last executing test programs: 6.102179156s ago: executing program 1 (id=706): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a, 0x0, 0x0, 0x3}, 0x28) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./bus\x00', 0x1400c, &(0x7f0000000000)={[{@test_dummy_encryption}, {@init_itable}, {@norecovery}]}, 0x3, 0x470, &(0x7f0000000dc0)="$eJzs3M1vG0UbAPBn13H65k0hoZSvlo9AQVQIkqYt0AMHQCBxKBISHOBoJaEqTQtqgkSrSKQcygkhJO6II/8CJ7ggxAmJK9xRpQr1QsvJaL27iZ3YTtPYcYt/P8ntM/vhmce7Y8/u2AlgaE1l/yQReyPi94iYyIutG0zl/12/tjJ349rKXBL1+tt/JY3t/r62MlduWu433lyIJA62qXfpwsUztcXFhfNFeWb57EczSxcuPnf6bO3UwqmFc0dPnDh+bPbFF44+35M8xyMtojfe++rNk1+05L8hjx6Z6rbyqXq9x9UN1l1N8cgA28H2VIrjVW30/4moNB29iXj9s7XCpwNqINA39Xq9Pt559Wod+A9LorWsy8OwKD/oy+vfdtfBL/dt9DF4V1/JL4CyvK8Xj3zNyNodg+qG69temoqId1f/+SZ7RH/uQwAAtPghG/88m412Vuayscf6+CON+5u2u7uYG5qMiHsiYl9E3BvnYn9E3BfR2PaBiHhwm/U3TZI0hpmbxz/plVtO7iZk47+Xirmt1vFfOfqLyUqjdCEvRDV5//TiwpHiNTkc1T1ZebZLHT++9tuXndY1j/+yR1Z/ORYs2nFlZE/rPvO15dqtZ9zq6qWIAyPt8k/WZgKSiHgoIg60e4J06zpOP/Pdw53WbZ1/Fz2YaKp/G/F0fvxXY0P+paT7/OTM/2Jx4chMeVZs9suvl9/qVP+O8u+B7Pj/v+35v5b/ZNI8X7u0/Tou//F5x2uaqWoRbOP8X60t10aTdxrxaLHsk9ry8vnZiNHkZN7o5uVH1/cty+X2Wf6HD7Xv//ti/ZU4GBHZSfxIRDwaEY8Vx+7xiHgiIg51yf/nV5/8YOOysTL/2+D4z2/r+K8Ho9G6JG2zTRZUzvz0fUulk+thkf+N7u9/xxvR4WLJzbz/bW5F+2Cnrx8AAADcCdKI2BtJOr0Wp+n0dP4d/v351Hfm43Pz+W8EJqOalne6Jpruh84Wl/V5+VJE5F8tKNcfi7Rx3/jrylijPD334eL8QDMHxjv0/8yflUG3Dug7P9iC4aX/w/Dq2v+ru9cOYPdt6v9d+/yevrYF2F1tPv/HBtEOYPe1G//7ez8wHDb0f9N+METc/4fhpf/D8NL/YSgtjcXWP5LvGpTPdIu7bxVMROy0hYMJonpbNKNvQaR9r2K0v6dW34LkDmzzpmBw70kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC99G8AAAD//1KFzjw=") seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x14, r4, 0x1, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x20004890}, 0x20044010) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40c4) flock(0xffffffffffffffff, 0x5) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000000), 0x208e24b) 5.047552059s ago: executing program 0 (id=709): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40488c1}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0xfffffffd, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56561, 0x70bd2a, 0x25dfdbfa, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0x0, 0x8}, {0xc, 0x3}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0xfffffffa}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x4048090) 4.95531593s ago: executing program 0 (id=710): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000780)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x1011f, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r3 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) write$P9_RREAD(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = fsmount(r3, 0x0, 0x0) r5 = openat$cgroup(r4, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) syz_clone3(&(0x7f0000000340)={0x201800000, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) 4.036603663s ago: executing program 1 (id=714): r0 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000180)={[{@nodiscard}]}, 0x0, 0x236, &(0x7f0000000b40)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f00000003c0)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='mnt/encrypted_dir\x00', 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e0c0e1c200217033026e212e259ed"], 0xf) openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x40000, 0x0) futex(0x0, 0xd, 0xfffffffe, 0x0, 0x0, 0x6fd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100114, 0x0, 0xfffffffffffffd25) 4.02354857s ago: executing program 3 (id=716): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40488c1}, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0xfffffffd, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56561, 0x70bd2a, 0x25dfdbfa, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {0x0, 0x8}, {0xc, 0x3}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0xfffffffa}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x4048090) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 3.853612989s ago: executing program 4 (id=717): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c00010062"], 0x3c}}, 0x40000) r3 = socket(0x10, 0x803, 0x0) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYRES16=r5], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2d, r6}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 3.737187081s ago: executing program 0 (id=718): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008008000b70400000000000085000000030000009500000000000000"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x2000000}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/ram0\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f0000001040)={0x2020}, 0xffffff16) 3.559513926s ago: executing program 4 (id=719): mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r0 = syz_open_dev$vim2m(&(0x7f0000000b80), 0x1f, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x8, 0x1, 0x1, "1c4a130812bfe92b5d2e1ca4664fc58fdb25dec8457cdba0918870ec5f3dd988", 0x31435750}) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="3300000008000601010000000001", 0xe) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x200400d1) syz_io_uring_setup(0xf08, &(0x7f0000000300)={0x0, 0xfffffffe, 0x800, 0x3, 0x800000c3}, &(0x7f0000000580)=0x0, &(0x7f0000000540)=0x0, 0x0) syz_io_uring_submit(r1, r2, 0x0, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) r3 = memfd_create(&(0x7f0000001240)='[\v\xdbX\xae[\x1a\xad\xd1md\xc8\x85HX\xa9%\f\x1a,\xe2\x9c\xb4\xd7\xbc\xf1\xb3\x86\xe2/Op\xd0\xa2\x82\x1eb;(\xb5\xe1j\xc8\f\xe5\x89\x17\xee|J\x90=5\xed\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q%\x8a\xda\x05\x00f\xe3j%\x00\x00\x1c#\xc6\xd8\xdbD\x92P\xe16W\x10\xdau\xc7\x8f\xaa\x8d\xa9\x97\x9d\xcb\x1e\x80\xe7\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\xbdD\xcc\'\xa2\xaf`\xf6L\x0e\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecM\xe4H\xb7\xaf\xa8\x96dh\xa9\xab > \xac\x00O^\x14\xcbv\x17Hkb\xe7\xcb\x9d;\xd2\x9f\x05\xd1\x00\x8b\xd3\x9f\a\x99^v\xf7\xfa\xe5\xf0h\x87l\xd9\x15\xd2\x87~?\xb1\x9d\xc1\x92`\x8a\r\xfc\xeb\x14\xd1\x94\fv\x8a\xe3\x1d\x0fj}\x9f\xedsc\xd3\xee\xe6cXw\xa1\xbc\xd0o\xf9\x9cJ\b\x00\xd8;\\ik0+\xc8\xf2\x87\xdf\t\x97\x9dB\xc1\xa0\xa71\xf25GU|]A\x1eel \x8ff\xc6\nt\xd0\x91\x9d\x8c\xa4\xe5\xde\x06\x00\xffE\xf4\x96#\x92-9\xe5\xa7\xf8%\xb0I\xd4\x91r\xbf\x1bOS\xee}\x16\x87\x05\xf2\xb9\x81\x14\xe2NZ\\I\xd0[\xc4\xf2\"\x87\xf5\xb8\x95.M\xb1S\xbd\xe4i\x00\xc1b\t]?}0\t\xebV\xbci\xa5\x05\xca\xb6\xc22\x7fL\x89&\xa0\xcfMULr0rs\xb4\n\xa6)\xe23\xf0\x8d\x9dO\xb9\xc9\x83\xabS\x013\"\x1b\x97K\x17\x16\x89\a\xee\xc903\xad\x15\x1cH\xd2\x95\x91\xb4$\x1b\xbf\xaf\xf5\x9b\xc2\x85\xe7[\xe5\xfb}\x1d@f2\x11\x13Y\x98\xa4\xecWEE\x9eI\x05\v\x11\xad\x93!^T\xe5N\xf6LI\x9a6\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf\x1a\xc9(a\x06>g\xe5\x00:\x9au\xef\x14\t\x1f8E\x86\xcb\xd0e\x17\xfb\xc1', 0x3) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 3.472571376s ago: executing program 3 (id=720): r0 = socket$kcm(0x2, 0xa, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7fc}], 0x2c) recvmmsg(r2, &(0x7f0000003700)=[{{0x0, 0x0, &(0x7f0000000200)=[{0x0}], 0x1}, 0x902}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x40010060, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x2, 0x180000, 0x1}, 0x1c) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x2) write(r5, &(0x7f0000000000)='3', 0x4e) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r5, 0xc0207511, &(0x7f0000000380)) sendmsg$AUDIT_SET(r5, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20080000}, 0x4004) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000040)={'ipvlan0\x00', @multicast}) 3.189646547s ago: executing program 3 (id=721): r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$AUTOFS_IOC_FAIL(r0, 0x9361, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xe, 0x4, &(0x7f0000000000)=@framed={{}, [@generic={0x91, 0x1, 0x1, 0x7a}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r6, &(0x7f0000000040)="4c00000011002914001100020004040002000400200000", 0x17) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x501, 0x0, 0x25dfdbfb, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x16}}]}}}]}, 0x44}}, 0x40848c0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x401, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x12e1b, 0x1a001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @broadcast}]}}}]}, 0x3c}}, 0x20004000) 2.351305681s ago: executing program 4 (id=722): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x840}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x0, 0xb}, 0x5, 0x38, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x0, 0x77}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.333967324s ago: executing program 2 (id=723): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) 2.28791556s ago: executing program 2 (id=724): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x70}, 0x40000180) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe700, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x1000, 0x2, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x89a0, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 2.073358378s ago: executing program 0 (id=725): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x1000040, &(0x7f00000002c0)={[{@barrier}, {@nodioread_nolock}, {@noquota}, {@oldalloc}, {@errors_remount}, {@nodioread_nolock}, {@bh}]}, 0xfe, 0x5a1, &(0x7f0000000740)="$eJzs3U9oHFUYAPBvZrNN/0RTQUGlh6JChdJN0j9aPbVXsVDpQfSiYbMNJZtsySbahIDpvYg9iEov9aYHj4oHD+LFo1cvimeh2KDQ9KArm51N03Q3bGPSjdnfDyb73szsfu/N7PeyM8wwAfSsw/U/acQzEXE+iRhcs6wvsoWHG+stLy0U7y4tFJOo1S78kUQSEXeWForN9ZPs9UBELEbE0xHxQz7iaLr6kXuaherc/MRouVyazupDM5OXh6pz88cuTY6Ol8ZLUydefuXU6ZOnRo6PrG3u3Vqz1N9pD++teO3X6x9e++m1m9e//OrQYvHj0STOxEC2bG0/tlJjm+TjzLr5J7cjWBcl3W4Am5LL8jwfEU/FYOSyrG+ltnZw6Dj/gJ2q1h9RW7WmCPSARNJDj2r+Dqgf/zanR/n749bZxgFIPe7y0kLxg2jG72ucm4i9K8cm+/9M7jsyqR9vHnyUDWVXWrwaEcN9fQ9+/5Ps+7d5w1vRQLbV92cbO+rB/Z+ujj/RYvwZaJ47/Y+a499yNv4tt4ifazP+ne8wxt9v//ZZ2/hX++PZlvGT1fhJi/hpRLzbYfwbb357ut2y2ucRR6J1/KZk4/PDQxcvlUvDjb8tY3x35NCr7fsfsb9N/MY5270rDVnb/z1Zm9IO+//Nj18/t7hB/Bef33j/t9r++yLiow7jP3Hni9fbLbt1Nbld/xXwsPs/iXzc7DD+S2cO/5IVnTUEAAAAAAAAAIAtlK5cy5akhdVymhYKjXt4n4z9ablSnTl6sTI7Nda45u1g5NPmlVaDjXpSr49k1+M268fX1U/ksoC5fSv1QrFSHuty3wEAAAAAAAAAAAAAAAAAAGCnOLDu/v+/civ3/69/XDWwW7V/5Dew28l/6F3353/StXYAj57//9CzavIfepf8h94l/6F3yX/oXfIfepf8h94l/wEAAAAAAAAAAAAAAAAAAAAAAAAAYFucP3euPtXuLi0U6/WxvrnZicp7x8ZK1YnC5GyxUKxMXy6MVyrj5VKhWJmMiPxGn5dUKpeHY2r2ytBMqTozVJ2bf2eyMjvVfKZoacM3AwAAAAAAAAAAAAAAAAAAQI8aWJmStJDd1z8QaVooRDwWEQeTSC5eKpeGI+LxiPg5l++v10e63WgAAAAAAAAAAAAAAAAAAADYZapz8xOj5XJpevsKfVmobQzReaHvYVaOiMWtbUb9Ex/6XflsAzbmvPFWo7YDNub/sZDbGd/DnV/o1ogEAAAAAAAAAAAAAAAAAAC9695Nv52+45/tbRAAAAAAAAAAAAAAAAAAAAD0pPT3JCLq05HBFwbWL92TLOdWXiPi/RsXPrkyOjMzPVKff3t1/syn2fzj3Wg/0KlmnqYRUc9jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4J7q3PzEaLlcmt5kob+DdbrdRwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDN+DcAAP//rk7LoQ==") openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_io_uring_setup(0x31c5, &(0x7f0000000080)={0x0, 0x7978, 0x10000, 0xfffffffe, 0xfffffffa}, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4), 0x1c) getsockopt$inet6_buf(r2, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(r0, 0x0, r1, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x200, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0xc02, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x2, 0x26d}}], 0x1, 0x0, 0x0) 2.072543655s ago: executing program 1 (id=726): unshare(0x4000000) r0 = ioctl$USERFAULTFD_IOC_NEW(0xffffffffffffffff, 0xaa00) ioctl$OCFS2_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000240)={0x615d1626352fdb9a, 0x0, 0xef4, 0x6, 0x80000000, 0x100}) r1 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$smackfs_logging(r1, &(0x7f0000000000)=0xfffffffffffffffb, 0x14) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mount(0x0, 0x0, 0x0, 0x800000, 0x0) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) recvmmsg(r3, &(0x7f0000001980)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x122, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) timer_settime(r2, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, &(0x7f00000002c0)) getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40088a01, &(0x7f0000000000)=0x2000) setreuid(0x0, 0x0) sendmsg$NFT_MSG_GETTABLE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={0x0, 0xc8}}, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo\x00') 2.06281151s ago: executing program 3 (id=727): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x2, {0x2, 0x0, 0x0, 0x4, 0xfe, 0x0, 0x0, 0x6, 0x1400}}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) sendto$inet6(0xffffffffffffffff, &(0x7f0000000300)="132d0e7fb6266243757624fc5857dea6f06d50fbe0bf92c7de509a5610d8a6cdcbab0e42b53e7f53a4b0c52f6b2936411cfe0980cbac22c972c70bffaaa5470e5e06bf8b65ad1b2027c109fb2ff84fa1bf774958b0fdd6ff1887801458e45fa3407898d4e019274cb91f5efd23b483d1a0bc22e6f79f2291ec1dcf8b8a", 0x7d, 0x4000, &(0x7f0000000380)={0xa, 0x4e22, 0x3, @dev={0xfe, 0x80, '\x00', 0x37}, 0x5}, 0x1c) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/ima/policy\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/nullb0/queue/scheduler\x00', 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)='3', 0x4e) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26}, 0x20) write(r2, &(0x7f00000001c0)='kyber', 0x5) write(r1, &(0x7f0000000200)='measure uid>1', 0xd) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), 0xffffffffffffffff) r5 = socket$inet6(0xa, 0x3, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'geneve1\x00', 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000980)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x3f, 0x0}, @in=@local, 0xee24, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, r6}, {0x81000, 0x200000004, 0x40000000007, 0xffffffff, 0x100000000, 0x0, 0x200000003, 0x9}, {0x5}, 0x5, 0x0, 0x1, 0x0, 0x4, 0x3}, {{@in=@empty, 0x4d5, 0x6c}, 0xa, @in6=@loopback, 0x3502, 0x4, 0x8, 0x0, 0x9075, 0xef, 0x9}}, 0xe8) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xc0, r4, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x3c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x0, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_TOKEN, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x1}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x87}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4040041}, 0x44080) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0xc00}}, 0x1c}}, 0x8c0) 2.048087276s ago: executing program 4 (id=728): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000009, 0x12, r2, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r1, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee0598", 0xa8, 0x840, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) 1.187399649s ago: executing program 1 (id=729): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000780)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x1011f, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r3 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) write$P9_RREAD(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = fsmount(r3, 0x0, 0x0) r5 = openat$cgroup(r4, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) syz_clone3(&(0x7f0000000340)={0x201800000, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) 1.187103652s ago: executing program 2 (id=730): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xe51de000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) msgctl$MSG_STAT_ANY(0x0, 0xd, 0xfffffffffffffffe) ioctl$sock_SIOCGIFCONF(r2, 0x8912, &(0x7f0000001640)=@buf={0x1000, &(0x7f0000000640)="a09f0bf8daeac14dd8f00edd4fdeb82052d088f66f3baab51491e9a9920ddbb646d0b421f3cc628c9df45a1714215c014aefa560dbe3c1bf42702a4d5e6b46fe9d4e25c31dfc0d825bde01269c804366303f1a196eb23ac1ab6b9dd291b1417fe8079022cfc1b7e76fed3ccd7a856613ab8fd19ac1afe699187eabe14ac2cb075ff00f9e0b102a5880aa4ecb8af8ecbdb467673cd5561389bff94ca55693298af2ea83bafaf8b7fb05bf58385d7c0b08678fbe795aee644fa9ff459d9dedff9101c9c9262143b9643baaad53b32a9c3f5d9d0292d575f10ab9dee53dee7bbe33c6b1cb31817e9110a19d59ecf1bba1271d0360c9ce6e688794d9a35928f4c6fc0cf94c3a827800d680e98136dc73b6e68f3776bd0c4e10d815602f7b473f5368debdc82188fcc9f5726f7c0828801380e13ce62e87b7347f25d9d4565fee2cb2fb33e65a648e42324386c2e7a660d42c28e35083d306c83099c820abe7f6a774318ba568483f31f7ca96c08c50634a6a744ffdc9577d493bd8d58b16f0d8ac29572a5e35b19ac9d18153250156f5a0c3ad44a46f8481ba58edfa1889cd5e6047663b9db44e113d628dad9f1a081fbbbda05580f877c2344d31e6d7068fd9dbd41787986eb2a27fa7375da82c1fe7ef0c74d7754583deec2f16d49da5a4fc5b070157e75c7b2b3c5bcd7ee2749612676a0cc3e9a805a8ee5719f0946f7eaf20b5a61be3e2c91b1a4556afa1743ed33d61ac04c9fb1bfbd8282b2b9de34ae7b38471abfb345eed0b4c4a945543e16c7d3fb8b9dfbff0ba54e6da5fab33a8c5a8a3f02a00ef26ac73dfb16dc911981f3e90017a4d958481aebd5039d40e41eca375cb34dc2b6e9453a020a8a5708aa016fa44ba8214a3f3f44588b44052992c19913a2871f196ba0ae73033eca0374ddaf619fc8a3a18725a0c41aba1846c9df43d11d307c16c91041637ef21b50a10c5918780550c6689d2e9ce2b7f30cb4a9ea4c431784fb92ea9a33b6eb4518cf6ed8764e922591e993b9825e33ef2efeaef4ffd83758155ad376dd964a0279d90ba0f6e6994bcb38fb5fb5419233907c09d59558f7de4a0bca3f4177229f2ec89b8874564943ed12d6bc4459b4c3e613d653e2a762bea3ed45f14d3d87f500de7261122733dd0aa50f7c52b2fd143bea09f44f184ea603e81caf584334c9dee4aedc5a751f4ce5e8e3407b855c7f1055f1c4a8a4eb4cf0e85572ea7d170b181f8d233ac42f1e97a7e6d68014f23ecafdd08f5b70ddb0b116de867b404bc68d3acadface2157f8a9cb392fc005894b8e64ffd52aff56efc85ba59e93039248e441c91d216256dbc734c19ddf589a08abb184f71c2ce89e4b98809c808eb7d09315b513f3c2fbd0cd036a8279c685a529382044b1c21fd4f4e76abdec4be495e790ad9c93a1f3f90310062567f2ee6d86fed7204b0b1de3cef0f143a8f3332c58c37d3eafd588f5a6d50ad5dbee79b9ccc85dcf0fddd347e051d4a221edc86b25514ada16a0bbaec92b0476e8707e234d69ee286809d0b9fce6abc4430da36856250aab07db2df0092dd9e3e619a3ca4c0eff93e18a33bdea78d48ab659c905c542c0c84f534acfcbe6ae825a45b4bb98347c43dea87750d686cbb8fc569205582d1dc1af97cccbc56554c2c66038652e7b509d25ce117da51caaeb9d8916216bcdf401507795db707719f5d86712d43487b69551fe8ec4701bd5e14684c924a9c2acc9b19e418c9140dd0950c0e151fcada7f03b65b3918ad7ea9ab56667bdf2032f39413cfd38474ef4ab688dcf5132dccebf6f9a63608a07273d1488a7f87d4c8f5fa0a117846ca0dac06e2824ff76f667416f27244223507845448f4005afb94fc2b93136f1e01ceafa8560dfb75614a0475e8b22115c0199deda89981bb307785c91fdc58348b2e1ffde6746ab28f37f5f3b85bfceacac21f056100b8f53049644f876c905eb553d192503982b422b81eb3f7b3e89a42bfb815bd996c2a2bf459eb71c7921a0ce4bf7e7ce9a51a5f8710e4699f80b4d8f5bd8f612fd27af1c41f7ef199c6f0cd9236340647b1b8087177e4f0447a360c8a5c0c7481994cc07bb63d743e70843dd83d63169717902b2b863d68daa53fa79a7920e0d29b4fdaaa87511925d5c5cc407aba03eb1f521f1d95a39972cc693ecec87affbd5b493fcf9ef22c6752b944ca50696af9153a90243ac8c883f631ced3d5a4f26f9b7142c0a5b036bf7f1458ed2f10cc935693ed0fe0185d8052ad94ad9d6466af6c74704b133e952852522622600d1c8f61e1a8b27c468afe094743af58af311949f6fa5322e34c47a65a3b782fcdfcfc9d758b1d3a522cbbea956c0f75e06ee6fbd7c8d05978cfa2908b5a9a1e3f1d9fce32c90e7aea787d576074c938f048b37f177b0a479ea73890138267341f199dc4936afb0228222d786e8e063dabd0a6a415e415067d29ad4128a0e4b00067c03b1c9484b990b4e93be8e0f96802dc36fcaa6207467fba2596fb84e3b6ef3467358304d47cd432210037907afa435b6601dc316f32ad2ce739d3dace2c5eec1d00a3c49924aeeb08be5466a2eeb8b5fd43b1655cbf54bce15d0a3faf68e1a3177f665bc1c45c0b7fc82c9302987577386286d6e0a3f3e82104c79cdf6426315bc29a315c321ce4cb2102c49a03b8978c0746ba9eac86580334c354efb64b318100b96d6e7a15559069db51bfcc68c1fd57991a8738cd658bd9ec640ba7dbfe5a6c6d11cd46322ae0c86094e877b6d89f5b0eba4ec79ac6d0b1e28e94c71f64b375fe5f60fe0fea94136ae5917ca51fd29304eccf4a8994b27c2db25f989de5535ad6cdf2d8fe21023793d8590a7d99c3fa5700fe703b68570348dda067e4fc81415c2182fba01f3aea6ff14273280f06d2374714536e7df921cdc9d6af009b1d2e1a5da94422e1972d365e36daa0d08559c12f7ad698dd6b9cec3c9415f54fcd8d7eeceb9a182f5210f4a4a8d049c44e675a00d312ed81e135946d0dcc9c50969a81947c943d76a48a4396655a53d39ca4f259c05e5e74477475cd15036eb1bcc6a76ae557751a5e3503972a84a8bacd02537a031ea0d4d4a4c2c870d0990c28913498faaf865dc8396e9a01600e8b5aceeca8350bdb5a8d32ee8304e584464a80f3b136954298c017f581e743f828aeaa605172444a4780ee5ed3056f7991bd482e22271167357f57e83d38400774e13b23a7176b98a0c18d822de698181d6806b3558be8e8b8cfb788021690b0986b98cc56691192d8bf4e6cd735619cb5d3aa3d22494c759bf667afc3f7728fa74f23022f54267dd032bfce2b1e3742610b91fe55e91b9b8219547de5a4a6e22c4c67ef76236b444dc64da5d86b8804b109c16c2e8da7450e8218d60f575117f26272cbe0c719b124a0785511c2b44660d440699b7e6f496722abeb18abcdb95bf57e2c042a4a0456676864a3001c37c02a335e153e5f2a109cf147d550f647c17eaf78253cfe87b7528fd64dfe27a16a4de50038da41f0a68b80078886bd8d105d813b826dbcfd45cd936cd538228589395807decb97a9daa16c401eaf7e3166e94662a56af486f30f6bbbe3d5044e51e14e5ce0fd5996796922126a95ad60b76866c0f22d26afb96aa2361cc925f5741e69e82d54690c26fc1a240e53da816f58e8870c7cc2d138181429ff6c9567e30215e0f50852477007c68817258bc1065b62a2ecd61473e28552321e4d89a3737d98897261c37a8f28264ee85b83971b8331088081ec254e204fe2acbe67ec25107cc07534fa0b4841e6d68bec6394cbcaa57fe462174cb4f41ee88f2ea11d86d9645b17ae327956676c0d1d8349e07627843421281be10b56315e4591ed56ee6c0043e4b97a753c3196263b98420b4e1f304ec09738b6482af15d2c9bf57f49e704fc20e9d2c74b8ad12a9759e0dd528b8cc21afd7c6c7e8f7424c0ef388a6a082def5d44f1424f3c7df5cd53e38fa920cde681fcd8b413bc57a5275029e3ab485c27f7977fbf7fd150341d60c15ea41e8ebb5a619eb08d155aed396dcd7c3eb7770aae1de408508ff051524f641a491e25bcf86090f3090d99e47eaf4d99391d0eb83ec5bedd439a0d5448befe120f0c39eef293f4ac29cd850d7449e8497ab5c06341ccf7881bb5d003da2f3e1f2b5822ac149ba2ca3e081011e4c33ed4905db90b58fffda9561971f48d2610dd69eec8ea7e72f2703fa41d4468a5880aea3793b2b1d87d2a63243c40b596b9dfb95127e11b0e6a9f25b496b7f8ffdeb2df9e78cbcd3fe09fe8e4061a08fa454164b80309167afe392ea3ef842ab381b10785d9a2006a179d097fc74975b736f9f90980531c5bdca8a4df02bbe3e5055ddd9e2106c0c3fd7f3f93b3d03bd4ed4a413c73ee85a484b58d033e257c4fe64a87fc265d86f20b6961e955698ca7af3465751a1c7592a4d717bc4bd426668dc5fb876b16aa51f71a5c2b20048a1c100501afde00d555657837e5d02a1d6ea4623078f467336b902ba843f183515ecb4792534cccd014ae2f903fdfcf607f872111313927a466e322d2049027477094352ff300a5d17d73d02ea84b904206d9845af2784b4c31fd71a865e2f59fec3ca38e2b401434adfdcb5ab306d8ff1d82eef036119d260509b2e10c8b22946c849a8d850e6d3dd47c9593f7cc9538aa07dc2ad9032aa758e444a09aa0fd07749407e88bb9faca2c5b22f33ade0ceb530e2556094d750c86c108ea4b054e5435e0436d0ddcf1adf97a35aa20f0d06c314427214638a4d8687bd0405e3dd58f6d1d38c614ce314b035e89f8d60e2658b522094c8354776166e4f41395a2093819f626e6b97ded1373061ac6a3d04764a40fcb4d6dc7c5a84514d5499829ed9aeecd5880bf345ec8d21c2d30f3212af12ecafa0f096deaeac42cfebf8081320ed489d03f46fe31884569ec206be90ed69519cd423ebb4f6b904ab77a3c0c844f3028d89084e17adf40ee273f3d63674f7825a7595e8e91e12c2619712ab6e1083d2cae3722d23638c8df47baf12e7fe5d33124f84690575d2b7dd2bf05fc59cb597761baf3b371ada9d913f8bddf19929f7f8e4f7c3e6bd34746be472f7b93a39532b7768dea58737725e6cd70f2fe3e22f8cfd1e5d99a218e995319b03af9dab182b8ef344f5f1fc6919a742fd26889111e24be9fc6deab62906809b01f83dd9fbf2b12cce670c33e0f89d3165195ee3d67c3b517b03ea100f235be8a841c2c41ee4107c15c4d7a2d0a91e887cd962d81295554b70cbb40d44b7e06966cbdc2a053207f1925d38d8f9b34aafb64b7989c9a85679a6da8838f5fb6174060632af69a1b6d204f80a4d11882ad4a6619f2f3a2594184fc24d67f6c866b20c0b4b60acfc80a961b6ea69f5bc64940fa27509f5e4def604a86ad1bebb14c4b2875f07a08612808ec71c4d10bac8afa963e5094edc264333f0fb39b1b7189dbb36f05df330da98f906309c102a1615e087aa1267432ed982b006d8d2a16f358a3976ac2cd8654e043077eae242d5ae6457393d28dad91e25ef6b8041b4225252cd9dd2d18f6a0789a80faf69583a2d7ccfae6dbb515246031f3078446f9c4e864a5dbde80d4d182095e382b469c66af6af04d60790f87306624b5e5fd4ae0165d4cf34ab9ef6a12f857ceaf6e344414bcc572f4b99fb3d380974a6283aeda5cf4acc19eb3813ed587712b89aa2669f787d5172ab1e77934e5e7d5b9b6521ac737f108b04c330885d3b4f6f29cad899c4bb1e37104ced178810622d39e0"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000600)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0) ioctl(r3, 0xc0145608, &(0x7f0000000600)) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 1.186826574s ago: executing program 3 (id=731): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c00010062"], 0x3c}}, 0x40000) r3 = socket(0x10, 0x803, 0x0) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYRES16=r5], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2d, r6}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 1.184585195s ago: executing program 4 (id=732): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f00000001c0), 0x1, 0x509, &(0x7f0000001100)="$eJzs3c9vW0kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSG0EmKPIHVD4kZR7DiKndKEHtIzVyQqcYIjfwDnnrhzQXDjUg5I/IhADYiD0Xt+Sd3UbrxpYkf15yM9vZk3jr/fafpm6nHtCWBkXY2I/YiYiIhPI2I2u57LjviofSSPe3xwb+Xw4N5KLlqtT/6RS9uTa9HxM4kr2XMWI+IH34n4ce7ZuI3dvY3larWyndXnm7Wt+cbu3o312vJaZa2yWS4vLS4tfHDz/fK59fWt2kRW+vKj3+9/46dJWjPZlc5+nKd21wvHcRLjEfG9iwg2BGNZfyaGnQhnko+I1yPi7fT+n42x9LcJALzMWq3ZaM121gGAl10+XQPL5UvZWsBM5POlUnsN742Yzlfrjeb12/WdzdX2WtlcFPK316uVhWytcC4KuaS+mJaf1Msn6jcj4rWI+PnkVFovrdSrq8P8hw8AjLArJ+b/f0+25/9uioNODgC4OCZ2ABg9Z5//8+eaBwAwOF7/A8DoMf8DwOhpz/9Tw04DABggr/8BYPSY/wFgpHz/44+To3WYff/16p3dnY36nRurlcZGqbazUlqpb2+V1ur1tfQ7e2qnPV+1Xt9afC927s59c6vRnG/s7t2q1Xc2m7fS7/W+VSmkj9ofQM8AgF5ee+vhn3LJjPzhVHpEx14OhaFmBly0fj7AuzeAPIDBGxt2AsDQ2O0LRtdnfo0/efYfBS6nLlv0PqXY7QNCrVardXEpARfs2hes/8Oo6lj/97+AYcRY/4fRZf0fRlerlet3z//o94EAwOVmjR/o8f7/69n5N9mbAz9aPfmIBxeZFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFxuR/v/lrK9wGciny+VIl6JiLko5G6vVysLEfFqRPxxsjCZ1BeHnDMA8KLyf81l+39dm3135qmmN68cFyci4ie//OQXd5ebze0/REzk/jl5dL35ILteHnz2AMDpjubp9NzxQv7xwb2Vo2OQ+fzt2xFRbMc/PJiIw+P44zGenotRiIjpf+WyeluuY+3iRezfj4jPd+t/LmbSNZD2zqcn4yexXxlo/PxT8fNpW/uc/Fl87hxygVHzMBl/Pup2/+Xjanrufv8X0xHqxWXjX/JUK4fpGPgk/tH4N9Zj/Lvab4z3fvfddmnq2bb7EV8cjziKfdgx/hzFz/WI/26f8f/8pTff7tXW+lXEtegevzPWfLO2Nd/Y3buxXlteq6xVNsvlpcWlhQ9uvl/+b7pGPd97Nvj7h9df7dWW9H+6R/ziKf3/ap/9//X/Pv3hV54T/+vvdIufjzeeEz+ZE7/WZ/zl6d8We7Ul8Vd79P+03//1PuM/+sveM9uGAwDD09jd21iuVivbCgqXv5D8lb0EaXQtfGtQsSaie9PP3mnf0yeaWq0zxeo1YpzHqhtwGRzf9BHxn2EnAwAAAAAAAAAAAAAAdDWITywNu48AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8vP4fAAD//3T20Hg=") r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) syz_open_dev$vim2m(&(0x7f00000000c0), 0x7, 0x2) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x15, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0xb00}, 0x90) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x2c, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x2c}}, 0x0) 1.184345546s ago: executing program 0 (id=739): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r3, 0x4000) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000040)=""/7, 0x7, 0xc9100021, 0x0, 0x0) r4 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x1, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) pread64(r6, &(0x7f00000000c0)=""/30, 0x1e, 0x800000000004) 619.963891ms ago: executing program 3 (id=733): socket$netlink(0x10, 0x3, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) unshare(0x6a040000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x13, 0x401d031, 0xffffffffffffffff, 0x0) request_key(0x0, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write$snapshot(r0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(r1, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x20, 0x1, 0x7fff) socket(0x8, 0x2, 0x0) ioctl$DVB_DEMUX_DMX_STOP(r1, 0x6f2a) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x11, &(0x7f00000044c0)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x40000c5}, 0x2400c890) 257.577432ms ago: executing program 1 (id=734): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) 256.513686ms ago: executing program 2 (id=735): socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) unshare(0x40400) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000140)=""/36, 0x24, 0x40000000, &(0x7f00000004c0)=@file={0x1, './config/usb_gadget/g1/functions/uvc.0\x00'}, 0x6e) r0 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x40) ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f0000001040)={0xe, {0x6, 0x7, 0x7, 0xffffffde}, {0x8, 0x1, 0x4, 0x7ff}, {0x7, 0x6}}) r1 = mq_open(&(0x7f0000000000)='R}\x00', 0x40, 0x60, 0x0) mq_getsetattr(r1, 0x0, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f0000000100), 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) 247.695987ms ago: executing program 4 (id=736): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008008000b70400000000000085000000030000009500000000000000"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x2000000}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/ram0\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f0000001040)={0x2020}, 0xffffff16) 247.503186ms ago: executing program 0 (id=737): r0 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000180)={[{@nodiscard}]}, 0x0, 0x236, &(0x7f0000000b40)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f00000003c0)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='mnt/encrypted_dir\x00', 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e0c0e1c200217033026e212e259ed"], 0xf) pwritev2(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x1, 0x7, 0x2) futex(0x0, 0xd, 0xfffffffe, 0x0, 0x0, 0x6fd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100114, 0x0, 0xfffffffffffffd25) 158.2147ms ago: executing program 2 (id=738): r0 = socket(0x2b, 0x1, 0x1) listen(r0, 0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "f64e40efffde0080", "409172d80a000000d65605dff8a4a8d2", '\x00', "ffffff7f00"}, 0x28) listen(r2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x0, 0x3, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x14) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r7, 0x0) r8 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) 111.147819ms ago: executing program 1 (id=740): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB], 0x40}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000400)=[@in={0x2, 0x0, @empty}, @in6={0xa, 0x0, 0x0, @empty}], 0x2c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0x3, 0xffffffffffffffff, 0x38) io_uring_setup(0x19b4, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, 0x0, 0x8, 0x2) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r6, 0x4b72, &(0x7f0000000000)={0x4, 0xfffffffc, 0x11, 0x20, 0x100, &(0x7f00000004c0)="387ed7626d850509a2d6c1aa38f15cd00f85c263cb226db671261fff7ce9c555f18dafae3530db6dd493f2a3cc88721b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef494c89092883b902a41cd75387ef6f7bc7d460d5e665f398ff95596dc94ec97003c7e6f3c82fbd8de6e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1aed6e850ecb3421143c5c4ded0f06affc524dcf3208272619b6a952db5bc96141b26c54d13c7a5416287a3b6f7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8da0dbf5e20d604413ed2ddf9bb0f881caf811852806175d63892a15234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa0284abe90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695efbd649f42f310859122c0d2c1e558dc6586958a283762386ecf369274e43003a0fdff59ea515eb44521901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc5092548feaef7204a12cece59181fcb5bad8c24bd9f8f78d17ab82831325501e80d899e9252f99d3a2666343392fda11504800f4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd333b30d3ce2f50dddeea3447aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b68986af3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9000400002f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d14df8aa9df6f40a80ace2bb8a2aad3b0c66915927db4233181943d88c0c76d5969e2043db5bd77fd60ba0f013139929ccfec96020000000000000032ba1f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fd81bc31152538db50f47dc38ba908a0d808687e478a666e7f2e98597e2813e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d472dd0e1338688ba782b41bde141f99c4894ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e87dde71929f918b98c4cbfcb11a90139264a9ee8081973167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d2195ff9c6320c85bddc42915e4f3a5db642c47bc2195a3d64e04c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e0e32b75ce814731c542091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00"}) 0s ago: executing program 2 (id=741): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setpriority(0x1, 0x0, 0xffffffffffffffcd) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ifreq(r3, 0x8943, &(0x7f00000000c0)={'ipvlan0\x00', @ifru_hwaddr=@local}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./dev/mtdblock0\x00', 0x42, 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x110000) close(r4) kernel console output (not intermixed with test programs): 0 to HW filter on device netdevsim0 [ 29.619978][ T4708] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 29.621348][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.623947][ T4719] hsr_slave_0: entered promiscuous mode [ 29.624249][ T4719] hsr_slave_1: entered promiscuous mode [ 29.624438][ T4719] debugfs: 'hsr0' already exists in 'hsr' [ 29.624448][ T4719] Cannot create hsr debugfs directory [ 29.635782][ T4716] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.635796][ T4716] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.635809][ T4716] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.638054][ T4716] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.638067][ T4716] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.638082][ T4716] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.638251][ T4708] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 29.639676][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.640027][ T4708] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 29.641289][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.678454][ T4716] hsr_slave_0: entered promiscuous mode [ 29.678755][ T4716] hsr_slave_1: entered promiscuous mode [ 29.678929][ T4716] debugfs: 'hsr0' already exists in 'hsr' [ 29.678940][ T4716] Cannot create hsr debugfs directory [ 29.687439][ T4708] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.687475][ T4708] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.687629][ T4708] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.687669][ T4708] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.693852][ T4709] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 29.696128][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.696631][ T4709] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 29.699414][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.716535][ T4709] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 29.717784][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.730683][ T4709] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 29.733434][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.773010][ T4710] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 29.774301][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.774745][ T4710] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 29.775733][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.778620][ T4710] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 29.780050][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.780590][ T4710] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 29.784819][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.792282][ T4708] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.801614][ T4709] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.801648][ T4709] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.801767][ T4709] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.801807][ T4709] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.820428][ T4719] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 29.821587][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.825368][ T4708] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.834750][ T4719] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 29.836088][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.837655][ T460] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.838500][ T460] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.839058][ T460] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.839363][ T460] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.865823][ T4719] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 29.866892][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.867829][ T4719] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 29.869227][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.881848][ T4709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.887395][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.887494][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.887848][ T14] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.887865][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.892969][ T4716] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 29.894520][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.894867][ T4716] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 29.897296][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.902569][ T4716] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 29.904299][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.905210][ T4716] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 29.907299][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.911655][ T4709] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.943595][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.943641][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.947079][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.947111][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.961225][ T4719] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.971067][ T4710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.996359][ T4716] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.009298][ T4719] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.009967][ T4710] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.016762][ T4716] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.026091][ T460] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.026121][ T460] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.046045][ T460] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.046082][ T460] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.047507][ T460] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.047530][ T460] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.047950][ T460] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.047970][ T460] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.051564][ T460] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.051592][ T460] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.085204][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.085238][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.138775][ T4716] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.138794][ T4716] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.177481][ T4708] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.277296][ T4709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.300151][ T4709] veth0_vlan: entered promiscuous mode [ 30.312680][ T4709] veth1_vlan: entered promiscuous mode [ 30.319880][ T4709] veth0_macvtap: entered promiscuous mode [ 30.321055][ T4709] veth1_macvtap: entered promiscuous mode [ 30.344062][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.345278][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.377780][ T4710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.392292][ T48] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.392654][ T48] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.392677][ T48] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.392693][ T48] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.393859][ T4708] veth0_vlan: entered promiscuous mode [ 30.413841][ T4719] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.415646][ T4708] veth1_vlan: entered promiscuous mode [ 30.421148][ T4708] veth0_macvtap: entered promiscuous mode [ 30.434259][ T4708] veth1_macvtap: entered promiscuous mode [ 30.447956][ T4708] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.448968][ T4708] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.460335][ T4710] veth0_vlan: entered promiscuous mode [ 30.461253][ T4716] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.474166][ T380] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.474188][ T380] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.480405][ T4710] veth1_vlan: entered promiscuous mode [ 30.502489][ T4719] veth0_vlan: entered promiscuous mode [ 30.507203][ T4719] veth1_vlan: entered promiscuous mode [ 30.510375][ T4710] veth0_macvtap: entered promiscuous mode [ 30.511510][ T4710] veth1_macvtap: entered promiscuous mode [ 30.517136][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.528308][ T14] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.528327][ T14] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.534515][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.553336][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.553355][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.562698][ T380] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.563430][ T380] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.563458][ T380] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.564736][ T4716] veth0_vlan: entered promiscuous mode [ 30.566460][ T4716] veth1_vlan: entered promiscuous mode [ 30.571211][ T4719] veth0_macvtap: entered promiscuous mode [ 30.590451][ T4719] veth1_macvtap: entered promiscuous mode [ 30.591592][ T541] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.591604][ T541] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.598724][ T4719] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.599885][ T4719] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.621192][ T380] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.621211][ T380] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.644352][ T4716] veth0_macvtap: entered promiscuous mode [ 30.651056][ T14] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.651075][ T14] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.655459][ T4709] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.667066][ T4716] veth1_macvtap: entered promiscuous mode [ 30.688760][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.688781][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.694370][ T4716] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.695469][ T4716] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.755764][ T339] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.755816][ T339] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.755826][ T339] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.756119][ T339] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.760717][ T339] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.760857][ T339] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.760940][ T339] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.761149][ T339] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.761328][ T339] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.761454][ T339] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.761547][ T339] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.781043][ T339] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.781594][ T339] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.781854][ T339] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.781965][ T339] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.808439][ T4897] Cannot find add_set index 0 as target [ 30.898136][ T4725] Bluetooth: hci2: command tx timeout [ 30.898440][ T4725] Bluetooth: hci3: command tx timeout [ 30.902186][ T4725] Bluetooth: hci1: command tx timeout [ 30.902474][ T4725] Bluetooth: hci0: command tx timeout [ 30.903102][ T4713] Bluetooth: hci4: command tx timeout [ 31.236474][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.236504][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.275397][ T380] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.275421][ T380] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.527811][ T4912] loop0: detected capacity change from 0 to 512 [ 31.539466][ T4912] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 31.620155][ T4912] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.626133][ T4917] netlink: 'syz.1.7': attribute type 1 has an invalid length. [ 31.721176][ T4920] ip6_vti0: Master is either lo or non-ether device [ 31.732207][ T4922] syzkaller0: entered promiscuous mode [ 31.732225][ T4922] syzkaller0: entered allmulticast mode [ 32.208399][ T4930] ubi0: attaching mtd0 [ 32.215204][ T4930] ubi0: scanning is finished [ 32.215245][ T4930] ubi0: empty MTD device detected [ 32.424261][ T4716] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.534042][ T4935] loop0: detected capacity change from 0 to 256 [ 32.534356][ T4935] ======================================================= [ 32.534356][ T4935] WARNING: The mand mount option has been deprecated and [ 32.534356][ T4935] and is ignored by this kernel. Remove the mand [ 32.534356][ T4935] option from the mount to silence this warning. [ 32.534356][ T4935] ======================================================= [ 32.785210][ T4930] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 32.785270][ T4930] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 32.785291][ T4930] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 32.785310][ T4930] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 32.785330][ T4930] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 32.785348][ T4930] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 32.785368][ T4930] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2792542771 [ 32.785388][ T4930] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 32.818107][ T4937] ubi0: background thread "ubi_bgt0d" started, PID 4937 [ 32.825841][ T4938] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 32.972066][ T4725] Bluetooth: hci1: command tx timeout [ 32.972160][ T4725] Bluetooth: hci3: command tx timeout [ 32.972728][ T4725] Bluetooth: hci2: command tx timeout [ 32.973546][ T4713] Bluetooth: hci0: command tx timeout [ 32.973887][ T4722] Bluetooth: hci4: command tx timeout [ 32.999116][ T4942] syz.0.12: attempt to access beyond end of device [ 32.999116][ T4942] loop0: rw=1, sector=1832, nr_sectors = 32 limit=256 [ 32.999562][ T4942] syz.0.12: attempt to access beyond end of device [ 32.999562][ T4942] loop0: rw=1, sector=1896, nr_sectors = 32 limit=256 [ 32.999930][ T4942] syz.0.12: attempt to access beyond end of device [ 32.999930][ T4942] loop0: rw=1, sector=1960, nr_sectors = 32 limit=256 [ 33.000214][ T4942] syz.0.12: attempt to access beyond end of device [ 33.000214][ T4942] loop0: rw=1, sector=2024, nr_sectors = 32 limit=256 [ 33.007000][ T4942] syz.0.12: attempt to access beyond end of device [ 33.007000][ T4942] loop0: rw=1, sector=2088, nr_sectors = 1928 limit=256 [ 33.321637][ T4945] loop1: detected capacity change from 0 to 512 [ 33.334329][ T4945] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a066c018, mo2=0002] [ 33.334416][ T4945] System zones: 1-12 [ 33.340753][ T4945] EXT4-fs error (device loop1): ext4_xattr_inode_iget:473: comm syz.1.14: EA inode 11 has unexpected i_nlink=0 ref_count=1 [ 33.340817][ T4945] loop1: lost filesystem error report for type 5 error -117 [ 33.341735][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 33.341748][ C0] EXT4-fs (loop1): initial error at time 33: ext4_xattr_inode_iget:473 [ 33.341760][ C0] EXT4-fs (loop1): last error at time 33: ext4_xattr_inode_iget:473 [ 33.344516][ T4945] EXT4-fs (loop1): 1 orphan inode deleted [ 33.346181][ T4945] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.448781][ T12] kworker/u8:0: attempt to access beyond end of device [ 33.448781][ T12] loop0: rw=1, sector=4016, nr_sectors = 20920 limit=256 [ 33.895055][ T12] kworker/u8:0: attempt to access beyond end of device [ 33.895055][ T12] loop0: rw=1, sector=24968, nr_sectors = 32 limit=256 [ 33.895145][ T12] kworker/u8:0: attempt to access beyond end of device [ 33.895145][ T12] loop0: rw=1, sector=25032, nr_sectors = 32 limit=256 [ 33.895199][ T12] kworker/u8:0: attempt to access beyond end of device [ 33.895199][ T12] loop0: rw=1, sector=25096, nr_sectors = 32 limit=256 [ 33.895243][ T12] kworker/u8:0: attempt to access beyond end of device [ 33.895243][ T12] loop0: rw=1, sector=25160, nr_sectors = 32 limit=256 [ 34.078591][ T4963] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 34.227497][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.236177][ T4965] loop2: detected capacity change from 0 to 1024 [ 34.239852][ T4965] EXT4-fs: Ignoring removed bh option [ 34.269969][ T4965] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 34.790831][ T4985] netlink: 'syz.4.22': attribute type 1 has an invalid length. [ 34.819389][ T4985] netlink: 4 bytes leftover after parsing attributes in process `syz.4.22'. [ 34.823826][ T4985] bridge1: entered promiscuous mode [ 35.061853][ T4722] Bluetooth: hci4: command tx timeout [ 35.062288][ T4722] Bluetooth: hci0: command tx timeout [ 35.062352][ T4722] Bluetooth: hci2: command tx timeout [ 35.062412][ T4722] Bluetooth: hci3: command tx timeout [ 35.062563][ T4722] Bluetooth: hci1: command tx timeout [ 35.917441][ T5000] FAULT_INJECTION: forcing a failure. [ 35.917441][ T5000] name failslab, interval 1, probability 0, space 0, times 1 [ 35.917468][ T5000] CPU: 0 UID: 0 PID: 5000 Comm: syz.3.27 Not tainted syzkaller #0 PREEMPT [ 35.917488][ T5000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 35.917496][ T5000] Call trace: [ 35.917500][ T5000] show_stack+0x2c/0x3c (C) [ 35.917523][ T5000] __dump_stack+0x30/0x40 [ 35.917537][ T5000] dump_stack_lvl+0xd8/0x12c [ 35.917549][ T5000] dump_stack+0x1c/0x28 [ 35.917561][ T5000] should_fail_ex+0x418/0x58c [ 35.917576][ T5000] should_failslab+0xc4/0x120 [ 35.917591][ T5000] __kmalloc_node_track_caller_noprof+0x108/0x6e0 [ 35.917602][ T5000] kmemdup_nul+0x48/0xfc [ 35.917613][ T5000] vfs_parse_fs_qstr+0x100/0x1cc [ 35.917624][ T5000] do_new_mount+0x21c/0x538 [ 35.917637][ T5000] path_mount+0x5f0/0xa88 [ 35.917649][ T5000] do_mount+0xe8/0x148 [ 35.917660][ T5000] __arm64_sys_mount+0x33c/0x388 [ 35.917672][ T5000] invoke_syscall+0x98/0x244 [ 35.917685][ T5000] el0_svc_common+0xec/0x23c [ 35.917698][ T5000] do_el0_svc+0x4c/0x5c [ 35.917710][ T5000] el0_svc+0x60/0x1d8 [ 35.917725][ T5000] el0t_64_sync_handler+0x44/0x104 [ 35.917738][ T5000] el0t_64_sync+0x198/0x19c [ 36.205605][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.246876][ T5008] netlink: 'syz.0.28': attribute type 10 has an invalid length. [ 36.251111][ T5010] loop2: detected capacity change from 0 to 512 [ 36.270454][ T5007] netlink: 'syz.3.30': attribute type 1 has an invalid length. [ 36.271299][ T5008] syz_tun: entered promiscuous mode [ 36.282901][ T5008] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 36.284829][ T5007] netlink: 28 bytes leftover after parsing attributes in process `syz.3.30'. [ 36.306846][ T5010] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a066c018, mo2=0002] [ 36.306959][ T5010] System zones: 1-12 [ 36.307406][ T5010] EXT4-fs error (device loop2): ext4_xattr_inode_iget:473: comm syz.2.29: EA inode 11 has unexpected i_nlink=0 ref_count=1 [ 36.307420][ T5010] loop2: lost filesystem error report for type 5 error -117 [ 36.307641][ T5010] EXT4-fs (loop2): 1 orphan inode deleted [ 36.308676][ T5010] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.324840][ T380] bond0: (slave bond_slave_0): interface is now down [ 36.324857][ T380] bond0: (slave bond_slave_1): interface is now down [ 36.324864][ T380] bond0: (slave syz_tun): interface is now down [ 36.342022][ T48] bond0: (slave bond_slave_0): interface is now down [ 36.342048][ T48] bond0: (slave bond_slave_1): interface is now down [ 36.342059][ T48] bond0: (slave syz_tun): interface is now down [ 36.349039][ T48] bond0: now running without any active interface! [ 36.416887][ T5014] loop4: detected capacity change from 0 to 512 [ 37.279711][ T4713] Bluetooth: hci1: command tx timeout [ 37.279751][ T4713] Bluetooth: hci3: command tx timeout [ 37.279772][ T4713] Bluetooth: hci2: command tx timeout [ 37.279791][ T4713] Bluetooth: hci0: command tx timeout [ 37.279807][ T4713] Bluetooth: hci4: command tx timeout [ 37.344487][ T5014] EXT4-fs (loop4): Test dummy encryption mode enabled [ 37.363415][ T5014] EXT4-fs error (device loop4): ext4_xattr_inode_iget:473: comm syz.4.31: EA inode 11 has unexpected i_nlink=2 ref_count=1 [ 37.363443][ T5014] loop4: lost filesystem error report for type 5 error -117 [ 37.363689][ T5014] EXT4-fs (loop4): 1 orphan inode deleted [ 37.364140][ T5014] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.403237][ T5020] loop3: detected capacity change from 0 to 1024 [ 37.403703][ T5020] EXT4-fs: Ignoring removed nomblk_io_submit option [ 37.403723][ T5020] EXT4-fs: Ignoring removed nomblk_io_submit option [ 37.409726][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.425432][ T5020] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 37.533773][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.565246][ T5032] netlink: 'syz.2.34': attribute type 1 has an invalid length. [ 37.567323][ T5032] netlink: 28 bytes leftover after parsing attributes in process `syz.2.34'. [ 37.826763][ T5034] syzkaller0: entered promiscuous mode [ 37.826785][ T5034] syzkaller0: entered allmulticast mode [ 38.231546][ T4710] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 38.309783][ T5049] loop3: detected capacity change from 0 to 4096 [ 38.310377][ T5049] EXT4-fs: Invalid journal IO priority (must be 0-7) [ 38.465423][ T5053] Injecting memory failure for pfn 0x11fea3 at process virtual address 0x20000000 [ 38.680913][ T5053] Memory failure: 0x11fea3: Sending SIGBUS to syz.1.40:5053 due to hardware memory corruption [ 38.681001][ T5053] Memory failure: 0x11fea3: recovery action for dirty LRU page: Recovered [ 38.681015][ T5053] Injecting memory failure for pfn 0x11fea4 at process virtual address 0x20001000 [ 38.681231][ T5053] Memory failure: 0x11fea4: Sending SIGBUS to syz.1.40:5053 due to hardware memory corruption [ 38.681477][ T5053] Memory failure: 0x11fea4: dirty LRU page still referenced by 1024 users [ 38.681491][ T5053] Memory failure: 0x11fea4: recovery action for dirty LRU page: Failed [ 38.956065][ T5049] FAULT_INJECTION: forcing a failure. [ 38.956065][ T5049] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 38.956092][ T5049] CPU: 1 UID: 0 PID: 5049 Comm: syz.3.39 Not tainted syzkaller #0 PREEMPT [ 38.956105][ T5049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 38.956111][ T5049] Call trace: [ 38.956115][ T5049] show_stack+0x2c/0x3c (C) [ 38.956135][ T5049] __dump_stack+0x30/0x40 [ 38.956147][ T5049] dump_stack_lvl+0xd8/0x12c [ 38.956159][ T5049] dump_stack+0x1c/0x28 [ 38.956170][ T5049] should_fail_ex+0x418/0x58c [ 38.956184][ T5049] should_fail+0x14/0x24 [ 38.956195][ T5049] should_fail_usercopy+0x20/0x30 [ 38.956203][ T5049] _copy_from_iter+0x188/0x1064 [ 38.956213][ T5049] pfkey_sendmsg+0x1a0/0xdf8 [ 38.956226][ T5049] __sock_sendmsg+0xc8/0x17c [ 38.956237][ T5049] ____sys_sendmsg+0x3d0/0x6c8 [ 38.956249][ T5049] ___sys_sendmsg+0x198/0x224 [ 38.956260][ T5049] __sys_sendmsg+0x158/0x204 [ 38.956271][ T5049] __arm64_sys_sendmsg+0x88/0x9c [ 38.956282][ T5049] invoke_syscall+0x98/0x244 [ 38.956294][ T5049] el0_svc_common+0xec/0x23c [ 38.956306][ T5049] do_el0_svc+0x4c/0x5c [ 38.956317][ T5049] el0_svc+0x60/0x1d8 [ 38.956331][ T5049] el0t_64_sync_handler+0x44/0x104 [ 38.956343][ T5049] el0t_64_sync+0x198/0x19c [ 39.017790][ T5061] random: crng reseeded on system resumption [ 39.021188][ T5063] capability: warning: `syz.2.44' uses 32-bit capabilities (legacy support in use) [ 39.471542][ T5077] loop1: detected capacity change from 0 to 512 [ 39.499685][ T5077] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 39.525985][ T5077] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8842e11c, mo2=0102] [ 39.526114][ T5077] EXT4-fs (loop1): orphan cleanup on readonly fs [ 39.527471][ T5077] EXT4-fs error (device loop1): ext4_clear_blocks:876: inode #11: comm syz.1.48: attempt to clear invalid blocks 1024 len 1 [ 39.527589][ T5077] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 39.528647][ T5077] EXT4-fs error (device loop1): ext4_validate_block_bitmap:445: comm syz.1.48: bg 0: block 361: padding at end of block bitmap is not set [ 39.528669][ T5077] loop1: lost filesystem error report for type 5 error -117 [ 39.528804][ T5077] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 39.528813][ T5077] loop1: lost filesystem error report for type 5 error -117 [ 39.528982][ T5077] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #11: comm syz.1.48: invalid indirect mapped block 1811939328 (level 0) [ 39.528995][ T5077] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 39.529111][ T5077] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #11: comm syz.1.48: invalid indirect mapped block 2185560079 (level 1) [ 39.529123][ T5077] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 39.529584][ T5077] EXT4-fs (loop1): 1 truncate cleaned up [ 39.530068][ T5077] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: none. [ 39.772677][ T5082] EXT4-fs warning (device loop1): dx_probe:861: inode #2: comm syz.1.48: dx entry: limit 0 != root limit 125 [ 39.772807][ T5082] EXT4-fs warning (device loop1): dx_probe:934: inode #2: comm syz.1.48: Corrupt directory, running e2fsck is recommended [ 39.892863][ T5088] loop3: detected capacity change from 0 to 128 [ 39.941391][ T5088] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 40.080475][ T5094] ptrace attach of "ci-upstream-gce-arm64/syz-executor exec"[4719] was attempted by "ci-upstream-gce-arm64/syz-executor exec"[5094] [ 40.349953][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 40.381347][ T5097] process 'syz.1.53' launched '/dev/fd/7' with NULL argv: empty string added [ 40.385924][ T5099] bond0: (slave syz_tun): Releasing backup interface [ 40.420102][ T5099] bridge_slave_0: left allmulticast mode [ 40.420124][ T5099] bridge_slave_0: left promiscuous mode [ 40.420211][ T5099] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.420430][ T5101] loop1: detected capacity change from 0 to 4096 [ 40.434180][ T5101] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 40.434524][ T5099] bridge_slave_1: left allmulticast mode [ 40.434541][ T5099] bridge_slave_1: left promiscuous mode [ 40.435168][ T5099] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.437471][ T5103] netlink: 'syz.0.54': attribute type 10 has an invalid length. [ 40.438569][ T5099] bond0: (slave bond_slave_0): Releasing backup interface [ 40.465141][ T5099] bond0: (slave bond_slave_1): Releasing backup interface [ 40.490667][ T5104] loop2: detected capacity change from 0 to 7 [ 40.503066][ T5104] Dev loop2: unable to read RDB block 7 [ 40.503088][ T5104] loop2: AHDI p1 p2 p3 [ 40.503100][ T5104] loop2: partition table partially beyond EOD, truncated [ 40.503206][ T5104] loop2: p1 start 1601398130 is beyond EOD, truncated [ 40.503216][ T5104] loop2: p2 start 1702059890 is beyond EOD, truncated [ 40.535789][ T5099] team0: Port device team_slave_0 removed [ 40.538267][ T5099] team0: Port device team_slave_1 removed [ 40.538610][ T5099] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 40.538623][ T5099] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 40.539424][ T5099] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 40.539434][ T5099] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 40.540239][ T5099] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 40.557098][ T5103] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 40.558032][ T5103] team0: Port device netdevsim1 added [ 40.952087][ T5115] loop2: detected capacity change from 0 to 128 [ 40.960864][ T5115] EXT4-fs (loop2): Test dummy encryption mode enabled [ 41.272698][ T5115] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 41.281390][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.313558][ T4710] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 41.316815][ T5115] fscrypt: AES-256-XTS using blk-crypto-fallback [ 41.700906][ T5129] Zero length message leads to an empty skb [ 41.748623][ T5136] tipc: Enabling of bearer rejected, failed to enable media [ 41.817013][ T4719] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 42.132996][ T5155] gadgetfs: bound to dummy_udc driver [ 43.227373][ T5175] loop4: detected capacity change from 0 to 1024 [ 43.234491][ T5175] EXT4-fs: Ignoring removed bh option [ 43.335557][ T5175] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 43.357409][ T5175] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2863: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 43.435606][ T5191] loop3: detected capacity change from 0 to 1024 [ 43.436640][ T5191] EXT4-fs: Ignoring removed oldalloc option [ 43.436651][ T5191] EXT4-fs: Ignoring removed orlov option [ 43.459955][ T5194] capability: warning: `syz.1.70' uses deprecated v2 capabilities in a way that may be insecure [ 43.574932][ T5191] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.645721][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.018727][ T5201] tipc: Enabling of bearer rejected, failed to enable media [ 44.029313][ T5202] loop2: detected capacity change from 0 to 512 [ 44.034653][ T5202] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 44.041507][ T5202] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 44.041557][ T5202] System zones: 1-12 [ 44.041661][ T5202] EXT4-fs (loop2): orphan cleanup on readonly fs [ 44.043256][ T5202] EXT4-fs error (device loop2): ext4_free_branches:1023: inode #11: comm syz.2.80: invalid indirect mapped block 12 (level 1) [ 44.043271][ T5202] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 44.043436][ T5202] EXT4-fs error (device loop2): ext4_free_branches:1023: inode #11: comm syz.2.80: invalid indirect mapped block 2 (level 2) [ 44.043448][ T5202] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 44.045961][ T5202] EXT4-fs (loop2): 1 truncate cleaned up [ 44.046436][ T5202] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 44.138589][ T5211] syz_tun: entered allmulticast mode [ 45.305297][ T5212] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 45.309553][ T4710] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 45.428409][ T5229] loop0: detected capacity change from 0 to 256 [ 45.545242][ T5236] loop4: detected capacity change from 0 to 512 [ 45.577528][ T5236] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 45.577556][ T5236] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 45.585560][ T5236] EXT4-fs error (device loop4): ext4_orphan_get:1429: comm syz.4.83: bad orphan inode 131083 [ 45.585585][ T5236] loop4: lost filesystem error report for type 5 error -117 [ 45.591942][ T5236] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 45.917407][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 45.969607][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.978720][ T5246] loop2: detected capacity change from 0 to 128 [ 45.995710][ T5246] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 46.050086][ T5251] loop4: detected capacity change from 0 to 1024 [ 46.050465][ T5251] EXT4-fs: Ignoring removed oldalloc option [ 46.050474][ T5251] EXT4-fs: Ignoring removed orlov option [ 46.075764][ T5251] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.651201][ T5264] netlink: 28 bytes leftover after parsing attributes in process `syz.3.95'. [ 46.651266][ T5264] macvlan1: entered promiscuous mode [ 46.651412][ T5264] macvlan1: entered allmulticast mode [ 46.651422][ T5264] veth1_vlan: entered allmulticast mode [ 46.670349][ T5266] tipc: Enabling of bearer rejected, failed to enable media [ 46.743067][ T5273] loop3: detected capacity change from 0 to 512 [ 46.748532][ T5273] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 46.756739][ T5273] EXT4-fs (loop3): 1 truncate cleaned up [ 46.758410][ T5273] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.901916][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 47.360297][ T4719] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 47.714475][ T4710] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.815152][ T5299] netlink: 'syz.3.103': attribute type 8 has an invalid length. [ 47.815171][ T5299] netlink: 20 bytes leftover after parsing attributes in process `syz.3.103'. [ 47.829349][ T5301] loop0: detected capacity change from 0 to 512 [ 47.832394][ T5301] journal_path: Lookup failure for './file1' [ 47.832412][ T5301] EXT4-fs: error: could not find journal device path [ 48.065368][ T5299] v: renamed from veth0_vlan [ 48.547359][ T5308] loop4: detected capacity change from 0 to 256 [ 48.550239][ T5308] vfat: Unknown parameter 'shortnaail' [ 49.014304][ T5329] loop0: detected capacity change from 0 to 256 [ 49.156662][ T5322] loop2: detected capacity change from 0 to 1024 [ 49.167925][ T5322] EXT4-fs (loop2): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 49.444724][ T5322] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 2: comm syz.2.108: lblock 2 mapped to illegal pblock 2 (length 1) [ 49.444757][ T5322] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 49.447871][ T5322] Quota error (device loop2): qtree_write_dquot: dquota write failed [ 49.447911][ T5322] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 48: comm syz.2.108: lblock 0 mapped to illegal pblock 48 (length 1) [ 49.447928][ T5322] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 49.448089][ T5322] Quota error (device loop2): v2_write_file_info: Can't write info structure [ 49.448098][ T5322] EXT4-fs error (device loop2): ext4_acquire_dquot:7069: comm syz.2.108: Failed to acquire dquot type 0 [ 49.448108][ T5322] loop2: lost filesystem error report for type 5 error -117 [ 49.449167][ T5322] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 49.449182][ T5322] loop2: lost filesystem error report for type 5 error -117 [ 49.451734][ C1] EXT4-fs (loop2): error count since last fsck: 4 [ 49.451752][ C1] EXT4-fs (loop2): initial error at time 49: ext4_map_blocks:790: inode 3: block 2 [ 49.451772][ C1] EXT4-fs (loop2): last error at time 49: ext4_reserve_inode_write:6522 [ 49.480216][ T5322] EXT4-fs error (device loop2): ext4_evict_inode:269: inode #11: comm syz.2.108: mark_inode_dirty error [ 49.480248][ T5322] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 49.502126][ T5322] EXT4-fs warning (device loop2): ext4_evict_inode:272: couldn't mark inode dirty (err -117) [ 49.502216][ T5322] EXT4-fs (loop2): 1 orphan inode deleted [ 49.502697][ T5322] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 49.528102][ T5322] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000. [ 49.529999][ T5322] netlink: 'syz.2.108': attribute type 4 has an invalid length. [ 49.530018][ T5322] netlink: 156 bytes leftover after parsing attributes in process `syz.2.108'. [ 49.534013][ T4996] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:10: lblock 1 mapped to illegal pblock 1 (length 1) [ 49.543595][ T5322] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 49.544116][ T4996] Quota error (device loop2): remove_tree: Can't read quota data block 1 [ 49.544143][ T4996] EXT4-fs error (device loop2): ext4_release_dquot:7105: comm kworker/u8:10: Failed to release dquot type 0 [ 49.837877][ T4400] v: left promiscuous mode [ 49.839389][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.843924][ T4821] v: entered promiscuous mode [ 49.849802][ T4719] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 49.849829][ T4719] loop2: lost filesystem error report for type 5 error -117 [ 49.856869][ T4719] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 49.856888][ T4719] loop2: lost filesystem error report for type 5 error -117 [ 49.857095][ T4719] EXT4-fs error (device loop2): ext4_quota_off:7353: inode #3: comm syz-executor: mark_inode_dirty error [ 49.857108][ T4719] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 49.857440][ T4719] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 49.857460][ T4719] loop2: lost filesystem error report for type 5 error -117 [ 50.031968][ T5360] syzkaller0: entered promiscuous mode [ 50.031987][ T5360] syzkaller0: entered allmulticast mode [ 50.064078][ T5356] Bluetooth: MGMT ver 1.23 [ 50.440426][ T5360] tipc: Started in network mode [ 50.440449][ T5360] tipc: Node identity 4e44dee86763, cluster identity 4711 [ 50.440607][ T5360] tipc: Enabled bearer , priority 0 [ 50.464776][ T5359] tipc: Resetting bearer [ 50.480162][ T5359] tipc: Disabling bearer [ 50.862258][ T5386] ip_tables: iptables: counters copy to user failed while replacing table [ 50.896645][ T5390] loop4: detected capacity change from 0 to 512 [ 50.927502][ T5390] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 51.058857][ T5398] netlink: 4 bytes leftover after parsing attributes in process `syz.0.121'. [ 51.170219][ T5400] tipc: Enabling of bearer rejected, failed to enable media [ 52.222594][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.982036][ T4713] Bluetooth: hci0: command 0x2016 tx timeout [ 53.267045][ T5411] loop0: detected capacity change from 0 to 1024 [ 53.267810][ T5411] EXT4-fs: Ignoring removed oldalloc option [ 53.267820][ T5411] EXT4-fs: Ignoring removed orlov option [ 53.286756][ T5411] EXT4-fs (loop0): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 53.288325][ T5415] ip_tables: iptables: counters copy to user failed while replacing table [ 53.304907][ T5421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.305119][ T5421] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.371489][ T5427] loop1: detected capacity change from 0 to 256 [ 53.377162][ T5421] Trying to write to read-only block-device nullb0 [ 53.471406][ T5431] loop2: detected capacity change from 0 to 8192 [ 53.474101][ T5431] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 54.490009][ T4716] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 55.052018][ T4713] Bluetooth: hci0: command 0x2016 tx timeout [ 55.143459][ T5442] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 55.259892][ T5448] file system registered [ 55.470849][ T5451] tipc: Enabling of bearer rejected, failed to enable media [ 55.700935][ T5469] netlink: 'syz.1.138': attribute type 1 has an invalid length. [ 55.702340][ T5469] netlink: 28 bytes leftover after parsing attributes in process `syz.1.138'. [ 55.728775][ T5471] loop0: detected capacity change from 0 to 128 [ 55.997124][ T5471] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 56.079937][ T5480] protocol 0000 is buggy, dev veth0_vlan [ 56.400469][ T5489] loop4: detected capacity change from 0 to 512 [ 56.410049][ T5489] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #13: comm syz.4.144: attempt to clear invalid blocks 2 len 1 [ 56.410083][ T5489] loop4: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 56.411112][ T5489] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 216 vs 220 free clusters [ 56.411526][ T5489] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #13: comm syz.4.144: invalid indirect mapped block 1819239214 (level 0) [ 56.411542][ T5489] loop4: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 56.411737][ C0] EXT4-fs (loop4): error count since last fsck: 3 [ 56.411754][ C0] EXT4-fs (loop4): initial error at time 56: ext4_clear_blocks:876: inode 13 [ 56.411769][ C0] EXT4-fs (loop4): last error at time 56: ext4_free_branches:1023: inode 13 [ 56.421050][ T5489] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #13: comm syz.4.144: invalid indirect mapped block 1819239214 (level 1) [ 56.421094][ T5489] loop4: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 56.444223][ T5489] EXT4-fs (loop4): 1 truncate cleaned up [ 56.444740][ T5489] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 56.800550][ T4716] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 57.141782][ T4722] Bluetooth: hci0: command 0x2016 tx timeout [ 57.157673][ T5504] syzkaller0: entered promiscuous mode [ 57.157691][ T5504] syzkaller0: entered allmulticast mode [ 57.166165][ T5499] loop0: detected capacity change from 0 to 1024 [ 57.166474][ T5499] overlayfs: failed lookup in lower (newroot/28, name='bus', err=-40): overlapping layers [ 57.166647][ T5499] overlayfs: failed lookup in lower (newroot/28, name='bus', err=-40): overlapping layers [ 57.168619][ T5506] netlink: 'syz.1.149': attribute type 1 has an invalid length. [ 57.180910][ T5506] bond1: entered promiscuous mode [ 57.182717][ T5506] 8021q: adding VLAN 0 to HW filter on device bond1 [ 57.238699][ T5506] bond1: (slave bridge1): making interface the new active one [ 57.238718][ T5506] bridge1: entered promiscuous mode [ 57.239385][ T5506] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 57.268545][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.315125][ T5513] netlink: 'syz.3.152': attribute type 1 has an invalid length. [ 57.383069][ T5517] netlink: 28 bytes leftover after parsing attributes in process `syz.3.152'. [ 57.407054][ T5513] bond1: entered promiscuous mode [ 57.407197][ T5513] 8021q: adding VLAN 0 to HW filter on device bond1 [ 57.472907][ T5520] batman_adv: batadv0: Adding interface: netdevsim0 [ 57.472943][ T5520] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 57.473002][ T5520] batman_adv: batadv0: Interface activated: netdevsim0 [ 57.864715][ T5526] loop2: detected capacity change from 0 to 1024 [ 57.877506][ T5526] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 58.945053][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.633600][ T5557] netlink: 'syz.4.161': attribute type 1 has an invalid length. [ 59.635764][ T5557] netlink: 28 bytes leftover after parsing attributes in process `syz.4.161'. [ 60.107728][ T5568] netlink: 'syz.3.165': attribute type 1 has an invalid length. [ 60.117597][ T5568] bond2: entered promiscuous mode [ 60.117847][ T5568] 8021q: adding VLAN 0 to HW filter on device bond2 [ 60.132566][ T5568] netlink: 28 bytes leftover after parsing attributes in process `syz.3.165'. [ 61.000270][ T5599] netlink: 40 bytes leftover after parsing attributes in process `syz.1.171'. [ 61.235716][ T5614] netlink: 'syz.0.174': attribute type 1 has an invalid length. [ 61.311212][ T5614] 8021q: adding VLAN 0 to HW filter on device bond1 [ 61.336056][ T5616] 8021q: adding VLAN 0 to HW filter on device bond1 [ 61.336269][ T5616] bond1: (slave gre1): The slave device specified does not support setting the MAC address [ 61.336711][ T5616] bond1: (slave gre1): Error -95 calling set_mac_address [ 61.385877][ T5614] gretap1: entered promiscuous mode [ 61.388216][ T5614] bond1: (slave gretap1): making interface the new active one [ 61.388532][ T5614] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 61.415513][ T5614] 8021q: adding VLAN 0 to HW filter on device bond2 [ 61.416336][ T5614] bond1: (slave bond2): Enslaving as an active interface with a down link [ 61.429987][ T5614] bond1 (unregistering): (slave gretap1): Releasing active interface [ 61.436474][ T5614] bond1 (unregistering): (slave bond2): Releasing active interface [ 61.454138][ T5614] bond1 (unregistering): Released all slaves [ 61.823996][ T5634] FAULT_INJECTION: forcing a failure. [ 61.823996][ T5634] name failslab, interval 1, probability 0, space 0, times 0 [ 61.824021][ T5634] CPU: 1 UID: 0 PID: 5634 Comm: syz.0.178 Not tainted syzkaller #0 PREEMPT [ 61.824031][ T5634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 61.824037][ T5634] Call trace: [ 61.824040][ T5634] show_stack+0x2c/0x3c (C) [ 61.824061][ T5634] __dump_stack+0x30/0x40 [ 61.824075][ T5634] dump_stack_lvl+0xd8/0x12c [ 61.824086][ T5634] dump_stack+0x1c/0x28 [ 61.824098][ T5634] should_fail_ex+0x418/0x58c [ 61.824113][ T5634] should_failslab+0xc4/0x120 [ 61.824126][ T5634] __kmalloc_noprof+0x108/0x6c8 [ 61.824136][ T5634] tomoyo_init_log+0x15ec/0x1a4c [ 61.824146][ T5634] tomoyo_supervisor+0x280/0xf28 [ 61.824154][ T5634] tomoyo_audit_path_log+0xc8/0x100 [ 61.824165][ T5634] tomoyo_path_permission+0x160/0x250 [ 61.824175][ T5634] tomoyo_check_open_permission+0x22c/0x394 [ 61.824185][ T5634] tomoyo_file_open+0x78/0xcc [ 61.824196][ T5634] security_file_open+0xbc/0x258 [ 61.824207][ T5634] do_dentry_open+0x2a8/0xfbc [ 61.824219][ T5634] vfs_open+0x44/0x2dc [ 61.824230][ T5634] path_openat+0x1084/0x18f0 [ 61.824241][ T5634] do_file_open+0x1c8/0x2e8 [ 61.824251][ T5634] do_sys_openat2+0x114/0x1e8 [ 61.824262][ T5634] do_sys_open+0xb0/0xe0 [ 61.824273][ T5634] __arm64_sys_openat+0xa8/0xc4 [ 61.824285][ T5634] invoke_syscall+0x98/0x244 [ 61.824298][ T5634] el0_svc_common+0xec/0x23c [ 61.824309][ T5634] do_el0_svc+0x4c/0x5c [ 61.824321][ T5634] el0_svc+0x60/0x1d8 [ 61.824334][ T5634] el0t_64_sync_handler+0x44/0x104 [ 61.824346][ T5634] el0t_64_sync+0x198/0x19c [ 62.040686][ T5645] syzkaller0: entered promiscuous mode [ 62.040709][ T5645] syzkaller0: entered allmulticast mode [ 62.384027][ T5661] netlink: 'syz.2.183': attribute type 1 has an invalid length. [ 62.400240][ T5664] loop1: detected capacity change from 0 to 256 [ 62.410716][ T5661] bond2: entered promiscuous mode [ 62.410894][ T5661] 8021q: adding VLAN 0 to HW filter on device bond2 [ 62.607710][ T5661] netlink: 28 bytes leftover after parsing attributes in process `syz.2.183'. [ 62.785509][ T5670] No such timeout policy "syz1" [ 63.093335][ T5674] tipc: Enabling of bearer rejected, failed to enable media [ 63.107905][ T5678] loop1: detected capacity change from 0 to 1024 [ 63.109543][ T5678] EXT4-fs: Ignoring removed oldalloc option [ 63.109559][ T5678] EXT4-fs: Ignoring removed orlov option [ 63.170660][ T5678] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 63.214775][ T5689] loop4: detected capacity change from 0 to 512 [ 63.236560][ T5685] syzkaller0: entered promiscuous mode [ 63.236576][ T5685] syzkaller0: entered allmulticast mode [ 63.238590][ T5689] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 63.238643][ T5689] System zones: 1-12 [ 63.239179][ T5689] EXT4-fs error (device loop4): ext4_xattr_inode_iget:437: inode #12: comm syz.4.192: missing EA_INODE flag [ 63.239193][ T5689] loop4: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 63.240942][ T5689] EXT4-fs error (device loop4): ext4_xattr_inode_iget:442: comm syz.4.192: error while reading EA inode 12 err=-117 [ 63.240965][ T5689] loop4: lost filesystem error report for type 5 error -117 [ 63.241414][ T5691] syzkaller0: entered promiscuous mode [ 63.241429][ T5691] syzkaller0: entered allmulticast mode [ 63.241742][ C0] EXT4-fs (loop4): error count since last fsck: 2 [ 63.241754][ C0] EXT4-fs (loop4): initial error at time 63: ext4_xattr_inode_iget:437: inode 12 [ 63.241774][ C0] EXT4-fs (loop4): last error at time 63: ext4_xattr_inode_iget:442 [ 63.257996][ T5689] EXT4-fs (loop4): 1 orphan inode deleted [ 63.258462][ T5689] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 63.353553][ T5685] tipc: Enabled bearer , priority 0 [ 63.358542][ T5685] tipc: Resetting bearer [ 63.362705][ T5684] tipc: Resetting bearer [ 63.366727][ T5684] tipc: Disabling bearer [ 63.699587][ T5705] syzkaller0: entered promiscuous mode [ 63.699609][ T5705] syzkaller0: entered allmulticast mode [ 63.752838][ T5713] loop2: detected capacity change from 0 to 512 [ 63.754793][ T5713] journal_path: Lookup failure for './file1' [ 63.754807][ T5713] EXT4-fs: error: could not find journal device path [ 64.081873][ T5724] Option 'äÇ©?oÈ냟W½ÎƒÞ(ödîðÌ›ÔÏpø^ï8Æ ÝõXKÒtÔ..+jXpsízÑÔû¸ÔÿgˆH{“é&·}–(Ú)“eÒÓH/ Ïk;REÁŠ¨ãÂÉ<' to dns_resolver key: bad/missing value [ 64.094353][ T5721] x_tables: duplicate underflow at hook 3 [ 64.136509][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 64.148670][ T5721] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 64.155804][ T5726] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 64.163208][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.226008][ T5730] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 64.711599][ T1596] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.711637][ T1596] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.721043][ T9] cfg80211: failed to load regulatory.db [ 64.733755][ T5747] loop0: detected capacity change from 0 to 512 [ 64.742255][ T5747] EXT4-fs (loop0): Test dummy encryption mode enabled [ 64.746312][ T5747] EXT4-fs error (device loop0): ext4_orphan_get:1403: inode #15: comm syz.0.203: inode has both inline data and extents flags [ 64.746336][ T5747] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 64.746453][ T5747] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.203: couldn't read orphan inode 15 (err -117) [ 64.746466][ T5747] loop0: lost filesystem error report for type 5 error -117 [ 64.747292][ T5747] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 64.786872][ T5752] syzkaller0: entered promiscuous mode [ 64.786892][ T5752] syzkaller0: entered allmulticast mode [ 64.913197][ T5757] tipc: Enabling of bearer rejected, failed to enable media [ 65.091790][ T24] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 65.991825][ T24] usb 1-1: New USB device found, idVendor=0ab4, idProduct=0011, bcdDevice=ca.fb [ 66.002645][ T24] usb 1-1: config 2 has an invalid interface number: 79 but max is 0 [ 66.002664][ T24] usb 1-1: config 2 has no interface number 0 [ 66.002678][ T24] usb 1-1: config 2 interface 79 has no altsetting 0 [ 66.004131][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.004145][ T24] usb 1-1: Product: syz [ 66.004153][ T24] usb 1-1: Manufacturer: syz [ 66.004160][ T24] usb 1-1: SerialNumber: syz [ 66.029901][ T5777] loop4: detected capacity change from 0 to 1024 [ 66.040158][ T5777] EXT4-fs: Ignoring removed oldalloc option [ 66.040179][ T5777] EXT4-fs: Ignoring removed orlov option [ 66.065707][ T5777] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 66.157839][ T5781] ip6gretap1: entered allmulticast mode [ 66.163955][ T5781] batman_adv: batadv0: Adding interface: ip6gretap1 [ 66.163969][ T5781] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.163984][ T5781] batman_adv: batadv0: Interface activated: ip6gretap1 [ 66.202848][ T5789] loop1: detected capacity change from 0 to 128 [ 66.208994][ T5788] netlink: 'syz.2.213': attribute type 1 has an invalid length. [ 66.324099][ T5798] IPVS: starting estimator thread 0... [ 66.341204][ T5788] bond3: entered promiscuous mode [ 66.345992][ T5788] 8021q: adding VLAN 0 to HW filter on device bond3 [ 66.349387][ T5805] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 66.373339][ T5789] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 66.376310][ T24] usb 1-1: USB disconnect, device number 3 [ 66.415548][ T5801] IPVS: using max 61 ests per chain, 146400 per kthread [ 66.437459][ T5808] loop3: detected capacity change from 0 to 1024 [ 66.462241][ T5808] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 66.509636][ T5810] loop2: detected capacity change from 0 to 2048 [ 66.540036][ T5810] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 66.548912][ T5810] EXT4-fs error (device loop2): ext4_validate_block_bitmap:436: comm syz.2.217: bg 0: block 2: invalid block bitmap [ 66.550107][ T5810] fs-verity (loop2, inode 13): ext4_end_enable_verity() failed with err -28 [ 66.573478][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 66.853433][ T5821] netlink: 'syz.2.219': attribute type 1 has an invalid length. [ 66.854723][ T5821] netlink: 28 bytes leftover after parsing attributes in process `syz.2.219'. [ 66.887685][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 66.917159][ T4716] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 66.943389][ T5823] tipc: Enabling of bearer rejected, failed to enable media [ 67.909741][ T5682] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 67.933107][ T4710] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.038665][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 68.093500][ T5848] netlink: 28 bytes leftover after parsing attributes in process `syz.1.225'. [ 68.183378][ T5854] netlink: 'syz.2.227': attribute type 1 has an invalid length. [ 68.188686][ T5854] bond4: entered promiscuous mode [ 68.188915][ T5854] 8021q: adding VLAN 0 to HW filter on device bond4 [ 68.192854][ T5854] netlink: 28 bytes leftover after parsing attributes in process `syz.2.227'. [ 68.542403][ T5866] syzkaller0: entered promiscuous mode [ 68.542424][ T5866] syzkaller0: entered allmulticast mode [ 68.932443][ T5873] netlink: 'syz.0.233': attribute type 1 has an invalid length. [ 68.938166][ T5873] bond1: entered promiscuous mode [ 68.938689][ T5873] 8021q: adding VLAN 0 to HW filter on device bond1 [ 68.943731][ T5873] netlink: 28 bytes leftover after parsing attributes in process `syz.0.233'. [ 69.058242][ T5879] tipc: Enabling of bearer rejected, failed to enable media [ 69.073523][ T5882] syzkaller0: entered promiscuous mode [ 69.073542][ T5882] syzkaller0: entered allmulticast mode [ 69.087604][ T5885] loop3: detected capacity change from 0 to 128 [ 69.331283][ T5885] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 69.455237][ T5900] netlink: 'syz.2.239': attribute type 1 has an invalid length. [ 69.461156][ T5900] bond5: entered promiscuous mode [ 69.461387][ T5900] 8021q: adding VLAN 0 to HW filter on device bond5 [ 69.469148][ T5900] netlink: 28 bytes leftover after parsing attributes in process `syz.2.239'. [ 69.502693][ T5904] loop4: detected capacity change from 0 to 8192 [ 69.502789][ T5907] netlink: 28 bytes leftover after parsing attributes in process `syz.2.241'. [ 70.065453][ T5918] netlink: 4 bytes leftover after parsing attributes in process `syz.0.243'. [ 70.076228][ T4710] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 70.109351][ T5926] netlink: 'syz.3.244': attribute type 1 has an invalid length. [ 70.122523][ T5926] bond3: entered promiscuous mode [ 70.122700][ T5926] 8021q: adding VLAN 0 to HW filter on device bond3 [ 70.126600][ T5926] netlink: 28 bytes leftover after parsing attributes in process `syz.3.244'. [ 70.875754][ T5945] syz.2.250 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 70.877900][ T5945] loop2: detected capacity change from 0 to 512 [ 70.914524][ T5945] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 70.914835][ T5945] EXT4-fs (loop2): Remounting filesystem read-only [ 70.915043][ T5945] EXT4-fs (loop2): 1 truncate cleaned up [ 70.915507][ T5945] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 70.943182][ T5951] syzkaller0: entered promiscuous mode [ 70.943204][ T5951] syzkaller0: entered allmulticast mode [ 71.071949][ T5955] loop4: detected capacity change from 0 to 128 [ 71.134832][ T5955] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 71.145422][ T4722] Bluetooth: hci0: unexpected event for opcode 0x201c [ 71.418720][ T5945] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 71.514370][ T5960] loop2: detected capacity change from 0 to 512 [ 71.536339][ T5960] EXT4-fs error (device loop2): ext4_orphan_get:1403: inode #17: comm syz.2.255: iget: immutable or append flags not allowed on symlinks [ 71.536364][ T5960] loop2: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 71.536490][ T5960] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.255: couldn't read orphan inode 17 (err -117) [ 71.536507][ T5960] loop2: lost filesystem error report for type 5 error -117 [ 71.537034][ T5960] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 71.566665][ T5960] netlink: 'syz.2.255': attribute type 17 has an invalid length. [ 71.566684][ T5960] netlink: 8 bytes leftover after parsing attributes in process `syz.2.255'. [ 71.566700][ T5960] bond0: option all_slaves_active: invalid value (214) [ 71.625348][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 71.634566][ T4996] netdevsim netdevsim120 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.671214][ T5969] loop1: detected capacity change from 0 to 256 [ 71.682526][ T5969] netlink: 112 bytes leftover after parsing attributes in process `syz.1.259'. [ 71.717967][ T5973] syzkaller0: entered promiscuous mode [ 71.717985][ T5973] syzkaller0: entered allmulticast mode [ 72.290293][ T5984] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 72.318643][ T4708] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 72.327042][ T5986] netlink: 'syz.0.264': attribute type 1 has an invalid length. [ 72.341479][ T5986] bond3: entered promiscuous mode [ 72.344696][ T5986] 8021q: adding VLAN 0 to HW filter on device bond3 [ 72.349214][ T5986] netlink: 28 bytes leftover after parsing attributes in process `syz.0.264'. [ 72.814592][ T6004] loop2: detected capacity change from 0 to 512 [ 73.368849][ T6017] netlink: 28 bytes leftover after parsing attributes in process `syz.0.275'. [ 73.412526][ T6021] netlink: 'syz.0.277': attribute type 1 has an invalid length. [ 73.417791][ T6021] bond4: entered promiscuous mode [ 73.417980][ T6021] 8021q: adding VLAN 0 to HW filter on device bond4 [ 73.421564][ T6021] netlink: 28 bytes leftover after parsing attributes in process `syz.0.277'. [ 74.194712][ T6040] syzkaller0: entered promiscuous mode [ 74.194730][ T6040] syzkaller0: entered allmulticast mode [ 74.258125][ T6044] syzkaller0: entered promiscuous mode [ 74.258143][ T6044] syzkaller0: entered allmulticast mode [ 74.365414][ T6051] syzkaller0: entered promiscuous mode [ 74.365433][ T6051] syzkaller0: entered allmulticast mode [ 74.831504][ T6066] tipc: Started in network mode [ 74.831526][ T6066] tipc: Node identity 1, cluster identity 4711 [ 74.831533][ T6066] tipc: Node number set to 1 [ 74.837668][ T6066] tipc: New replicast peer: 127.0.0.1 [ 74.839597][ T6066] tipc: Enabled bearer , priority 10 [ 74.853231][ T6068] netlink: 'syz.2.294': attribute type 1 has an invalid length. [ 74.871350][ T6068] bond6: entered promiscuous mode [ 74.871549][ T6068] 8021q: adding VLAN 0 to HW filter on device bond6 [ 74.878080][ T6068] netlink: 28 bytes leftover after parsing attributes in process `syz.2.294'. [ 74.938889][ T6074] loop4: detected capacity change from 0 to 128 [ 74.944369][ T4701] udevd[4701]: incorrect ext4 checksum on /dev/loop4 [ 74.945973][ T6074] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 74.948759][ T4722] Bluetooth: hci0: unexpected event for opcode 0x201c [ 74.960143][ T6070] FAULT_INJECTION: forcing a failure. [ 74.960143][ T6070] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 74.960166][ T6070] CPU: 0 UID: 0 PID: 6070 Comm: syz.3.291 Not tainted syzkaller #0 PREEMPT [ 74.960177][ T6070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 74.960183][ T6070] Call trace: [ 74.960187][ T6070] show_stack+0x2c/0x3c (C) [ 74.960209][ T6070] __dump_stack+0x30/0x40 [ 74.960221][ T6070] dump_stack_lvl+0xd8/0x12c [ 74.960233][ T6070] dump_stack+0x1c/0x28 [ 74.960244][ T6070] should_fail_ex+0x418/0x58c [ 74.960258][ T6070] should_fail+0x14/0x24 [ 74.960270][ T6070] should_fail_usercopy+0x20/0x30 [ 74.960278][ T6070] core_sys_select+0x750/0x9e4 [ 74.960287][ T6070] __arm64_sys_pselect6+0x2f0/0x39c [ 74.960295][ T6070] invoke_syscall+0x98/0x244 [ 74.960308][ T6070] el0_svc_common+0xec/0x23c [ 74.960320][ T6070] do_el0_svc+0x4c/0x5c [ 74.960332][ T6070] el0_svc+0x60/0x1d8 [ 74.960346][ T6070] el0t_64_sync_handler+0x44/0x104 [ 74.960358][ T6070] el0t_64_sync+0x198/0x19c [ 75.290130][ T6085] netlink: 'syz.0.298': attribute type 1 has an invalid length. [ 75.294056][ T6085] netlink: 28 bytes leftover after parsing attributes in process `syz.0.298'. [ 75.363328][ T6087] syzkaller0: entered promiscuous mode [ 75.363346][ T6087] syzkaller0: entered allmulticast mode [ 75.364827][ T6087] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 75.541042][ T4708] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 75.677042][ T6097] 0x000000000000-0x000000010000 : "" [ 75.922897][ T6097] FAULT_INJECTION: forcing a failure. [ 75.922897][ T6097] name failslab, interval 1, probability 0, space 0, times 0 [ 75.922926][ T6097] CPU: 0 UID: 0 PID: 6097 Comm: syz.3.303 Not tainted syzkaller #0 PREEMPT [ 75.922938][ T6097] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 75.922944][ T6097] Call trace: [ 75.922947][ T6097] show_stack+0x2c/0x3c (C) [ 75.922970][ T6097] __dump_stack+0x30/0x40 [ 75.922982][ T6097] dump_stack_lvl+0xd8/0x12c [ 75.922994][ T6097] dump_stack+0x1c/0x28 [ 75.923005][ T6097] should_fail_ex+0x418/0x58c [ 75.923019][ T6097] should_failslab+0xc4/0x120 [ 75.923032][ T6097] __kmalloc_noprof+0x108/0x6c8 [ 75.923042][ T6097] kobject_get_path+0xbc/0x2a4 [ 75.923052][ T6097] kobject_uevent_env+0x264/0x944 [ 75.923061][ T6097] kobject_uevent+0x2c/0x3c [ 75.923070][ T6097] device_add+0x4d0/0x9e0 [ 75.923081][ T6097] nvmem_register+0xa18/0xe44 [ 75.923093][ T6097] add_mtd_device+0xd84/0x1504 [ 75.923105][ T6097] mtd_add_partition+0x318/0x438 [ 75.923116][ T6097] mtdchar_blkpg_ioctl+0x224/0x248 [ 75.923124][ T6097] mtdchar_ioctl+0x1218/0x1a7c [ 75.923137][ T6097] mtdchar_unlocked_ioctl+0xb0/0xd8 [ 75.923149][ T6097] __arm64_sys_ioctl+0x154/0x1cc [ 75.923157][ T6097] invoke_syscall+0x98/0x244 [ 75.923170][ T6097] el0_svc_common+0xec/0x23c [ 75.923181][ T6097] do_el0_svc+0x4c/0x5c [ 75.923192][ T6097] el0_svc+0x60/0x1d8 [ 75.923204][ T6097] el0t_64_sync_handler+0x44/0x104 [ 75.923217][ T6097] el0t_64_sync+0x198/0x19c [ 75.935387][ T6097] ftl_cs: FTL header not found. [ 76.495733][ T6109] No such timeout policy "syz1" [ 76.708920][ T6115] tipc: Started in network mode [ 76.708943][ T6115] tipc: Node identity 2230e629d096, cluster identity 4711 [ 76.709033][ T6115] tipc: Enabled bearer , priority 0 [ 76.713846][ T6115] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 76.730123][ T6114] tipc: Disabling bearer [ 77.654619][ T6117] Dev nullb1: unable to read RDB block 8 [ 77.654712][ T6117] nullb1: unable to read partition table [ 77.658084][ T6117] null_blk: disk nullb1 created [ 77.690591][ T6124] syzkaller0: entered promiscuous mode [ 77.690611][ T6124] syzkaller0: entered allmulticast mode [ 77.713196][ T6127] loop0: detected capacity change from 0 to 128 [ 77.731639][ T6127] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 77.788093][ T6131] loop4: detected capacity change from 0 to 512 [ 77.797172][ T6131] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 77.802436][ T6131] EXT4-fs (loop4): 1 truncate cleaned up [ 77.802906][ T6131] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 77.832907][ T6135] loop2: detected capacity change from 0 to 128 [ 77.851896][ T6135] EXT4-fs (loop2): Test dummy encryption mode enabled [ 77.855229][ T6135] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 77.918726][ T6139] syzkaller0: entered promiscuous mode [ 77.918746][ T6139] syzkaller0: entered allmulticast mode [ 77.934149][ T6139] 0: reclassify loop, rule prio 0, protocol 700 [ 78.138658][ T6143] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-ce" [ 78.191918][ T6137] EXT4-fs error (device loop4): ext4_generic_delete_entry:2675: inode #2: block 13: comm syz.4.314: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 78.193428][ T6137] EXT4-fs (loop4): Remounting filesystem read-only [ 78.193454][ T6137] EXT4-fs warning (device loop4): ext4_rename_delete:3741: inode #2: comm syz.4.314: Deleting old file: nlink 4, error=-117 [ 78.223838][ T6145] syzkaller0: entered promiscuous mode [ 78.223857][ T6145] syzkaller0: entered allmulticast mode [ 78.225303][ T6145] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 78.263033][ T6147] loop3: detected capacity change from 0 to 1024 [ 78.265281][ T6147] EXT4-fs: Ignoring removed bh option [ 78.273380][ T6147] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 78.333933][ T6151] loop1: detected capacity change from 0 to 1024 [ 78.379835][ T6151] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 78.758135][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.760365][ T4719] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 78.776321][ T4716] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 78.864795][ T6164] tipc: Enabled bearer , priority 0 [ 78.874175][ T6164] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 78.892646][ T6162] tipc: Disabling bearer [ 79.031634][ T6168] loop0: detected capacity change from 0 to 1024 [ 79.034949][ T6168] EXT4-fs: Ignoring removed oldalloc option [ 79.034961][ T6168] EXT4-fs: Ignoring removed orlov option [ 79.219128][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.219773][ T6168] EXT4-fs (loop0): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 79.260265][ T4716] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 79.296233][ T6175] loop1: detected capacity change from 0 to 128 [ 79.296245][ T4710] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.306374][ T6177] loop0: detected capacity change from 0 to 512 [ 79.310623][ T6175] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 79.321634][ T6177] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 79.330679][ T6177] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8842e11c, mo2=0102] [ 79.330799][ T6177] EXT4-fs (loop0): orphan cleanup on readonly fs [ 79.331146][ T6177] EXT4-fs error (device loop0): ext4_clear_blocks:876: inode #11: comm syz.0.325: attempt to clear invalid blocks 1024 len 1 [ 79.331160][ T6177] loop0: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 79.331558][ T6177] EXT4-fs error (device loop0): ext4_validate_block_bitmap:445: comm syz.0.325: bg 0: block 361: padding at end of block bitmap is not set [ 79.331574][ T6177] loop0: lost filesystem error report for type 5 error -117 [ 79.331718][ C0] EXT4-fs (loop0): error count since last fsck: 2 [ 79.331728][ C0] EXT4-fs (loop0): initial error at time 79: ext4_clear_blocks:876: inode 11 [ 79.331745][ C0] EXT4-fs (loop0): last error at time 79: ext4_validate_block_bitmap:445 [ 79.331883][ T6177] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 79.331894][ T6177] loop0: lost filesystem error report for type 5 error -117 [ 79.332125][ T6177] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #11: comm syz.0.325: invalid indirect mapped block 1811939328 (level 0) [ 79.332139][ T6177] loop0: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 79.332258][ T6177] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #11: comm syz.0.325: invalid indirect mapped block 2185560079 (level 1) [ 79.332270][ T6177] loop0: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 79.334384][ T6177] EXT4-fs (loop0): 1 truncate cleaned up [ 79.334896][ T6177] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: none. [ 79.443449][ T6184] syzkaller0: entered promiscuous mode [ 79.443466][ T6184] syzkaller0: entered allmulticast mode [ 79.515518][ T6185] EXT4-fs warning (device loop0): dx_probe:861: inode #2: comm syz.0.325: dx entry: limit 0 != root limit 125 [ 79.515582][ T6185] EXT4-fs warning (device loop0): dx_probe:934: inode #2: comm syz.0.325: Corrupt directory, running e2fsck is recommended [ 79.753930][ T6188] syzkaller0: entered promiscuous mode [ 79.753948][ T6188] syzkaller0: entered allmulticast mode [ 79.755030][ T6188] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 79.873430][ T6196] loop2: detected capacity change from 0 to 128 [ 79.880402][ T6196] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 79.924139][ T6199] syzkaller0: entered promiscuous mode [ 79.924156][ T6199] syzkaller0: entered allmulticast mode [ 79.925496][ T6199] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 80.184435][ T4716] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 80.887661][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 80.913294][ T6217] syzkaller0: entered promiscuous mode [ 80.913314][ T6217] syzkaller0: entered allmulticast mode [ 81.345753][ T4719] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 81.378938][ T6229] loop3: detected capacity change from 0 to 128 [ 81.380816][ T6227] syzkaller0: entered promiscuous mode [ 81.380831][ T6227] syzkaller0: entered allmulticast mode [ 81.388230][ T6229] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 81.388359][ T6227] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 81.623901][ T6233] md: invalid raid superblock magic on ram0 [ 81.623918][ T6233] md: ram0 does not have a valid v0.0 superblock, not importing! [ 81.623957][ T6233] md: md_import_device returned -22 [ 81.627796][ T6233] loop2: detected capacity change from 0 to 512 [ 81.628732][ T6233] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 81.641462][ T6233] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 81.716878][ T6238] syzkaller0: entered promiscuous mode [ 81.716897][ T6238] syzkaller0: entered allmulticast mode [ 81.718590][ T6238] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 81.792547][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 81.831478][ T6242] sch_tbf: peakrate 11 is lower than or equals to rate 2112 ! [ 81.881338][ T6245] loop1: detected capacity change from 0 to 512 [ 81.893496][ T6245] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 81.900143][ T6248] netlink: 'syz.4.349': attribute type 1 has an invalid length. [ 81.903076][ T6248] netlink: 28 bytes leftover after parsing attributes in process `syz.4.349'. [ 81.915117][ T6254] netlink: 'syz.0.351': attribute type 1 has an invalid length. [ 81.919715][ T6254] netlink: 28 bytes leftover after parsing attributes in process `syz.0.351'. [ 81.919922][ T6245] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 81.949791][ T6256] loop2: detected capacity change from 0 to 512 [ 81.965091][ T6256] EXT4-fs (loop2): couldn't mount as ext3 due to feature incompatibilities [ 82.007518][ T6256] loop2: detected capacity change from 0 to 1024 [ 82.022035][ T6259] netlink: 'syz.4.353': attribute type 1 has an invalid length. [ 82.033425][ T6259] netlink: 28 bytes leftover after parsing attributes in process `syz.4.353'. [ 82.311452][ T4710] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 82.361983][ T6267] syzkaller0: entered promiscuous mode [ 82.362006][ T6267] syzkaller0: entered allmulticast mode [ 82.363753][ T6267] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 82.380864][ T6269] loop0: detected capacity change from 0 to 1024 [ 82.390035][ T6269] EXT4-fs: Ignoring removed bh option [ 82.406451][ T6269] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 82.504140][ T6277] syzkaller0: entered promiscuous mode [ 82.504167][ T6277] syzkaller0: entered allmulticast mode [ 82.505922][ T6277] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 82.790210][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 83.005828][ T6291] sch_tbf: peakrate 11 is lower than or equals to rate 2112 ! [ 83.085312][ T6296] loop1: detected capacity change from 0 to 128 [ 83.102886][ T6296] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 83.285705][ T4716] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 83.310858][ T6304] netlink: 'syz.0.367': attribute type 1 has an invalid length. [ 83.314665][ T6304] netlink: 28 bytes leftover after parsing attributes in process `syz.0.367'. [ 83.384827][ T6307] syzkaller0: entered promiscuous mode [ 83.384849][ T6307] syzkaller0: entered allmulticast mode [ 83.386347][ T6307] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 83.561038][ T6314] loop2: detected capacity change from 0 to 512 [ 83.564801][ T6314] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 83.776751][ T6317] loop0: detected capacity change from 0 to 256 [ 83.872888][ T6314] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 83.893350][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 83.917276][ T6319] syzkaller0: entered promiscuous mode [ 83.917296][ T6319] syzkaller0: entered allmulticast mode [ 83.919273][ T6319] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 84.315611][ T6327] loop4: detected capacity change from 0 to 512 [ 84.321663][ T6327] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 84.365755][ T6327] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4223: comm syz.4.374: Allocating blocks 41-42 which overlap fs metadata [ 84.365789][ T6327] loop4: lost filesystem error report for type 5 error -117 [ 84.371740][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 84.371761][ C0] EXT4-fs (loop4): initial error at time 84: ext4_mb_mark_diskspace_used:4223 [ 84.371773][ C0] EXT4-fs (loop4): last error at time 84: ext4_mb_mark_diskspace_used:4223 [ 84.379972][ T6327] EXT4-fs (loop4): Remounting filesystem read-only [ 84.380146][ T6327] Quota error (device loop4): write_blk: dquota write failed [ 84.380160][ T6327] Quota error (device loop4): find_free_dqentry: Can't write quota data block 5 [ 84.380261][ T6327] Quota error (device loop4): write_blk: dquota write failed [ 84.380308][ T6327] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 84.380398][ T6327] EXT4-fs (loop4): 1 truncate cleaned up [ 84.380893][ T6327] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 85.051236][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 85.081066][ T6345] netlink: 'syz.2.379': attribute type 1 has an invalid length. [ 85.084361][ T6345] netlink: 28 bytes leftover after parsing attributes in process `syz.2.379'. [ 85.091477][ T6344] syzkaller0: entered promiscuous mode [ 85.091503][ T6344] syzkaller0: entered allmulticast mode [ 85.099089][ T6344] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 85.453274][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 85.453976][ T6349] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 85.993074][ T6370] syzkaller0: entered promiscuous mode [ 85.993096][ T6370] syzkaller0: entered allmulticast mode [ 86.390638][ T6386] netlink: 28 bytes leftover after parsing attributes in process `syz.4.392'. [ 86.405251][ T6384] syzkaller0: entered promiscuous mode [ 86.405271][ T6384] syzkaller0: entered allmulticast mode [ 86.407265][ T6384] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 86.420564][ T6388] set_capacity_and_notify: 2 callbacks suppressed [ 86.420582][ T6388] loop3: detected capacity change from 0 to 512 [ 86.430920][ T6388] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 86.454185][ T6388] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 86.554259][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 86.557419][ T6393] syzkaller0: entered promiscuous mode [ 86.557443][ T6393] syzkaller0: entered allmulticast mode [ 86.560085][ T6393] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 86.896304][ T6400] loop2: detected capacity change from 0 to 512 [ 86.954883][ T6400] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=8856c01c, mo2=0002] [ 86.955498][ T6400] EXT4-fs (loop2): orphan cleanup on readonly fs [ 87.375525][ T6400] EXT4-fs warning (device loop2): ext4_enable_quotas:7304: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 87.512052][ T6400] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 87.512333][ T6400] EXT4-fs error (device loop2): ext4_ext_check_inode:521: inode #13: comm syz.2.396: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 87.512360][ T6400] loop2: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 87.512613][ T6400] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.396: couldn't read orphan inode 13 (err -117) [ 87.512631][ T6400] loop2: lost filesystem error report for type 5 error -117 [ 87.513236][ T6400] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 87.568047][ T4710] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 87.875666][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 87.912579][ T6423] netlink: 28 bytes leftover after parsing attributes in process `syz.2.404'. [ 88.167490][ T6429] loop0: detected capacity change from 0 to 128 [ 88.192652][ T6429] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 88.288052][ T6434] syzkaller0: entered promiscuous mode [ 88.288069][ T6434] syzkaller0: entered allmulticast mode [ 88.290427][ T6434] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 88.476633][ T6442] netlink: 'syz.1.408': attribute type 1 has an invalid length. [ 88.479119][ T6442] netlink: 28 bytes leftover after parsing attributes in process `syz.1.408'. [ 88.567756][ T6447] syzkaller0: entered promiscuous mode [ 88.567783][ T6447] syzkaller0: entered allmulticast mode [ 88.570375][ T6447] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 88.762060][ T6456] loop4: detected capacity change from 0 to 1024 [ 88.767530][ T6456] EXT4-fs: Ignoring removed oldalloc option [ 88.767548][ T6456] EXT4-fs: Ignoring removed orlov option [ 88.789377][ T6456] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 88.807685][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 89.824600][ T6464] syzkaller0: entered promiscuous mode [ 89.824622][ T6464] syzkaller0: entered allmulticast mode [ 89.893301][ T6472] syzkaller0: entered promiscuous mode [ 89.893319][ T6472] syzkaller0: entered allmulticast mode [ 89.896703][ T6472] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 89.908485][ T6474] syzkaller0: entered promiscuous mode [ 89.908503][ T6474] syzkaller0: entered allmulticast mode [ 89.913305][ T6474] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 90.065171][ T6483] Unknown status report in ack skb [ 90.068537][ T6483] dvmrp8: entered allmulticast mode [ 90.313357][ T6485] dvmrp8: left allmulticast mode [ 90.356457][ T4716] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 90.845872][ T6496] bridge_slave_0: left allmulticast mode [ 90.845897][ T6496] bridge_slave_0: left promiscuous mode [ 90.845978][ T6496] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.848131][ T6496] bridge_slave_1: left allmulticast mode [ 90.848148][ T6496] bridge_slave_1: left promiscuous mode [ 90.848208][ T6496] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.860165][ T6496] bond0: (slave bond_slave_0): Releasing backup interface [ 90.880652][ T6501] netlink: 24 bytes leftover after parsing attributes in process `syz.3.428'. [ 90.891237][ T6496] bond0: (slave bond_slave_1): Releasing backup interface [ 90.917075][ T6496] team0: Port device team_slave_0 removed [ 90.925963][ T6496] team0: Port device team_slave_1 removed [ 90.926321][ T6496] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 90.926333][ T6496] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 90.928784][ T6496] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 90.928795][ T6496] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 90.929460][ T6496] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 90.936087][ T6502] team0: Mode changed to "broadcast" [ 90.958908][ T6496] vlan0: entered promiscuous mode [ 90.970004][ T6496] team0: Port device vlan0 added [ 90.973730][ T6507] loop3: detected capacity change from 0 to 128 [ 90.974333][ T6507] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 90.975987][ T6507] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 90.985618][ T6496] tipc: Started in network mode [ 90.985641][ T6496] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 90.985824][ T6496] tipc: Enabled bearer , priority 0 [ 90.990281][ T4722] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 91.077139][ T6514] syzkaller0: entered promiscuous mode [ 91.077159][ T6514] syzkaller0: entered allmulticast mode [ 91.078678][ T6514] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 91.775678][ T6533] netlink: 28 bytes leftover after parsing attributes in process `syz.3.437'. [ 92.015634][ T4840] tipc: Node number set to 11578026 [ 92.865348][ T6567] netlink: 28 bytes leftover after parsing attributes in process `syz.3.449'. [ 93.336797][ T6574] syzkaller0: entered promiscuous mode [ 93.336815][ T6574] syzkaller0: entered allmulticast mode [ 93.384369][ T6576] loop2: detected capacity change from 0 to 128 [ 93.397908][ T6576] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 94.175392][ T6600] syzkaller0: entered promiscuous mode [ 94.175473][ T6600] syzkaller0: entered allmulticast mode [ 94.344110][ T6605] netlink: 28 bytes leftover after parsing attributes in process `syz.1.460'. [ 95.282601][ T4719] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 95.626497][ T6621] netlink: 4 bytes leftover after parsing attributes in process `syz.3.462'. [ 95.630475][ T6621] netlink: 4 bytes leftover after parsing attributes in process `syz.3.462'. [ 95.731975][ T6623] loop2: detected capacity change from 0 to 512 [ 96.054016][ T6623] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 96.645364][ T6634] syzkaller0: entered promiscuous mode [ 96.645382][ T6634] syzkaller0: entered allmulticast mode [ 96.692126][ T6639] syzkaller0: entered promiscuous mode [ 96.692146][ T6639] syzkaller0: entered allmulticast mode [ 96.706038][ T6637] syzkaller0: entered promiscuous mode [ 96.706056][ T6637] syzkaller0: entered allmulticast mode [ 96.708188][ T6637] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 97.388931][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.547038][ T6659] netlink: 'syz.0.476': attribute type 1 has an invalid length. [ 97.555763][ T6659] bond5: entered promiscuous mode [ 97.555996][ T6659] 8021q: adding VLAN 0 to HW filter on device bond5 [ 97.559450][ T6659] netlink: 28 bytes leftover after parsing attributes in process `syz.0.476'. [ 97.937651][ T6674] syzkaller0: entered promiscuous mode [ 97.937668][ T6674] syzkaller0: entered allmulticast mode [ 98.476779][ T6682] syzkaller0: entered promiscuous mode [ 98.476799][ T6682] syzkaller0: entered allmulticast mode [ 98.881138][ T6695] syzkaller0: entered promiscuous mode [ 98.881161][ T6695] syzkaller0: entered allmulticast mode [ 98.887447][ T6693] syzkaller0: entered promiscuous mode [ 98.887476][ T6693] syzkaller0: entered allmulticast mode [ 98.888954][ T6695] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 99.280697][ T6705] netlink: 'syz.1.490': attribute type 1 has an invalid length. [ 99.282863][ T6705] netlink: 28 bytes leftover after parsing attributes in process `syz.1.490'. [ 99.391120][ T6710] loop1: detected capacity change from 0 to 128 [ 99.470194][ T6711] netlink: 11 bytes leftover after parsing attributes in process `syz.4.489'. [ 99.625099][ T6710] FAT-fs (loop1): data area starts beyond volume (33 > 0) [ 99.625136][ T6710] FAT-fs (loop1): Can't find a valid FAT filesystem [ 99.651126][ T6713] netlink: 28 bytes leftover after parsing attributes in process `syz.0.493'. [ 99.747890][ T6717] syzkaller0: entered promiscuous mode [ 99.747906][ T6717] syzkaller0: entered allmulticast mode [ 99.750586][ T6717] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 99.814233][ T6723] loop3: detected capacity change from 0 to 2048 [ 99.835437][ T6723] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 99.838310][ T6725] syzkaller0: entered promiscuous mode [ 99.838330][ T6725] syzkaller0: entered allmulticast mode [ 99.862368][ T6725] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 100.243977][ T6734] tipc: Cannot configure node identity twice [ 100.244266][ T6734] tipc: New replicast peer: 127.0.0.1 [ 100.244518][ T6734] tipc: Enabled bearer , priority 10 [ 100.382809][ T6744] netlink: 'syz.0.503': attribute type 1 has an invalid length. [ 100.383938][ T6744] netlink: 28 bytes leftover after parsing attributes in process `syz.0.503'. [ 100.457397][ T6748] netlink: 28 bytes leftover after parsing attributes in process `syz.4.505'. [ 100.771086][ T4710] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 101.125051][ T4722] Bluetooth: hci2: link tx timeout [ 101.125067][ T4722] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 101.130807][ T6757] loop2: detected capacity change from 0 to 512 [ 101.131201][ T6757] EXT4-fs: Ignoring removed nobh option [ 101.165996][ T6757] EXT4-fs error (device loop2): ext4_do_update_inode:5801: inode #3: comm syz.2.508: corrupted inode contents [ 101.166021][ T6757] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 101.166603][ T6757] EXT4-fs error (device loop2): ext4_dirty_inode:6736: inode #3: comm syz.2.508: mark_inode_dirty error [ 101.166622][ T6757] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 101.167063][ T6757] EXT4-fs error (device loop2): ext4_do_update_inode:5801: inode #3: comm syz.2.508: corrupted inode contents [ 101.167075][ T6757] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 101.167215][ T6757] EXT4-fs error (device loop2): __ext4_ext_dirty:207: inode #3: comm syz.2.508: mark_inode_dirty error [ 101.167228][ T6757] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 101.167395][ T6757] Quota error (device loop2): write_blk: dquota write failed [ 101.167436][ T6757] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 101.167453][ T6757] EXT4-fs error (device loop2): ext4_acquire_dquot:7069: comm syz.2.508: Failed to acquire dquot type 0 [ 101.167464][ T6757] loop2: lost filesystem error report for type 5 error -117 [ 101.169228][ T6757] EXT4-fs error (device loop2): ext4_do_update_inode:5801: inode #16: comm syz.2.508: corrupted inode contents [ 101.169254][ T6757] loop2: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 101.169412][ T6757] EXT4-fs error (device loop2): ext4_dirty_inode:6736: inode #16: comm syz.2.508: mark_inode_dirty error [ 101.169424][ T6757] loop2: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 101.169876][ T6757] EXT4-fs error (device loop2): ext4_do_update_inode:5801: inode #16: comm syz.2.508: corrupted inode contents [ 101.169898][ T6757] loop2: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 101.170052][ T6757] EXT4-fs error (device loop2): __ext4_ext_dirty:207: inode #16: comm syz.2.508: mark_inode_dirty error [ 101.170068][ T6757] loop2: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 101.171077][ T6757] EXT4-fs error (device loop2): ext4_do_update_inode:5801: inode #16: comm syz.2.508: corrupted inode contents [ 101.171098][ T6757] loop2: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 101.171273][ T6757] EXT4-fs error (device loop2) in ext4_orphan_del:304: Corrupt filesystem [ 101.171283][ T6757] loop2: lost filesystem error report for type 5 error -117 [ 101.171407][ T6757] EXT4-fs error (device loop2): ext4_do_update_inode:5801: inode #16: comm syz.2.508: corrupted inode contents [ 101.171418][ T6757] loop2: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 101.171860][ C1] EXT4-fs (loop2): error count since last fsck: 12 [ 101.171875][ C1] EXT4-fs (loop2): initial error at time 101: ext4_do_update_inode:5801: inode 3 [ 101.171895][ C1] EXT4-fs (loop2): last error at time 101: ext4_do_update_inode:5801: inode 16 [ 101.182377][ T6757] EXT4-fs error (device loop2): ext4_truncate:4721: inode #16: comm syz.2.508: mark_inode_dirty error [ 101.182615][ T6757] EXT4-fs error (device loop2) in ext4_process_orphan:346: Corrupt filesystem [ 101.182624][ T6757] loop2: lost filesystem error report for type 5 error -117 [ 101.187025][ T6757] EXT4-fs (loop2): 1 truncate cleaned up [ 101.187575][ T6757] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 101.193807][ T6757] EXT4-fs warning (device loop2): ext4_es_cache_extent:1082: inode #3: comm syz.2.508: ES cache extent failed: add [1,1,41,0x1] conflict with existing [1,-2,576460752303423487,0x18] [ 101.193807][ T6757] [ 101.242426][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 101.295862][ T6767] syzkaller0: entered promiscuous mode [ 101.295883][ T6767] syzkaller0: entered allmulticast mode [ 101.305618][ T6769] loop1: detected capacity change from 0 to 512 [ 101.379494][ T10] tipc: Node number set to 4071024169 [ 101.427300][ T6774] syzkaller0: entered promiscuous mode [ 101.427318][ T6774] syzkaller0: entered allmulticast mode [ 101.913774][ T6781] tipc: Cannot configure node identity twice [ 101.914916][ T6781] tipc: New replicast peer: 127.0.0.1 [ 101.915411][ T6781] tipc: Enabled bearer , priority 10 [ 102.288187][ T5799] IPVS: starting estimator thread 0... [ 102.325510][ T6795] netlink: 28 bytes leftover after parsing attributes in process `syz.0.519'. [ 102.402284][ T6791] IPVS: using max 59 ests per chain, 141600 per kthread [ 103.355084][ T4722] Bluetooth: hci2: command 0x0406 tx timeout [ 103.537324][ T6809] netlink: 28 bytes leftover after parsing attributes in process `syz.3.522'. [ 103.597638][ T6813] syzkaller0: entered promiscuous mode [ 103.597657][ T6813] syzkaller0: entered allmulticast mode [ 103.600987][ T6813] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 103.688989][ T4806] tipc: Node number set to 690478824 [ 103.725319][ T6823] loop2: detected capacity change from 0 to 128 [ 103.759332][ T6829] netlink: 28 bytes leftover after parsing attributes in process `syz.4.530'. [ 103.795790][ T6823] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 105.102036][ T6861] netlink: 28 bytes leftover after parsing attributes in process `syz.0.538'. [ 105.192121][ T6868] syzkaller0: entered promiscuous mode [ 105.192140][ T6868] syzkaller0: entered allmulticast mode [ 105.193352][ T6868] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 105.435876][ T4719] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 105.536123][ T6877] loop3: detected capacity change from 0 to 128 [ 105.563624][ T6877] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 105.605197][ T4713] Bluetooth: hci2: unexpected event for opcode 0x201c [ 105.656899][ T6882] syzkaller0: entered promiscuous mode [ 105.656918][ T6882] syzkaller0: entered allmulticast mode [ 106.002560][ T6896] netlink: 28 bytes leftover after parsing attributes in process `syz.4.550'. [ 106.777347][ T6912] loop1: detected capacity change from 0 to 128 [ 106.797022][ T6912] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 106.907085][ T4710] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 106.914477][ T6916] loop4: detected capacity change from 0 to 1024 [ 106.927840][ T6916] EXT4-fs: Ignoring removed oldalloc option [ 106.927857][ T6916] EXT4-fs: Ignoring removed orlov option [ 106.936323][ T6916] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 106.958078][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 106.986330][ T6920] loop3: detected capacity change from 0 to 1024 [ 106.987959][ T6920] EXT4-fs: quotafile must be on filesystem root [ 107.057670][ T6922] syzkaller0: entered promiscuous mode [ 107.057691][ T6922] syzkaller0: entered allmulticast mode [ 107.190650][ T6924] loop3: detected capacity change from 0 to 128 [ 107.224543][ C1] wlan0: beacon TX faster than countdown (channel/color switch) completion [ 107.353871][ T6924] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 107.358967][ T6923] EXT4-fs (loop3): shut down requested (1) [ 107.444077][ T6931] syzkaller0: entered promiscuous mode [ 107.444095][ T6931] syzkaller0: entered allmulticast mode [ 107.446629][ T6931] tipc: Enabled bearer , priority 0 [ 107.522344][ T6931] tipc: Resetting bearer [ 107.595977][ T6935] trusted_key: encrypted_key: keylen parameter is missing [ 108.041813][ T4710] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 108.041956][ T6930] tipc: Resetting bearer [ 108.121564][ T6930] tipc: Disabling bearer [ 108.156208][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 109.155565][ T6944] loop4: detected capacity change from 0 to 256 [ 110.242971][ T6959] loop3: detected capacity change from 0 to 128 [ 110.256911][ T6959] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 110.731268][ T6965] netlink: 28 bytes leftover after parsing attributes in process `syz.0.568'. [ 110.752924][ T4713] Bluetooth: hci2: unexpected event for opcode 0x201c [ 110.773902][ T6960] syzkaller0: entered promiscuous mode [ 110.773924][ T6960] syzkaller0: entered allmulticast mode [ 110.839131][ T6960] 0: reclassify loop, rule prio 0, protocol 700 [ 112.208172][ T4710] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 112.503008][ T6993] netlink: 28 bytes leftover after parsing attributes in process `syz.3.575'. [ 112.505813][ T6993] netlink: 28 bytes leftover after parsing attributes in process `syz.3.575'. [ 113.613041][ T7028] netlink: 28 bytes leftover after parsing attributes in process `syz.4.584'. [ 113.968189][ T7024] geneve2: entered promiscuous mode [ 113.984113][ T40] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 44137 - 0 [ 113.984553][ T40] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 44137 - 0 [ 113.984582][ T40] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 44137 - 0 [ 113.984602][ T40] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 44137 - 0 [ 114.010770][ T7034] loop1: detected capacity change from 0 to 128 [ 114.019432][ T7034] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 114.950745][ T7055] loop4: detected capacity change from 0 to 1024 [ 114.955302][ T7055] EXT4-fs: Ignoring removed oldalloc option [ 114.955314][ T7055] EXT4-fs: Ignoring removed orlov option [ 114.968679][ T7055] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 114.986699][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 115.017851][ T7061] loop4: detected capacity change from 0 to 256 [ 115.535773][ T7074] syzkaller0: entered promiscuous mode [ 115.535796][ T7074] syzkaller0: entered allmulticast mode [ 115.869628][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 115.895577][ T7080] netlink: 28 bytes leftover after parsing attributes in process `syz.3.598'. [ 115.920442][ T7082] netlink: 36 bytes leftover after parsing attributes in process `syz.1.596'. [ 115.958598][ T7086] syzkaller0: entered promiscuous mode [ 115.958614][ T7086] syzkaller0: entered allmulticast mode [ 115.960353][ T7086] tipc: Enabled bearer , priority 0 [ 115.963167][ T7086] tipc: Resetting bearer [ 115.976857][ T7085] tipc: Resetting bearer [ 116.002701][ T7089] loop3: detected capacity change from 0 to 512 [ 116.015351][ T7089] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 116.087791][ T7090] Console: switching to colour dummy device 80x25 [ 116.104287][ T7090] Console: switching to colour frame buffer device 128x48 [ 116.983754][ T7089] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c028, mo2=0082] [ 116.983806][ T7089] System zones: 1-12 [ 116.984300][ T7085] tipc: Disabling bearer [ 116.991939][ T7089] EXT4-fs (loop3): 1 truncate cleaned up [ 116.992393][ T7089] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 116.996376][ T7089] EXT4-fs error (device loop3): ext4_find_dest_de:2052: inode #2: block 13: comm syz.3.601: bad entry in directory: directory entry overrun - offset=60, inode=3758096399, rec_len=172556, size=1024 fake=0 [ 117.004998][ T7089] EXT4-fs (loop3): Remounting filesystem read-only [ 117.213686][ T7099] loop4: detected capacity change from 0 to 1024 [ 117.215699][ T7099] EXT4-fs: Ignoring removed oldalloc option [ 117.215711][ T7099] EXT4-fs: Ignoring removed orlov option [ 118.217293][ T7099] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 118.554506][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 118.571197][ T4710] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 118.634823][ T7117] loop3: detected capacity change from 0 to 256 [ 118.636306][ T7115] loop1: detected capacity change from 0 to 128 [ 118.705516][ T7115] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 118.740593][ T7122] loop2: detected capacity change from 0 to 2048 [ 118.744996][ T7122] EXT4-fs: Ignoring removed orlov option [ 118.745010][ T7122] EXT4-fs: Ignoring removed i_version option [ 118.796757][ T7122] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 119.566894][ T7139] syzkaller0: entered promiscuous mode [ 119.566915][ T7139] syzkaller0: entered allmulticast mode [ 119.567942][ T7121] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.713586][ T7147] overlayfs: failed to clone upperpath [ 120.001918][ T7150] netlink: 28 bytes leftover after parsing attributes in process `syz.0.617'. [ 120.539963][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 121.494768][ T7187] netlink: 1708 bytes leftover after parsing attributes in process `syz.3.626'. [ 121.560337][ T7192] loop4: detected capacity change from 0 to 128 [ 121.566789][ T7192] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 121.578221][ T4713] Bluetooth: hci0: unexpected event for opcode 0x201c [ 121.772105][ T7206] netlink: 28 bytes leftover after parsing attributes in process `syz.2.630'. [ 122.040526][ T7211] @0Ù: renamed from dummy0 (while UP) [ 122.286737][ T7213] syzkaller0: entered promiscuous mode [ 122.286757][ T7213] syzkaller0: entered allmulticast mode [ 122.289878][ T7213] tipc: Enabled bearer , priority 0 [ 122.302671][ T7213] tipc: Resetting bearer [ 122.307438][ T7212] tipc: Resetting bearer [ 122.317331][ T7212] tipc: Disabling bearer [ 123.092241][ T4708] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 123.295972][ T7251] syzkaller0: entered promiscuous mode [ 123.295997][ T7251] syzkaller0: entered allmulticast mode [ 123.376705][ T7255] ip_tables: iptables: counters copy to user failed while replacing table [ 123.381270][ T4713] Bluetooth: hci2: unexpected event for opcode 0x0428 [ 123.864389][ T7263] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 123.864730][ T7263] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 124.184430][ T7269] syzkaller0: entered promiscuous mode [ 124.184451][ T7269] syzkaller0: entered allmulticast mode [ 124.186365][ T7269] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 124.317278][ T7276] syzkaller0: entered promiscuous mode [ 124.317300][ T7276] syzkaller0: entered allmulticast mode [ 124.827199][ T7286] loop3: detected capacity change from 0 to 128 [ 124.835548][ T7287] loop1: detected capacity change from 0 to 128 [ 124.847292][ T7287] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 124.848120][ T7286] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 124.865729][ T4713] Bluetooth: hci2: unexpected event for opcode 0x201c [ 125.172916][ T7299] loop4: detected capacity change from 0 to 256 [ 125.803582][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 125.908166][ T7322] syzkaller0: entered promiscuous mode [ 125.908185][ T7322] syzkaller0: entered allmulticast mode [ 125.909249][ T7322] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 125.933315][ T1596] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.933347][ T1596] ieee802154 phy1 wpan1: encryption failed: -22 [ 126.057755][ T7324] loop1: detected capacity change from 0 to 128 [ 126.173369][ T12] IPVS: starting estimator thread 0... [ 126.182156][ T7324] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 126.272281][ T7325] IPVS: using max 61 ests per chain, 146400 per kthread [ 126.348023][ T4710] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 126.700992][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 126.806653][ T7333] netlink: 28 bytes leftover after parsing attributes in process `syz.0.670'. [ 126.807741][ T7333] netlink: 28 bytes leftover after parsing attributes in process `syz.0.670'. [ 126.823858][ T7336] loop1: detected capacity change from 0 to 512 [ 126.840361][ T7336] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 126.905459][ T7336] EXT4-fs (loop1): 1 truncate cleaned up [ 126.905935][ T7336] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 126.937443][ T7343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.663'. [ 126.938583][ T7343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.663'. [ 128.004921][ T7350] loop3: detected capacity change from 0 to 512 [ 128.073081][ T7350] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 128.073101][ T7350] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e042e018, mo2=0002] [ 128.073130][ T7350] System zones: 0-1, 15-15, 18-18, 34-34 [ 128.073245][ T7350] EXT4-fs (loop3): orphan cleanup on readonly fs [ 128.073275][ T7350] Quota error (device loop3): v2_read_header: Failed header read: expected=8 got=0 [ 128.073321][ T7350] EXT4-fs warning (device loop3): ext4_enable_quotas:7304: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 128.073332][ T7350] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 128.073563][ T7350] EXT4-fs error (device loop3): ext4_orphan_get:1429: comm syz.3.664: bad orphan inode 16 [ 128.073582][ T7350] loop3: lost filesystem error report for type 5 error -117 [ 128.073783][ T7350] ext4_test_bit(bit=15, block=18) = 1 [ 128.073791][ T7350] is_bad_inode(inode)=0 [ 128.073794][ T7350] NEXT_ORPHAN(inode)=0 [ 128.073798][ T7350] max_ino=32 [ 128.073802][ T7350] i_nlink=2 [ 128.074307][ T7350] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 128.077211][ T7358] syzkaller0: entered promiscuous mode [ 128.077231][ T7358] syzkaller0: entered allmulticast mode [ 128.079131][ T7358] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 128.157350][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 128.449039][ T7361] loop4: detected capacity change from 0 to 512 [ 128.458887][ T7361] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 128.459614][ T7361] EXT4-fs (loop4): Remounting filesystem read-only [ 128.459758][ T7361] EXT4-fs (loop4): 1 truncate cleaned up [ 128.460215][ T7361] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 128.491539][ T7368] netlink: 28 bytes leftover after parsing attributes in process `syz.1.668'. [ 128.600130][ T7375] loop1: detected capacity change from 0 to 128 [ 128.609215][ T7375] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 128.998663][ T7361] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.013935][ T4710] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.127010][ T7385] lo speed is unknown, defaulting to 1000 [ 129.127048][ T7385] lo speed is unknown, defaulting to 1000 [ 129.128126][ T7385] lo speed is unknown, defaulting to 1000 [ 129.129924][ T7385] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 129.442755][ T7385] lo speed is unknown, defaulting to 1000 [ 129.443188][ T7385] lo speed is unknown, defaulting to 1000 [ 129.443544][ T7385] lo speed is unknown, defaulting to 1000 [ 129.443854][ T7385] lo speed is unknown, defaulting to 1000 [ 129.444187][ T7385] lo speed is unknown, defaulting to 1000 [ 129.444535][ T7385] lo speed is unknown, defaulting to 1000 [ 129.938621][ T7400] loop4: detected capacity change from 0 to 512 [ 129.943025][ T7400] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 129.943067][ T7400] System zones: 1-12 [ 129.943375][ T7400] EXT4-fs error (device loop4): ext4_xattr_inode_iget:437: inode #12: comm syz.4.677: missing EA_INODE flag [ 129.943388][ T7400] fserror_report: 1 callbacks suppressed [ 129.943393][ T7400] loop4: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 129.943505][ T7400] EXT4-fs error (device loop4): ext4_xattr_inode_iget:442: comm syz.4.677: error while reading EA inode 12 err=-117 [ 129.943523][ T7400] loop4: lost filesystem error report for type 5 error -117 [ 129.943634][ T7400] EXT4-fs (loop4): 1 orphan inode deleted [ 129.944170][ T7400] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 130.057001][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 130.888185][ T7406] tipc: Enabling of bearer rejected, failed to enable media [ 131.046919][ T7418] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 131.070886][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 131.124056][ T7424] tipc: Enabling of bearer rejected, failed to enable media [ 131.124487][ T7424] syzkaller0: entered promiscuous mode [ 131.124499][ T7424] syzkaller0: entered allmulticast mode [ 131.125956][ T7424] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 131.318148][ T7426] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 131.380102][ T7434] netlink: 40 bytes leftover after parsing attributes in process `syz.3.686'. [ 131.944796][ T7443] loop4: detected capacity change from 0 to 512 [ 131.954809][ T7443] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 132.323326][ T7449] netlink: 12 bytes leftover after parsing attributes in process `syz.0.688'. [ 132.367350][ T7449] netlink: 28 bytes leftover after parsing attributes in process `syz.0.688'. [ 132.427223][ T7459] tipc: Enabling of bearer rejected, failed to enable media [ 132.427608][ T7459] syzkaller0: entered promiscuous mode [ 132.427624][ T7459] syzkaller0: entered allmulticast mode [ 132.429370][ T7459] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 132.752609][ T7465] Bluetooth: MGMT ver 1.23 [ 132.821200][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.941485][ T7498] netlink: 12 bytes leftover after parsing attributes in process `syz.1.704'. [ 133.956717][ T7498] netlink: 28 bytes leftover after parsing attributes in process `syz.1.704'. [ 134.025469][ T7502] tipc: Enabling of bearer rejected, failed to enable media [ 134.025788][ T7502] syzkaller0: entered promiscuous mode [ 134.025800][ T7502] syzkaller0: entered allmulticast mode [ 134.027032][ T7502] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 134.141909][ T7508] loop1: detected capacity change from 0 to 512 [ 134.142992][ T7508] EXT4-fs (loop1): Test dummy encryption mode enabled [ 134.143005][ T7508] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 134.148986][ T7508] EXT4-fs error (device loop1): ext4_orphan_get:1429: comm syz.1.706: bad orphan inode 131083 [ 134.149002][ T7508] loop1: lost filesystem error report for type 5 error -117 [ 134.149718][ T7508] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 135.219646][ T7511] loop4: detected capacity change from 0 to 8 [ 136.263286][ T4709] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.299808][ T7540] netlink: 12 bytes leftover after parsing attributes in process `syz.4.717'. [ 136.385702][ T7542] netlink: 28 bytes leftover after parsing attributes in process `syz.4.717'. [ 136.506724][ T7549] loop1: detected capacity change from 0 to 128 [ 136.529812][ T7549] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 136.650849][ T7558] syz.3.720 uses obsolete (PF_INET,SOCK_PACKET) [ 136.665619][ T7558] FAULT_INJECTION: forcing a failure. [ 136.665619][ T7558] name failslab, interval 1, probability 0, space 0, times 0 [ 136.665647][ T7558] CPU: 0 UID: 0 PID: 7558 Comm: syz.3.720 Not tainted syzkaller #0 PREEMPT [ 136.665658][ T7558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 136.665664][ T7558] Call trace: [ 136.665667][ T7558] show_stack+0x2c/0x3c (C) [ 136.665688][ T7558] __dump_stack+0x30/0x40 [ 136.665701][ T7558] dump_stack_lvl+0xd8/0x12c [ 136.665712][ T7558] dump_stack+0x1c/0x28 [ 136.665723][ T7558] should_fail_ex+0x418/0x58c [ 136.665737][ T7558] should_failslab+0xc4/0x120 [ 136.665750][ T7558] __kmalloc_cache_noprof+0x94/0x5fc [ 136.665760][ T7558] tipc_nametbl_insert_publ+0x4f8/0xe44 [ 136.665774][ T7558] tipc_nametbl_publish+0x10c/0x250 [ 136.665786][ T7558] tipc_sk_publish+0x17c/0x380 [ 136.665796][ T7558] tipc_sk_join+0x2d8/0x508 [ 136.665807][ T7558] tipc_setsockopt+0x570/0x7c0 [ 136.665818][ T7558] do_sock_setsockopt+0x1f0/0x330 [ 136.665831][ T7558] __sys_setsockopt+0x104/0x170 [ 136.665841][ T7558] __arm64_sys_setsockopt+0xc8/0xe4 [ 136.665853][ T7558] invoke_syscall+0x98/0x244 [ 136.665865][ T7558] el0_svc_common+0xec/0x23c [ 136.665877][ T7558] do_el0_svc+0x4c/0x5c [ 136.665888][ T7558] el0_svc+0x60/0x1d8 [ 136.665901][ T7558] el0t_64_sync_handler+0x44/0x104 [ 136.665914][ T7558] el0t_64_sync+0x198/0x19c [ 136.665924][ T7558] tipc: Failed to bind to 30739,3,3 [ 136.667413][ T7558] ipvlan0: entered promiscuous mode [ 136.667446][ T7558] ipvlan0: entered allmulticast mode [ 136.667453][ T7558] v: entered allmulticast mode [ 136.667860][ T7558] FAULT_INJECTION: forcing a failure. [ 136.667860][ T7558] name failslab, interval 1, probability 0, space 0, times 0 [ 136.667871][ T7558] CPU: 0 UID: 0 PID: 7558 Comm: syz.3.720 Not tainted syzkaller #0 PREEMPT [ 136.667881][ T7558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 136.667886][ T7558] Call trace: [ 136.667888][ T7558] show_stack+0x2c/0x3c (C) [ 136.667903][ T7558] __dump_stack+0x30/0x40 [ 136.667916][ T7558] dump_stack_lvl+0xd8/0x12c [ 136.667928][ T7558] dump_stack+0x1c/0x28 [ 136.667939][ T7558] should_fail_ex+0x418/0x58c [ 136.667952][ T7558] should_failslab+0xc4/0x120 [ 136.667965][ T7558] __kmalloc_noprof+0x108/0x6c8 [ 136.667974][ T7558] fib_create_info+0xca0/0x2184 [ 136.667984][ T7558] fib_table_insert+0xa4/0x12bc [ 136.667993][ T7558] fib_magic+0x26c/0x344 [ 136.668001][ T7558] fib_add_ifaddr+0x330/0x500 [ 136.668009][ T7558] fib_netdev_event+0x35c/0x49c [ 136.668017][ T7558] notifier_call_chain+0x1a4/0x4cc [ 136.668029][ T7558] raw_notifier_call_chain+0x3c/0x50 [ 136.668041][ T7558] call_netdevice_notifiers_info+0xb8/0x120 [ 136.668050][ T7558] __dev_notify_flags+0x288/0x438 [ 136.668062][ T7558] netif_change_flags+0xd0/0x15c [ 136.668075][ T7558] dev_change_flags+0x10c/0x204 [ 136.668084][ T7558] devinet_ioctl+0x87c/0x1788 [ 136.668093][ T7558] inet_ioctl+0x304/0x42c [ 136.668103][ T7558] packet_ioctl+0x1c8/0x404 [ 136.668113][ T7558] sock_do_ioctl+0x100/0x254 [ 136.668126][ T7558] sock_ioctl+0x55c/0x7ec [ 136.668138][ T7558] __arm64_sys_ioctl+0x154/0x1cc [ 136.668146][ T7558] invoke_syscall+0x98/0x244 [ 136.668158][ T7558] el0_svc_common+0xec/0x23c [ 136.668170][ T7558] do_el0_svc+0x4c/0x5c [ 136.668181][ T7558] el0_svc+0x60/0x1d8 [ 136.668194][ T7558] el0t_64_sync_handler+0x44/0x104 [ 136.668207][ T7558] el0t_64_sync+0x198/0x19c [ 137.816003][ T7567] tipc: Enabling of bearer rejected, failed to enable media [ 137.822172][ T7567] syzkaller0: entered promiscuous mode [ 137.822187][ T7567] syzkaller0: entered allmulticast mode [ 137.823721][ T7567] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 138.055294][ T4709] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 138.109273][ T7577] FAULT_INJECTION: forcing a failure. [ 138.109273][ T7577] name failslab, interval 1, probability 0, space 0, times 0 [ 138.109306][ T7577] CPU: 0 UID: 0 PID: 7577 Comm: syz.3.727 Not tainted syzkaller #0 PREEMPT [ 138.109318][ T7577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 138.109326][ T7577] Call trace: [ 138.109329][ T7577] show_stack+0x2c/0x3c (C) [ 138.109352][ T7577] __dump_stack+0x30/0x40 [ 138.109365][ T7577] dump_stack_lvl+0xd8/0x12c [ 138.109377][ T7577] dump_stack+0x1c/0x28 [ 138.109388][ T7577] should_fail_ex+0x418/0x58c [ 138.109403][ T7577] should_failslab+0xc4/0x120 [ 138.109416][ T7577] __kvmalloc_node_noprof+0x160/0x7fc [ 138.109427][ T7577] sbitmap_init_node+0x360/0x564 [ 138.109439][ T7577] sbitmap_queue_init_node+0x54/0x380 [ 138.109452][ T7577] blk_mq_init_tags+0x138/0x284 [ 138.109464][ T7577] blk_mq_alloc_map_and_rqs+0xd8/0x810 [ 138.109483][ T7577] blk_mq_alloc_sched_tags+0x140/0x308 [ 138.109495][ T7577] blk_mq_alloc_sched_res+0x94/0x1bc [ 138.109506][ T7577] elevator_change+0x124/0x35c [ 138.109518][ T7577] elv_iosched_store+0x2a8/0x3bc [ 138.109529][ T7577] queue_attr_store+0x1c0/0x24c [ 138.109538][ T7577] sysfs_kf_write+0xe0/0x108 [ 138.109551][ T7577] kernfs_fop_write_iter+0x260/0x3b8 [ 138.109562][ T7577] vfs_write+0x51c/0xa0c [ 138.109570][ T7577] ksys_write+0x12c/0x228 [ 138.109578][ T7577] __arm64_sys_write+0x84/0x98 [ 138.109586][ T7577] invoke_syscall+0x98/0x244 [ 138.109598][ T7577] el0_svc_common+0xec/0x23c [ 138.109613][ T7577] do_el0_svc+0x4c/0x5c [ 138.109624][ T7577] el0_svc+0x60/0x1d8 [ 138.109638][ T7577] el0t_64_sync_handler+0x44/0x104 [ 138.109651][ T7577] el0t_64_sync+0x198/0x19c [ 138.950774][ T7592] loop4: detected capacity change from 0 to 512 [ 139.016629][ T7591] netlink: 12 bytes leftover after parsing attributes in process `syz.3.731'. [ 139.026757][ T7591] netlink: 28 bytes leftover after parsing attributes in process `syz.3.731'. [ 139.413574][ T7592] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 139.845847][ T7610] lo speed is unknown, defaulting to 1000 [ 139.868602][ T4708] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 139.932920][ T7608] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 139.932996][ T7608] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 139.985092][ T7608] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 139.985163][ T7608] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 139.990147][ T7608] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 139.991640][ T7608] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 139.992309][ T7608] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 140.059832][ T7608] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 140.059901][ T7608] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 140.061437][ T7608] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 140.065539][ T7608] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 140.065598][ T7608] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 140.070555][ T7608] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 140.308681][ T7632] ================================================================== [ 140.308693][ T7632] BUG: KASAN: slab-use-after-free in soft_cursor+0x378/0x6bc [ 140.308711][ T7632] Read of size 96 at addr ffff0000cb820dc0 by task syz.1.740/7632 [ 140.308719][ T7632] [ 140.308724][ T7632] CPU: 1 UID: 0 PID: 7632 Comm: syz.1.740 Not tainted syzkaller #0 PREEMPT [ 140.308734][ T7632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 140.308739][ T7632] Call trace: [ 140.308742][ T7632] show_stack+0x2c/0x3c (C) [ 140.308756][ T7632] __dump_stack+0x30/0x40 [ 140.308767][ T7632] dump_stack_lvl+0xd8/0x12c [ 140.308779][ T7632] print_address_description+0xb0/0x238 [ 140.308788][ T7632] print_report+0x68/0x84 [ 140.308795][ T7632] kasan_report+0x8c/0xc4 [ 140.308805][ T7632] kasan_check_range+0x17c/0x1ac [ 140.308815][ T7632] __asan_memcpy+0x3c/0x84 [ 140.308825][ T7632] soft_cursor+0x378/0x6bc [ 140.308834][ T7632] ud_cursor+0xb40/0x1234 [ 140.308843][ T7632] fbcon_cursor+0x344/0x498 [ 140.308851][ T7632] hide_cursor+0xdc/0x2d0 [ 140.308861][ T7632] redraw_screen+0x200/0x51c [ 140.308869][ T7632] vc_do_resize+0x884/0xbbc [ 140.308878][ T7632] __vc_resize+0x60/0x74 [ 140.308886][ T7632] fbcon_do_set_font+0x3d8/0x734 [ 140.308895][ T7632] fbcon_set_font+0x4f0/0x6ac [ 140.308904][ T7632] con_font_op+0x954/0xc4c [ 140.308913][ T7632] vt_ioctl+0x1664/0x1d4c [ 140.308924][ T7632] tty_ioctl+0x828/0xcb8 [ 140.308932][ T7632] __arm64_sys_ioctl+0x154/0x1cc [ 140.308941][ T7632] invoke_syscall+0x98/0x244 [ 140.308953][ T7632] el0_svc_common+0xec/0x23c [ 140.308964][ T7632] do_el0_svc+0x4c/0x5c [ 140.308975][ T7632] el0_svc+0x60/0x1d8 [ 140.308989][ T7632] el0t_64_sync_handler+0x44/0x104 [ 140.309001][ T7632] el0t_64_sync+0x198/0x19c [ 140.309010][ T7632] [ 140.309012][ T7632] Allocated by task 12: [ 140.309017][ T7632] kasan_save_track+0x40/0x78 [ 140.309025][ T7632] kasan_save_alloc_info+0x40/0x50 [ 140.309034][ T7632] __kasan_kmalloc+0x9c/0xb4 [ 140.309041][ T7632] __kmalloc_node_track_caller_noprof+0x440/0x6e0 [ 140.309049][ T7632] kmalloc_reserve+0x118/0x214 [ 140.309060][ T7632] __alloc_skb+0x230/0x610 [ 140.309068][ T7632] nsim_dev_trap_report_work+0x204/0x9cc [ 140.309077][ T7632] process_scheduled_works+0x91c/0x1250 [ 140.309086][ T7632] worker_thread+0x798/0xbd0 [ 140.309095][ T7632] kthread+0x304/0x3d4 [ 140.309102][ T7632] ret_from_fork+0x10/0x20 [ 140.309108][ T7632] [ 140.309109][ T7632] Freed by task 12: [ 140.309112][ T7632] kasan_save_track+0x40/0x78 [ 140.309120][ T7632] kasan_save_free_info+0x54/0x6c [ 140.309129][ T7632] __kasan_slab_free+0x74/0xa4 [ 140.309136][ T7632] kfree+0x188/0x658 [ 140.309141][ T7632] skb_free_head+0x70/0x120 [ 140.309151][ T7632] skb_release_data+0x6d0/0x890 [ 140.309160][ T7632] skb_release_all+0x60/0x7c [ 140.309169][ T7632] consume_skb+0x80/0xf4 [ 140.309178][ T7632] nsim_dev_trap_report_work+0x678/0x9cc [ 140.309186][ T7632] process_scheduled_works+0x91c/0x1250 [ 140.309194][ T7632] worker_thread+0x798/0xbd0 [ 140.309203][ T7632] kthread+0x304/0x3d4 [ 140.309210][ T7632] ret_from_fork+0x10/0x20 [ 140.309216][ T7632] [ 140.309217][ T7632] The buggy address belongs to the object at ffff0000cb820000 [ 140.309217][ T7632] which belongs to the cache kmalloc-4k of size 4096 [ 140.309224][ T7632] The buggy address is located 3520 bytes inside of [ 140.309224][ T7632] freed 4096-byte region [ffff0000cb820000, ffff0000cb821000) [ 140.309232][ T7632] [ 140.309234][ T7632] The buggy address belongs to the physical page: [ 140.309238][ T7632] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b820 [ 140.309246][ T7632] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 140.309252][ T7632] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 140.309260][ T7632] page_type: f5(slab) [ 140.309267][ T7632] raw: 05ffc00000000040 ffff0000c0002140 dead000000000100 dead000000000122 [ 140.309274][ T7632] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 140.309282][ T7632] head: 05ffc00000000040 ffff0000c0002140 dead000000000100 dead000000000122 [ 140.309288][ T7632] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 140.309295][ T7632] head: 05ffc00000000003 fffffdffc32e0801 00000000ffffffff 00000000ffffffff [ 140.309302][ T7632] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 140.309306][ T7632] page dumped because: kasan: bad access detected [ 140.309309][ T7632] [ 140.309311][ T7632] Memory state around the buggy address: [ 140.309315][ T7632] ffff0000cb820c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.309320][ T7632] ffff0000cb820d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.309325][ T7632] >ffff0000cb820d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.309329][ T7632] ^ [ 140.309334][ T7632] ffff0000cb820e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.309339][ T7632] ffff0000cb820e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.309343][ T7632] ================================================================== [ 140.309360][ T7632] Disabling lock debugging due to kernel taint [ 141.611794][ T4713] Bluetooth: hci0: command 0x2016 tx timeout [ 142.011771][ T4722] Bluetooth: hci1: command 0x0c1a tx timeout [ 142.011826][ T4713] Bluetooth: hci2: command 0x0406 tx timeout [ 142.101762][ T4713] Bluetooth: hci4: command 0x0c1a tx timeout [ 142.101797][ T4722] Bluetooth: hci3: command 0x0c1a tx timeout [ 143.691700][ T4722] Bluetooth: hci0: command 0x2016 tx timeout [ 144.091765][ T4722] Bluetooth: hci2: command 0x0406 tx timeout [ 144.091801][ T4722] Bluetooth: hci1: command 0x0c1a tx timeout [ 144.171849][ T4722] Bluetooth: hci4: command 0x0c1a tx timeout [ 144.171860][ T4713] Bluetooth: hci3: command 0x0c1a tx timeout [ 146.171700][ T4722] Bluetooth: hci1: command 0x0c1a tx timeout [ 146.251728][ T4722] Bluetooth: hci4: command 0x0c1a tx timeout [ 146.251756][ T4722] Bluetooth: hci3: command 0x0c1a tx timeout