0x28 [ 99.265217][ T7282] should_fail_ex+0x418/0x58c [ 99.265231][ T7282] should_fail+0x14/0x24 [ 99.265242][ T7282] should_fail_usercopy+0x20/0x30 [ 99.265254][ T7282] _inline_copy_from_user+0x3c/0x188 [ 99.265263][ T7282] dm_ctl_ioctl+0x3e4/0xbbc [ 99.265271][ T7282] __arm64_sys_ioctl+0x154/0x1cc [ 99.265283][ T7282] invoke_syscall+0x98/0x244 [ 99.265295][ T7282] el0_svc_common+0xec/0x23c [ 99.265306][ T7282] do_el0_svc+0x4c/0x5c [ 99.265317][ T7282] el0_svc+0x60/0x1d8 [ 99.265329][ T7282] el0t_64_sync_handler+0x44/0x104 [ 99.265339][ T7282] el0t_64_sync+0x198/0x19c [ 99.315031][ T7290] FAULT_INJECTION: forcing a failure. [ 99.315031][ T7290] name failslab, interval 1, probability 0, space 0, times 0 [ 99.315053][ T7290] CPU: 1 UID: 0 PID: 7290 Comm: syz.5.796 Not tainted syzkaller #0 PREEMPT [ 99.315064][ T7290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 99.315070][ T7290] Call trace: [ 99.315074][ T7290] show_stack+0x2c/0x3c (C) [ 99.315096][ T7290] __dump_stack+0x30/0x40 [ 99.315108][ T7290] dump_stack_lvl+0xd8/0x12c [ 99.315120][ T7290] dump_stack+0x1c/0x28 [ 99.315131][ T7290] should_fail_ex+0x418/0x58c [ 99.315144][ T7290] should_failslab+0xc4/0x120 [ 99.315156][ T7290] __kmalloc_cache_noprof+0x94/0x5fc [ 99.315165][ T7290] alloc_tty_struct+0xb8/0x5d8 [ 99.315174][ T7290] pty_common_install+0x14c/0x66c [ 99.315182][ T7290] pty_unix98_install+0x2c/0x3c [ 99.315190][ T7290] tty_init_dev+0xb4/0x3a4 [ 99.315198][ T7290] ptmx_open+0x100/0x2d8 [ 99.315205][ T7290] chrdev_open+0x398/0x3e8 [ 99.315216][ T7290] do_dentry_open+0x5c4/0xfbc [ 99.315227][ T7290] vfs_open+0x44/0x2dc [ 99.315237][ T7290] path_openat+0x1084/0x18f0 [ 99.315247][ T7290] do_file_open+0x1c8/0x2e8 [ 99.315256][ T7290] do_sys_openat2+0x114/0x1e8 [ 99.315267][ T7290] do_sys_open+0xb0/0xe0 [ 99.315277][ T7290] __arm64_sys_openat+0xa8/0xc4 [ 99.315288][ T7290] invoke_syscall+0x98/0x244 [ 99.315300][ T7290] el0_svc_common+0xec/0x23c [ 99.315312][ T7290] do_el0_svc+0x4c/0x5c [ 99.315323][ T7290] el0_svc+0x60/0x1d8 [ 99.315334][ T7290] el0t_64_sync_handler+0x44/0x104 [ 99.315345][ T7290] el0t_64_sync+0x198/0x19c [ 99.426727][ T7307] FAULT_INJECTION: forcing a failure. [ 99.426727][ T7307] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 99.426748][ T7307] CPU: 1 UID: 0 PID: 7307 Comm: syz.5.802 Not tainted syzkaller #0 PREEMPT [ 99.426759][ T7307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 99.426764][ T7307] Call trace: [ 99.426767][ T7307] show_stack+0x2c/0x3c (C) [ 99.426796][ T7307] __dump_stack+0x30/0x40 [ 99.426811][ T7307] dump_stack_lvl+0xd8/0x12c [ 99.426822][ T7307] dump_stack+0x1c/0x28 [ 99.426833][ T7307] should_fail_ex+0x418/0x58c [ 99.426845][ T7307] should_fail+0x14/0x24 [ 99.426856][ T7307] should_fail_usercopy+0x20/0x30 [ 99.426868][ T7307] generic_map_lookup_batch+0x9d4/0x101c [ 99.426877][ T7307] bpf_map_do_batch+0x228/0x4d0 [ 99.426886][ T7307] __sys_bpf+0x7b4/0x82c [ 99.426895][ T7307] __arm64_sys_bpf+0xd0/0xec [ 99.426903][ T7307] invoke_syscall+0x98/0x244 [ 99.426915][ T7307] el0_svc_common+0xec/0x23c [ 99.426926][ T7307] do_el0_svc+0x4c/0x5c [ 99.426937][ T7307] el0_svc+0x60/0x1d8 [ 99.426948][ T7307] el0t_64_sync_handler+0x44/0x104 [ 99.426958][ T7307] el0t_64_sync+0x198/0x19c [ 99.516919][ T7311] FAULT_INJECTION: forcing a failure. [ 99.516919][ T7311] name failslab, interval 1, probability 0, space 0, times 0 [ 99.516941][ T7311] CPU: 0 UID: 0 PID: 7311 Comm: syz.5.805 Not tainted syzkaller #0 PREEMPT [ 99.516952][ T7311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 99.516957][ T7311] Call trace: [ 99.516961][ T7311] show_stack+0x2c/0x3c (C) [ 99.516979][ T7311] __dump_stack+0x30/0x40 [ 99.516991][ T7311] dump_stack_lvl+0xd8/0x12c [ 99.517003][ T7311] dump_stack+0x1c/0x28 [ 99.517014][ T7311] should_fail_ex+0x418/0x58c [ 99.517027][ T7311] should_failslab+0xc4/0x120 [ 99.517039][ T7311] __kmalloc_noprof+0x108/0x6c8 [ 99.517052][ T7311] tomoyo_realpath_from_path+0xbc/0x4dc [ 99.517063][ T7311] tomoyo_mount_permission+0x794/0x7e4 [ 99.517073][ T7311] tomoyo_sb_mount+0x48/0x60 [ 99.517084][ T7311] security_sb_mount+0xfc/0x308 [ 99.517097][ T7311] path_mount+0xb8/0xa88 [ 99.517107][ T7311] do_mount+0xe8/0x148 [ 99.517116][ T7311] __arm64_sys_mount+0x33c/0x388 [ 99.517127][ T7311] invoke_syscall+0x98/0x244 [ 99.517139][ T7311] el0_svc_common+0xec/0x23c [ 99.517150][ T7311] do_el0_svc+0x4c/0x5c [ 99.517161][ T7311] el0_svc+0x60/0x1d8 [ 99.517172][ T7311] el0t_64_sync_handler+0x44/0x104 [ 99.517182][ T7311] el0t_64_sync+0x198/0x19c [ 99.517192][ T7311] ERROR: Out of memory at tomoyo_realpath_from_path. [ 99.812473][ T7317] loop5: detected capacity change from 0 to 128 [ 99.815118][ T7317] EXT4-fs (loop5): mounting ext2 file system using the ext4 subsystem [ 99.825395][ T7317] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 99.861414][ T6719] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 100.088780][ T7280] nvme nvme1: failed to connect socket: -512 [ 100.121432][ T7333] netlink: 52 bytes leftover after parsing attributes in process `syz.4.811'. [ 100.125579][ T7333] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.125963][ T7333] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.154163][ T7335] FAULT_INJECTION: forcing a failure. [ 100.154163][ T7335] name failslab, interval 1, probability 0, space 0, times 0 [ 100.154183][ T7335] CPU: 0 UID: 0 PID: 7335 Comm: syz.4.812 Not tainted syzkaller #0 PREEMPT [ 100.154193][ T7335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 100.154198][ T7335] Call trace: [ 100.154201][ T7335] show_stack+0x2c/0x3c (C) [ 100.154221][ T7335] __dump_stack+0x30/0x40 [ 100.154233][ T7335] dump_stack_lvl+0xd8/0x12c [ 100.154244][ T7335] dump_stack+0x1c/0x28 [ 100.154256][ T7335] should_fail_ex+0x418/0x58c [ 100.154269][ T7335] should_failslab+0xc4/0x120 [ 100.154281][ T7335] kmem_cache_alloc_noprof+0x94/0x5d4 [ 100.154295][ T7335] anon_vma_fork+0x84/0x4d4 [ 100.154306][ T7335] dup_mmap+0x7d4/0x1998 [ 100.154315][ T7335] copy_mm+0xe8/0x324 [ 100.154324][ T7335] copy_process+0x1658/0x34bc [ 100.154332][ T7335] kernel_clone+0x234/0x8e8 [ 100.154345][ T7335] __arm64_sys_clone3+0x35c/0x390 [ 100.154354][ T7335] invoke_syscall+0x98/0x244 [ 100.154367][ T7335] el0_svc_common+0xec/0x23c [ 100.154378][ T7335] do_el0_svc+0x4c/0x5c [ 100.154390][ T7335] el0_svc+0x60/0x1d8 [ 100.154401][ T7335] el0t_64_sync_handler+0x44/0x104 [ 100.154412][ T7335] el0t_64_sync+0x198/0x19c [ 100.353582][ T7344] fuse: Bad value for 'fd' [ 100.446899][ T7350] syzkaller0: entered promiscuous mode [ 100.446918][ T7350] syzkaller0: entered allmulticast mode [ 101.116446][ T7373] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 101.245955][ T7379] loop4: detected capacity change from 0 to 256 [ 102.214804][ T7393] netlink: 52 bytes leftover after parsing attributes in process `syz.4.836'. [ 102.266257][ T7394] netlink: 52 bytes leftover after parsing attributes in process `syz.4.836'. [ 102.980436][ T7322] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 103.074592][ T7401] lo speed is unknown, defaulting to 1000 [ 103.169595][ T7423] netlink: 12 bytes leftover after parsing attributes in process `syz.4.848'. [ 103.286493][ T7433] loop5: detected capacity change from 0 to 512 [ 103.288057][ T7433] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 103.910561][ T7464] binder: 7463:7464 tried to acquire reference to desc 0, got 1 instead [ 103.910629][ T7464] binder: 7463:7464 got transaction with out-of-order buffer fixup [ 103.910638][ T7464] binder: 7464:7463 failed to fixup parent [ 103.910725][ T7464] binder: 7463:7464 transaction call to 7463:0 failed 18/29201/-22, code 0 size 104-24 line 3717 [ 103.911288][ T24] binder: undelivered TRANSACTION_ERROR: 29201 [ 103.934970][ T7466] loop5: detected capacity change from 0 to 128 [ 103.942896][ T7466] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 103.975597][ T6719] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 103.988488][ T7470] fuse: Bad value for 'fd' [ 104.398183][ T7499] fuse: fd is not a fuse device [ 104.508037][ T7518] batadv_slave_1: entered promiscuous mode [ 104.509140][ T7517] batadv_slave_1: left promiscuous mode [ 104.517961][ T7521] fuse: fd is not a fuse device [ 104.556685][ T7530] loop1: detected capacity change from 0 to 256 [ 104.558974][ T7530] vfat: Unknown parameter 'ÿÿ' [ 104.742049][ T7546] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 105.004019][ T7565] loop1: detected capacity change from 0 to 512 [ 105.005109][ T7565] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 105.494866][ T7566] psci: CPU1 killed (polled 0 ms) [ 105.702752][ T7600] FAULT_INJECTION: forcing a failure. [ 105.702752][ T7600] name failslab, interval 1, probability 0, space 0, times 0 [ 105.702780][ T7600] CPU: 0 UID: 0 PID: 7600 Comm: syz.5.894 Not tainted syzkaller #0 PREEMPT [ 105.702793][ T7600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 105.702801][ T7600] Call trace: [ 105.702804][ T7600] show_stack+0x2c/0x3c (C) [ 105.702826][ T7600] __dump_stack+0x30/0x40 [ 105.702840][ T7600] dump_stack_lvl+0xd8/0x12c [ 105.702852][ T7600] dump_stack+0x1c/0x28 [ 105.702862][ T7600] should_fail_ex+0x418/0x58c [ 105.702876][ T7600] should_failslab+0xc4/0x120 [ 105.702888][ T7600] kmem_cache_alloc_lru_noprof+0x98/0x5d8 [ 105.702901][ T7600] alloc_inode+0x84/0x198 [ 105.702912][ T7600] new_inode+0x20/0x50 [ 105.702922][ T7600] devpts_fill_super+0x13c/0x4c0 [ 105.702932][ T7600] vfs_get_super+0xb8/0x148 [ 105.702941][ T7600] get_tree_nodev+0x2c/0x3c [ 105.702949][ T7600] devpts_get_tree+0x28/0x38 [ 105.702958][ T7600] vfs_get_tree+0x90/0x28c [ 105.702967][ T7600] fc_mount+0x24/0xac [ 105.702976][ T7600] do_new_mount+0x2a4/0x538 [ 105.702985][ T7600] path_mount+0x5f0/0xa88 [ 105.702995][ T7600] do_mount+0xe8/0x148 [ 105.703005][ T7600] __arm64_sys_mount+0x33c/0x388 [ 105.703015][ T7600] invoke_syscall+0x98/0x244 [ 105.703027][ T7600] el0_svc_common+0xec/0x23c [ 105.703039][ T7600] do_el0_svc+0x4c/0x5c [ 105.703050][ T7600] el0_svc+0x60/0x1d8 [ 105.703061][ T7600] el0t_64_sync_handler+0x44/0x104 [ 105.703071][ T7600] el0t_64_sync+0x198/0x19c [ 106.871162][ T7647] fuse: fd is not a fuse device [ 107.355458][ T7659] FAULT_INJECTION: forcing a failure. [ 107.355458][ T7659] name failslab, interval 1, probability 0, space 0, times 0 [ 107.355484][ T7659] CPU: 0 UID: 0 PID: 7659 Comm: syz.1.914 Not tainted syzkaller #0 PREEMPT [ 107.355495][ T7659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 107.355501][ T7659] Call trace: [ 107.355504][ T7659] show_stack+0x2c/0x3c (C) [ 107.355525][ T7659] __dump_stack+0x30/0x40 [ 107.355538][ T7659] dump_stack_lvl+0xd8/0x12c [ 107.355549][ T7659] dump_stack+0x1c/0x28 [ 107.355561][ T7659] should_fail_ex+0x418/0x58c [ 107.355573][ T7659] should_failslab+0xc4/0x120 [ 107.355586][ T7659] __kmalloc_noprof+0x108/0x6c8 [ 107.355600][ T7659] nft_trans_alloc+0x34/0x270 [ 107.355609][ T7659] nft_trans_table_add+0x38/0x190 [ 107.355618][ T7659] nf_tables_newtable+0x968/0x10f4 [ 107.355625][ T7659] nfnetlink_rcv+0xc8c/0x16ec [ 107.355638][ T7659] netlink_unicast+0x600/0x7f8 [ 107.355648][ T7659] netlink_sendmsg+0x648/0x948 [ 107.355657][ T7659] __sock_sendmsg+0xc8/0x17c [ 107.355667][ T7659] ____sys_sendmsg+0x3d0/0x6c8 [ 107.355677][ T7659] ___sys_sendmsg+0x198/0x224 [ 107.355687][ T7659] __sys_sendmsg+0x158/0x204 [ 107.355697][ T7659] __arm64_sys_sendmsg+0x88/0x9c [ 107.355707][ T7659] invoke_syscall+0x98/0x244 [ 107.355719][ T7659] el0_svc_common+0xec/0x23c [ 107.355731][ T7659] do_el0_svc+0x4c/0x5c [ 107.355742][ T7659] el0_svc+0x60/0x1d8 [ 107.355753][ T7659] el0t_64_sync_handler+0x44/0x104 [ 107.355773][ T7659] el0t_64_sync+0x198/0x19c [ 110.810210][ T7675] netlink: 20 bytes leftover after parsing attributes in process `syz.5.915'. [ 111.998090][ T7693] netlink: 8 bytes leftover after parsing attributes in process `syz.1.921'. [ 111.998112][ T7693] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 115.740277][ T7713] FAULT_INJECTION: forcing a failure. [ 115.740277][ T7713] name fail_futex, interval 1, probability 0, space 0, times 0 [ 115.740304][ T7713] CPU: 0 UID: 0 PID: 7713 Comm: syz.1.928 Not tainted syzkaller #0 PREEMPT [ 115.740316][ T7713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 115.740321][ T7713] Call trace: [ 115.740324][ T7713] show_stack+0x2c/0x3c (C) [ 115.740343][ T7713] __dump_stack+0x30/0x40 [ 115.740354][ T7713] dump_stack_lvl+0xd8/0x12c [ 115.740363][ T7713] dump_stack+0x1c/0x28 [ 115.740372][ T7713] should_fail_ex+0x418/0x58c [ 115.740382][ T7713] should_fail+0x14/0x24 [ 115.740391][ T7713] get_futex_key+0x718/0x12b0 [ 115.740401][ T7713] futex_wake+0x10c/0x594 [ 115.740409][ T7713] do_futex+0x2c4/0x378 [ 115.740417][ T7713] mm_exit_exec_release+0x190/0x27c [ 115.740426][ T7713] exit_mm+0x54/0x264 [ 115.740435][ T7713] do_exit+0x524/0x1a74 [ 115.740445][ T7713] do_group_exit+0x198/0x238 [ 115.740454][ T7713] get_signal+0xfb0/0x1094 [ 115.740462][ T7713] arch_do_signal_or_restart+0x288/0x444c [ 115.740472][ T7713] exit_to_user_mode_loop+0x70/0x17c [ 115.740481][ T7713] el0_svc+0x12c/0x1d8 [ 115.740490][ T7713] el0t_64_sync_handler+0x44/0x104 [ 115.740499][ T7713] el0t_64_sync+0x198/0x19c [ 115.974186][ T7725] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 116.266433][ T7707] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 116.395219][ T30] audit: type=1326 audit(116.380:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 116.398707][ T30] audit: type=1326 audit(116.380:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 116.416066][ T30] audit: type=1326 audit(116.400:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 116.416091][ T30] audit: type=1326 audit(116.400:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 116.425159][ T30] audit: type=1326 audit(116.400:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=222 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 116.426015][ T49] maxtcpc 0-0020: error -EIO: Failed to read TCPC_POWER_STATUS [ 116.438413][ T30] audit: type=1326 audit(116.420:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 116.446344][ T30] audit: type=1326 audit(116.420:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 116.447871][ T7741] i2c i2c-0: new_device: Instantiated device maxtcpc at 0x20 [ 116.494019][ T30] audit: type=1326 audit(116.480:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 116.496568][ T49] maxtcpc 0-0020: probe with driver maxtcpc failed with error -5 [ 116.505605][ T30] audit: type=1326 audit(116.490:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 116.518865][ T30] audit: type=1326 audit(116.500:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7743 comm="syz.5.935" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=261 compat=0 ip=0xffff87f79368 code=0x7ffc0000 [ 117.652623][ T7741] ================================================================== [ 117.652635][ T7741] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0xec8/0x1758 [ 117.652652][ T7741] Read of size 8 at addr ffff800093e39370 by task syz.1.933/7741 [ 117.652659][ T7741] [ 117.652664][ T7741] CPU: 0 UID: 0 PID: 7741 Comm: syz.1.933 Not tainted syzkaller #0 PREEMPT [ 117.652673][ T7741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 117.652677][ T7741] Call trace: [ 117.652680][ T7741] show_stack+0x2c/0x3c (C) [ 117.652693][ T7741] __dump_stack+0x30/0x40 [ 117.652703][ T7741] dump_stack_lvl+0xd8/0x12c [ 117.652712][ T7741] print_address_description+0xb0/0x238 [ 117.652720][ T7741] print_report+0x68/0x84 [ 117.652727][ T7741] kasan_report+0x8c/0xc4 [ 117.652735][ T7741] __asan_report_load8_noabort+0x20/0x2c [ 117.652744][ T7741] sys_imageblit+0xec8/0x1758 [ 117.652752][ T7741] drm_fbdev_shmem_defio_imageblit+0x38/0x144 [ 117.652767][ T7741] soft_cursor+0x534/0x6bc [ 117.652774][ T7741] bit_cursor+0xaac/0x112c [ 117.652781][ T7741] fbcon_cursor+0x344/0x498 [ 117.652792][ T7741] set_cursor+0x1a0/0x200 [ 117.652799][ T7741] con_flush_chars+0x84/0xc0 [ 117.652807][ T7741] con_write+0x40/0x58 [ 117.652815][ T7741] n_tty_write+0x994/0xd90 [ 117.652823][ T7741] file_tty_write+0x3dc/0x66c [ 117.652830][ T7741] tty_write+0x44/0x54 [ 117.652836][ T7741] vfs_write+0x51c/0xa0c [ 117.652846][ T7741] ksys_write+0x12c/0x228 [ 117.652855][ T7741] __arm64_sys_write+0x84/0x98 [ 117.652865][ T7741] invoke_syscall+0x98/0x244 [ 117.652875][ T7741] el0_svc_common+0xec/0x23c [ 117.652885][ T7741] do_el0_svc+0x4c/0x5c [ 117.652894][ T7741] el0_svc+0x60/0x1d8 [ 117.652903][ T7741] el0t_64_sync_handler+0x44/0x104 [ 117.652912][ T7741] el0t_64_sync+0x198/0x19c [ 117.652920][ T7741] [ 117.652922][ T7741] The buggy address belongs to a vmalloc virtual mapping [ 117.652933][ T7741] Memory state around the buggy address: [ 117.652938][ T7741] ffff800093e39200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 117.652943][ T7741] ffff800093e39280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 117.652947][ T7741] >ffff800093e39300: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 117.652950][ T7741] ^ [ 117.652955][ T7741] ffff800093e39380: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 117.652959][ T7741] ffff800093e39400: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 117.652962][ T7741] ================================================================== [ 117.652966][ T7741] Disabling lock debugging due to kernel taint [ 117.652984][ T7741] Unable to handle kernel paging request at virtual address ffff800093e39370 [ 117.652990][ T7741] KASAN: probably user-memory-access in range [0x000000049f1c9b80-0x000000049f1c9b87] [ 117.652996][ T7741] Mem abort info: [ 117.652999][ T7741] ESR = 0x0000000096000007 [ 117.653003][ T7741] EC = 0x25: DABT (current EL), IL = 32 bits [ 117.653007][ T7741] SET = 0, FnV = 0 [ 117.653011][ T7741] EA = 0, S1PTW = 0 [ 117.653014][ T7741] FSC = 0x07: level 3 translation fault [ 117.653019][ T7741] Data abort info: [ 117.653021][ T7741] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 117.653026][ T7741] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 117.653031][ T7741] GCS = 0, Overlay = 0, DirtyBit = 0 [ 117.653035][ T7741] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021b16f000 [ 117.653041][ T7741] [ffff800093e39370] pgd=0000000000000000, p4d=1000000221473003, pud=1000000221474003, pmd=10000001076d2403, pte=0000000000000000 [ 117.653058][ T7741] Internal error: Oops: 0000000096000007 [#1] SMP [ 117.717398][ T7741] Modules linked in: [ 117.718157][ T7741] CPU: 0 UID: 0 PID: 7741 Comm: syz.1.933 Tainted: G B syzkaller #0 PREEMPT [ 117.720126][ T7741] Tainted: [B]=BAD_PAGE [ 117.720876][ T7741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 117.722756][ T7741] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 117.724215][ T7741] pc : sys_imageblit+0xecc/0x1758 [ 117.725207][ T7741] lr : sys_imageblit+0xec8/0x1758 [ 117.726164][ T7741] sp : ffff800093437430 [ 117.726923][ T7741] x29: ffff8000934374b0 x28: dfff800000000000 x27: 0000000000000020 [ 117.728412][ T7741] x26: ffff800093e39370 x25: 0000000000000007 x24: 0000000000000020 [ 117.729901][ T7741] x23: ffff800093437490 x22: 0000000000000020 x21: ffff0000c739d8a0 [ 117.731504][ T7741] x20: ffff800093437488 x19: 0000000000000020 x18: 1fffe00035bd9428 [ 117.733048][ T7741] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 117.734565][ T7741] x14: 0000000000001adb x13: 0000000000000001 x12: 0000000000000000 [ 117.736090][ T7741] x11: 0000000000000000 x10: 0000000000080000 x9 : 0000000000000000 [ 117.737657][ T7741] x8 : ffffffffffffffff x7 : 0000000000000000 x6 : ffff8000804823d8 [ 117.739255][ T7741] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f397c [ 117.740841][ T7741] x2 : 0000000000000000 x1 : ffff0000daadbb00 x0 : 0000000000000001 [ 117.742416][ T7741] Call trace: [ 117.743030][ T7741] sys_imageblit+0xecc/0x1758 (P) [ 117.743990][ T7741] drm_fbdev_shmem_defio_imageblit+0x38/0x144 [ 117.745110][ T7741] soft_cursor+0x534/0x6bc [ 117.745932][ T7741] bit_cursor+0xaac/0x112c [ 117.746765][ T7741] fbcon_cursor+0x344/0x498 [ 117.747635][ T7741] set_cursor+0x1a0/0x200 [ 117.748446][ T7741] con_flush_chars+0x84/0xc0 [ 117.749289][ T7741] con_write+0x40/0x58 [ 117.750045][ T7741] n_tty_write+0x994/0xd90 [ 117.750873][ T7741] file_tty_write+0x3dc/0x66c [ 117.751762][ T7741] tty_write+0x44/0x54 [ 117.752533][ T7741] vfs_write+0x51c/0xa0c [ 117.753305][ T7741] ksys_write+0x12c/0x228 [ 117.754091][ T7741] __arm64_sys_write+0x84/0x98 [ 117.754951][ T7741] invoke_syscall+0x98/0x244 [ 117.755787][ T7741] el0_svc_common+0xec/0x23c [ 117.756624][ T7741] do_el0_svc+0x4c/0x5c [ 117.757381][ T7741] el0_svc+0x60/0x1d8 [ 117.758119][ T7741] el0t_64_sync_handler+0x44/0x104 [ 117.759077][ T7741] el0t_64_sync+0x198/0x19c [ 117.759899][ T7741] Code: 34000068 aa1a03e0 97b7b14d 92800008 (f9400349) [ 117.761181][ T7741] ---[ end trace 0000000000000000 ]--- [ 118.364590][ T7741] Kernel panic - not syncing: Oops: Fatal exception [ 118.365932][ T7741] Kernel Offset: disabled [ 118.366831][ T7741] CPU features: 0x0,a0000000,00f00020,9c080a02,a84ff6a7 [ 118.368130][ T7741] Memory Limit: none [ 118.959484][ T7741] Rebooting in 86400 seconds..