last executing test programs: 1m47.42464551s ago: executing program 3 (id=444): r0 = accept$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r0, 0x0, &(0x7f0000000440)) write$binfmt_format(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x7, 0x5, 0x8, 0xc1, r1}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = syz_open_procfs(0x0, &(0x7f0000000540)='net/netlink\x00') pread64(r6, &(0x7f000001a240)=""/102399, 0x18fff, 0x100008) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1, r2}, 0x38) 1m46.264641558s ago: executing program 3 (id=445): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000100)=ANY=[], 0x8) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r1, &(0x7f0000000140)={0x24, @short={0x2, 0x1, 0xffff}}, 0x14) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r1, 0x8983, &(0x7f0000000000)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="6c0100001000130700000000fcdbdf256401010000000000000000000000000020010000000000000000000000000001000000004e2100020200000033000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000000fe32000000fe80000000000000000000000000001f00000000000000000000000000000000fdffffffffffffffe9e000000000000001000000000000000900000000000000ffffff7f0000000043050000000000000400000000000000ffffffffffffff7ffcffffffffffffffe2eb0000000000000200000000000000000000002cbd7000003500000200040050000000000000001c00040007004e244e200000ac14142e00000000000000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060"], 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x40400c4) sendto$inet6(r0, &(0x7f00000004c0)="1e", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x2, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c) listen(r0, 0x100101) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCXONC(r3, 0x560c, 0x3) ioctl$BTRFS_IOC_GET_FEATURES(r0, 0x80189439, &(0x7f0000000040)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000180)=0x200) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x100, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r5, 0x4b44, 0x10000000000004) ioctl$SNDCTL_MIDI_PRETIME(r4, 0xc0046d00, &(0x7f0000000200)=0x7) accept4(r0, 0x0, 0x0, 0x80800) 1m43.574119731s ago: executing program 3 (id=446): socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0xa, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') setsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)=0x2, 0x4) sendmsg$802154_dgram(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f0000000500)={0x24, @short}, 0x14, &(0x7f0000001880)={0x0}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1m40.597880811s ago: executing program 3 (id=450): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x4008080}, 0x8000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='my_configfs/nullb\x00', 0x10000, 0x0) unshare(0x2c020500) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(r1, &(0x7f0000000180)='nullb1\x00', 0x1ff) unlinkat(r1, &(0x7f0000000680)='nullb1\x00', 0x200) 1m39.506974367s ago: executing program 3 (id=452): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mprotect(&(0x7f00000f8000/0x3000)=nil, 0x3000, 0x1) ptrace$setsig(0x4203, r0, 0xe, 0x0) r2 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x8) openat$cgroup(r3, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000004000)={0x2020}, 0x2020) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) 1m38.854770692s ago: executing program 3 (id=456): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x480, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000140)=@newtfilter={0x90, 0x2c, 0xd27, 0x30bd25, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xfff2, 0xf}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x92, 0xffffffffffffffff, 0x7, 0xffeffffc}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x2}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x90}}, 0x4c800) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f0000000500)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3f}, 0x80, &(0x7f0000000200)=[{&(0x7f00000002c0)='\r', 0x1}], 0x1}, 0x8004) 1m23.26016924s ago: executing program 32 (id=456): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x480, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000140)=@newtfilter={0x90, 0x2c, 0xd27, 0x30bd25, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xfff2, 0xf}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x92, 0xffffffffffffffff, 0x7, 0xffeffffc}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x2}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x90}}, 0x4c800) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f0000000500)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3f}, 0x80, &(0x7f0000000200)=[{&(0x7f00000002c0)='\r', 0x1}], 0x1}, 0x8004) 13.813045485s ago: executing program 1 (id=599): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0x1}, 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x8100, 0xd, 0x0, &(0x7f00000002c0)="c8e8a1aee95e10e19e00399da2", 0x0, 0xadf0, 0x21, 0x0, 0x0, 0x0, 0x0}, 0x4c) socket$rxrpc(0x21, 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='./config\x00') write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0xa4a1\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x2, 0x0) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="0100000000000000000040f7eca4d7"], 0x40) write(r2, 0x0, 0x0) symlinkat(&(0x7f0000000340)='usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000380)='usb_gadget/g1/configs/c.1/ecm.usb0\x00') nanosleep(&(0x7f0000000440)={0x0, 0x1dcd6500}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000004c0)={'syzkaller1\x00', 0x1}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) bind$packet(r5, &(0x7f0000000600)={0x11, 0x300, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x14) write$tun(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYBLOB="028000400500ff077c0567c42d2f08fe1100fe8000000000000000000000000000bbfe8000000000000000000000000000bb3b000000000000000010010700000000ff020000000000000000000000000001fc00000000000000000000000000000120010000000000000000000000000000ff010000000000000000000000000001fe880000000000000000000000000001ff01000000000000000000000000000120010000000000000000000000000002ff020000000000000000000000000001e60a04057a600300fe800000000000000000000000000033fe880000000000000000000000000001fe8000000000000000000000000000bb00000000000000000000ffffac1e0001ff0200000000000000000000000000014e204e220816907804000000070000000000000000000000fff7941273a459432a58a0d2b151f30c7c8cb61f5f51a3fd2cd4921dbbc417822ffb3af5e4a45de8fee649ade182fa998209ea938d8b727ce43c9cdf7a9eb21b2f3da531639964d91f902e52099bfc3a6eac9bf15c40bc57ee2227546a3d76272cbdda730b3b87db5ebec307597ce8bdcb2690fe95bfa8d2a4851488a079c62827caa90777a8e2aa9a356d160c7e66fadb9bd0622d27ed3338ab43cbc6f0c145a82d9bd5738d39f91080eec0cd496aa93078edf555d34a0584314e9a9edffa3bd105fb0e6a3d10a6e2add87cedf9b6004f03b6c4af76888724bd273ac64098ff22530a738b7a0f720014913fb6c028dc63db3ff1e0e4738db68a73f0456d14d8909e409cfeb9413563b69f3e20581be59434c7e0c906cd9ad51bc0144dee8a24560550c155976520d3842c7b9c5fd6e76668a3246faea544c224bec826a86b60edecf6382134dad0d8c705d09d4e300ed066598caa01becfa8143a7fc89ca8c2866b78ec8884c54ab4ccf23ed7d1507483c2eba2becca084e27720c4b75a40d2aad14bfbcf18ef7b70b4a696ec0c4a9bae61d766cb02f4ecd52f04acba3313dbbd4bb165cd6401ccc4c34da25d5ddb99b0c77cce00be74a2bd3dafe6ab2f988ea390b8a96582f0990d3583450c3599175597faf22cb9c01b4481065d1ec92d74719be2c15602647f6db75045dc65320a706b2d44733dff5446f60e1821019b9475f94293a78e8ee0473fcf90391cac6092680a804f3226ed94c95e8d8a8d67d4ab68f830c4c49b74c9cfc73af87c888cbf1adda97cc6b753fc9ea784dcf3f1ee693b6e6bbeabec379683ddda06f2810d48f88160579564baea90bd29b2f73e2f056578cc300345e82748e6ecd0bba9244f3c8ad83d2b81f21f46e9ae02ee537f6fbdb8cf461bb59f6b2b240246b1f4c2dc9464d9864194d3b80c9420359e277ad953933aff30db147c03810d47b76d8188593d0ea689bcefeeec17b8e0d38407568b3a8809879ad2618145096293ed63bb338e4d680d54941e21bd23bfd35dc1e1ff9e719a0f635a50b19813dc85c3080f41fd0fe943369c2ab08317329daadb370c41a1d2ad370fd435b7dc618baacb0c62ee9766f293121296da6d7034587d658e7675be60d8099b6c464b86408db6d7622ca8a74c4bbf31f10a8d7b907baae0c98e69238b39b7688dde5d4405d055c9a82c4f4f3139a3c1097323471acb11ac88957f1999cac77089cfde82cdddd364cd4542d3fe9e1a04e75c33da5be0ff2a9ffedf70a24c54774cc2850dd8d6bae812e2287deb6077c329f44babb112e1afd2cc850e61126d9bbddd316f65adf8e133e03d3cbdff8328b68249aaef7af4ed0145c5926cd370bbe12bee8a304707c9422df855a90c7c498146fc63a2659735072e5e665889c449c5b8a9300a6e0b22b8656a748ffb3989555e5346ef608154c1a7ca74ea10fb5f7852e0750e365ba2b4da42604650f54d831b620cfa204d5bc50b541a568ba04795dce6a30a4bae146080a22f7e7b1c8ba2ca6414b4b5ff52b92483aa0bcbb8778237e6f2ae9aec160d0e02a723df80ae76a5ff5edf99454e0c3bd3ddde1281e2909aad40f47b5e79b709e5b140875e91cf16596be9a2893c5dfd0a066f7368eacc2254af63e89f1a08497aa627f649f21ed09e79ffc73ff5577da0d46a22f6fba104fb3d2cbf5bda3032241b731bfcfe58e68f29ae95b35e5900104181a627cb0ea253045314c93177d983f1135ef2b7a5902dddddb0b6c5821174140a4877a86e848dad5865412b99e0b59ffb2b41d1dde6ed485885485fb6f3659a4fa4773c0b62a50ab471e9db91d04d5430daffe8773032b4f9158de6dd3de4c9fa18b177928c7ef5f95ddb80ea1374616febaac204b99cb900cb2cadb3d11bb193d8ccce23b5a7e9d8bdc5404fc90ec7e0a8f669fa9a6a849d8ad2f857afe0afde32b3b66553078b09aba6a83da4a1c570f02417bcfe0ae19871e1ecf02dc8458a4922cbd71a9d9af9a079eb6805a556522ea559f5599ee52b0dc869a9716d05dfdf5ed6d07b14a4495491e722a7cdd20d0de3ff6fc54c15093d6ce36faf4cbee63b8c85cd37685d0681f980a39bd30fe09cab0f28427dafe5533f682f564a263d68d53f792a9e05b39799c8a7aa8f5f74820ca19db92f3fbf391413f81fee17b169c7ffaf0f5552f550667b3ff42f229ad2cc2ebf540c9585a85eea215762b927a196e01366ba63fb01dfcf14d6928ed6766233bd8ef0215b9092e2af4879ccea34346f7aaeeaa7280ceee5121d45abadcc62212c77fc964a5a1187e71a3ef9d7db086ebcda0f78bbf92c87d3990f2700d38037d2c86001ab57076cb391bef8511137baf3a3a1152c4685416d925c46c0a7d5c5963c2f514ff8f2330fecb0b0220ba52891dc4c4c801723d677ab1990e55f8dd57cd0daf33e8ea39d23f584abe48eef74991c05409167b723ed54608c4645cc5c9c26a352ff8fbe577eada14383488777327df2e097846e47b2a9fd721c865af30f18a39ecdf28df046487ef9826b7daea698f75bff1a1344461d3b6133ae671fe63f3803e8a8aec07b5036b1c9c29edbd1125960aa4ed9d6c4a44876171a583b7140439813b2c661e188ea9cd74d1fd0b74a3c48869dbc2cc364e874f82c06125667f6422c706ba5d877b8954f25096d84d281b0083436a357356e6fd3d6c37f9fee8e098d49df0ac4b7630940b14a12c450be595f87d8f27f28f22ee4fbd33c74905da2e159f439138844f01f8d75f97a3d26080e153942fc1db3905918749fc3fb60ead653107a85585bf7c39816f329835be39fe436e042c5bbf59b09a5ac73a4009eb27254a750b69aebd66910a47739c19cf3797b275c2304f37129a27cd1d0621ded"], 0x930) 13.274710607s ago: executing program 2 (id=600): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0xa, 0x0) sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) r5 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r6, 0x0, 0x1, &(0x7f0000000000)=0x2, 0x4) sendmsg$802154_dgram(r6, &(0x7f00000018c0)={&(0x7f0000000500)={0x24, @short}, 0x14, &(0x7f0000001880)={0x0}}, 0x0) gettimeofday(0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x20000090) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000740), 0x0) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r4, 0x2) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) 11.505615599s ago: executing program 1 (id=602): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x6, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r1, &(0x7f00000002c0), 0x0, 0x20004004) mmap$IORING_OFF_CQ_RING(0x7fffffffb000, 0x7, 0x3000001, 0xbd4c341840b03bf2, 0xffffffffffffffff, 0x8000000) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x40400, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000240)={'pcl818\x00', [0x6, 0x2c, 0x1, 0xfffffffe, 0x81, 0x1000, 0x889a, 0x20000003, 0x6, 0x10007, 0x4, 0xb059, 0x100, 0xb6ac, 0x9, 0x54, 0x20000006, 0x10008, 0x40000fe9, 0x401, 0x3, 0x9, 0x4, 0x9, 0x48, 0x3, 0x80, 0x10, 0x83, 0x4000007, 0xff]}) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket(0x2, 0x80805, 0x0) utimensat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', &(0x7f00000002c0)={{0x0, 0x3fffffff}}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x1}, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x20000000) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010105, 0x4e20, 0x3, 'lblcr\x00', 0x30, 0x660f5380, 0x3}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000440)={{0x84, @broadcast, 0x4f29, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@rand_addr=0x64010101, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000022a00)={0x4000000, 0x92, 0x0, 0x0, 0x2}) munlockall() write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) bind$inet(0xffffffffffffffff, 0x0, 0x0) 10.684863229s ago: executing program 2 (id=603): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x80000000000002, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000000)=0x7fffffffffffffff) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x40003) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000280)={0x0, 0x5}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xaf1}, 0x8) bind$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000140)='\b', 0x1}], 0x45}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r4, 0x84, 0x79, &(0x7f0000000240)={0x0, 0x0, 0xc48f}, 0x7) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r5, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) 8.018835282s ago: executing program 2 (id=604): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x240008c4) ioctl$NILFS_IOCTL_GET_BDESCS(0xffffffffffffffff, 0xc0186e87, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f000007e000/0x1000)=nil) mremap(&(0x7f000007e000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffd000/0x1000)=nil) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x94}}, 0x0) syz_open_dev$video4linux(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) 8.000368192s ago: executing program 1 (id=606): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000840)={[{@noblock_validity}, {@resuid={'resuid', 0x3d, 0xee00}}]}, 0x0, 0x49b, &(0x7f0000001800)="$eJzs3MtrXFUcAODf3GTSpM/4qNqHGl9YUJsmfdiFG0XRhYKgi9qFENO01Ka2NBFsKaaK1KUU3ItLwb/AlW5EXQludS+FItk0PsAr9869Jk0ymZl0konO98G059x7Zs7rnjvnnnsnAXStoeyfSsTWiPg5Cyd59F9pkShLNzd7efz32cvjlUjT136r5Ptuzl4eL9OW79taRPYlEclHldizTL5TFy+dGZucnLhQxIenz54fnrp46anTZ8dOTZyaeGf06NFDB0eePjJ6uGEdKk3Uc1tW1t3vn9u766U3rr0yfuzaW99/2VuWdVE92mUohuqW7bF2Z9Zh2xaEK70dLAgt6YmIrLuq+fjfET0x33k74oUPO1o4YE2laZpur7/7Sgr8j1Wi0yUAOqP8or85OxD9a3QdvJHdeLZ2AZTVe6541fb0RlKkqS66vm2n/mL94tiVPz6LvP03dVX7AwDr7+ts/vNkbf5Tvmp7BuOeBem25+vB2daIOyLizoi4KyLujoidEXnaeyPivhbzH1oUXzr/TK6vqmJNyuZ/z0TEXG9E3DL/K2Z/f6eDPUVsWwzEYFQrJ09PThwo2mRfVDedrE5OjKyQxzfP//RJvX1DxdyvfGX5l3PBohzXezfd+p4TY9Njt1freTc+yNcAZ+aWzH/n71xloV0RsbvlTz/+4unz2f9f7K2XonH9V9CG+0zp5xGP1+5tXokV6r/4/uRAse/I6OHh/picODBcHhVL/fDj1Vfr5X9b9W+DrP83F/d26/T/YGXh/dqp1vO4+svHda9pWjj+j5dbsuO/r/J6Hu4rtr03Nj19YSSir/Ly0u2j859Wxsv0N7bujHhkufon+TkuO8ay+u+JiOwgvj8iHoiIB4uyPxQRD0f+EcuZmYuI75579O3V1D9p1LBtkPX/iVv6Pxr0f+uBnjPffrWa+tdk/X8oD+0rtix//usvA/lZodkCtqMNAQAAYKNL8mfgK8n+IjwQSbJ/f8SWfG13czJ5bmr6iZPn3v3zRO1Z+cGoJuVKV209uLYeOlKsDZfx0UXxg8W68ac9A3l888IrdqAjtiwc//mCY238Z37tWf49zfzeBviP8Hst6F7GP3Qv4x+6V3Pjv3gKcWZtywKsr2a//9M1Lgew/pYb/3W/5t9cj8eSgfXi+h+6l/EP3cv4h+5l/ENXup3f9Qs0CMy03Lz9sVKavvYXNU1X+/ZI8kA608F2/qv4MyzNJV678pTPxDdOXC3G3UY5ROsHOndOAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaKd/AgAA//9XstwK") socket(0x10, 0x3, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r1, &(0x7f00000008c0)=[{&(0x7f0000000580)='`', 0x1}], 0x1) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000080)=0x6, 0x26) recvmmsg(r0, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) 7.303763238s ago: executing program 1 (id=607): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffdf, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24000084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfdfffdfc, {0x0, 0x0, 0x0, r2, {0x4}, {0xffff, 0xffff}, {0xe, 0xa}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0x6}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x10000, 0x8, 0xbb}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x85c}, 0x0) 7.21954827s ago: executing program 4 (id=608): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r1}, 0x4) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0), 0xc) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0xa, 0x2400000001, 0x0) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000100)={0x2, @pix={0x712, 0x4e, 0x32315559, 0x4, 0x7, 0x9, 0x0, 0x2, 0x0, 0x6, 0x0, 0x2}}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, @none, 0x7f}, 0xa) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61105c00000000006113380000000000bfa00000000000000700000008ffffffd50301001874004095000600000000006916360000000000bf67000000000000360607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c747664e9f7478f8200000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) 6.036340288s ago: executing program 0 (id=610): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000000)=0x5) syz_open_dev$dri(0x0, 0x1f, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$sg(0x0, 0x0, 0x8002) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0x7e) io_uring_setup(0x6957, &(0x7f0000000700)={0x0, 0xc54b, 0x1, 0x20001, 0x2de}) r4 = io_uring_setup(0x110, 0x0) io_uring_register$IORING_REGISTER_FILES(r4, 0x1e, 0x0, 0x0) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f00000000c0)={'pcmmio\x00', [0x140, 0xb, 0x79b, 0x2, 0x10000007, 0x7fffffff, 0x7fff, 0x6, 0x3, 0xc72d, 0x0, 0x7, 0xfffff9f5, 0xd0eb, 0x29, 0x72f0, 0x9, 0x7c, 0x4, 0x3fe, 0x40008, 0x488, 0xc, 0x9, 0x1004, 0x80000001, 0xe, 0x3, 0x7, 0x3, 0x1]}) shutdown(0xffffffffffffffff, 0x1) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000180)={@rand_addr=0x640100ff, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x1, "fbd194a4a0c986ff21c1bac6917bf18aa114b0eb7cd0166f0d67d610e1b6f9f4", 0x0, 0x9, 0x3, 0xfffff001}, 0x3c) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000900), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r6, 0xc0145401, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) 6.035928278s ago: executing program 4 (id=611): r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x3e000, 0x1000}, 0x20) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000002d40)=0x1, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_ublk_setup_io_uring(0x155a, &(0x7f0000000500)={0x0, 0xa355, 0x10000, 0x2, 0x15a}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x34, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x5}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newsa={0x144, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@multicast1, @in=@broadcast, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0x4d6, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x192, 0xffffffffffffff3a, 0x0, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0x9, 0x0, 0x20000001f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0xfff}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x8}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x350759, 0x6eb0}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r12 = dup(r10) syz_ublk_setup_queues(r12, r9, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255, 0x0, r4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x6, 0x15e, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000004, 0x142, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x2000, 0x20003, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8256, 0x2, 0x3, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x8, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r8, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'netdevsim0\x00'}) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_RX_RING(r12, 0x11b, 0x2, &(0x7f0000000080)=0x800, 0x4) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)={0xa002803f}) 5.814003463s ago: executing program 1 (id=612): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x80000000000002, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x40003) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, 0x0, 0x0) bind$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @dev={0xfe, 0x80, '\x00', 0x18}, 0x1}, 0x1c, &(0x7f00000004c0)=[{0x0}, {&(0x7f0000000440)}, {&(0x7f0000000480)="0c7d18b0d81b997e4fee", 0xa}], 0x3}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r4, 0x84, 0x79, &(0x7f0000000240)={0x0, 0x0, 0xc48f}, 0x7) capset(&(0x7f0000000180)={0x20080522}, &(0x7f0000000100)={0x200000, 0x200000, 0x1000002, 0x0, 0xd33, 0xd26d}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_DESTROY$stdev(r5, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r6, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r5, 0x3ba0, &(0x7f0000000a40)={0x48, 0x7, r7, 0x0, 0x0, 0x0, 0x0, 0x1000}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r5, 0x3ba0, &(0x7f0000000b80)={0x48, 0x6, r7, 0x0, r8}) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) 5.742827315s ago: executing program 0 (id=613): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x5475d}, [@IFLA_BROADCAST={0xa, 0x2, @multicast}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x34}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setrlimit(0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) connect$unix(0xffffffffffffffff, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') setresgid(0xee00, 0xee01, 0x0) syz_open_procfs(0x0, &(0x7f0000000280)='net/route\x00') preadv(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x6, 0xffffffff) write$proc_mixer(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x8c) close(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) sendfile(r3, r3, &(0x7f0000000080), 0x7f03) 4.397244196s ago: executing program 1 (id=614): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfffff, 0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'bond_slave_1\x00', &(0x7f0000002fc0)=@ethtool_wolinfo={0x3, 0x8, 0xfffffffd, "050000009582"}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xb, &(0x7f0000000500)=@raw=[@btf_id={0x18, 0xb, 0x3, 0x0, 0x2}, @generic={0xb7, 0x2, 0x0, 0x0, 0x64}, @generic={0x85, 0x0, 0x0, 0x0, 0x3e}, @generic={0xbf, 0x1, 0x6}, @map_fd={0x18, 0x2}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4, 0x0, 0x0, 0x5}, @generic={0x85, 0x0, 0x0, 0x0, 0x3c}, @generic={0x95}], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x10) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r3, 0x402, 0x30) fcntl$notify(r3, 0x402, 0x7) r4 = socket(0x1e, 0x1, 0x0) connect$tipc(r4, &(0x7f0000000040)=@id, 0x10) recvmmsg(r4, 0x0, 0x0, 0x0, 0x0) recvfrom$unix(r4, &(0x7f00000000c0)=""/41, 0x29, 0x10003, 0x0, 0x0) shutdown(r4, 0x2) sendmsg$nl_route(r4, &(0x7f0000000440)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000180)=@ipv6_delrule={0x58, 0x21, 0x800, 0x70bd2c, 0x25dfdbfe, {0xa, 0x0, 0x0, 0x8, 0x6, 0x0, 0x0, 0x0, 0x8}, [@FRA_DST={0x14, 0x1, @private2}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @FRA_DST={0x14, 0x1, @private2}]}, 0x58}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) 4.281100829s ago: executing program 0 (id=615): epoll_create1(0x0) r0 = socket$unix(0x1, 0x1, 0x0) close(r0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x3e000, 0x1000}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000002d40)=0x1, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_ublk_setup_io_uring(0x155a, &(0x7f0000000500)={0x0, 0xa355, 0x10000, 0x2, 0x15a}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x34, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x5}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newsa={0x144, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@multicast1, @in=@broadcast, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0x4d6, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x192, 0xffffffffffffff3a, 0x0, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0x9, 0x0, 0x20000001f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0xfff}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x8}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x350759, 0x6eb0}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r11 = dup(r9) syz_ublk_setup_queues(r11, r8, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255, 0x0, r3}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x6, 0x15e, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000004, 0x142, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x2000, 0x20003, 0x0, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8256, 0x2, 0x3, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x8, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r7, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'netdevsim0\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_RX_RING(r11, 0x11b, 0x2, &(0x7f0000000080)=0x800, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r1, &(0x7f00000003c0)={0x2c, 0x18, r12}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0xf, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x94) 4.170460662s ago: executing program 4 (id=616): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000840)={[{@noblock_validity}, {@resuid={'resuid', 0x3d, 0xee00}}]}, 0x0, 0x49b, &(0x7f0000001800)="$eJzs3MtrXFUcAODf3GTSpM/4qNqHGl9YUJsmfdiFG0XRhYKgi9qFENO01Ka2NBFsKaaK1KUU3ItLwb/AlW5EXQludS+FItk0PsAr9869Jk0ymZl0konO98G059x7Zs7rnjvnnnsnAXStoeyfSsTWiPg5Cyd59F9pkShLNzd7efz32cvjlUjT136r5Ptuzl4eL9OW79taRPYlEclHldizTL5TFy+dGZucnLhQxIenz54fnrp46anTZ8dOTZyaeGf06NFDB0eePjJ6uGEdKk3Uc1tW1t3vn9u766U3rr0yfuzaW99/2VuWdVE92mUohuqW7bF2Z9Zh2xaEK70dLAgt6YmIrLuq+fjfET0x33k74oUPO1o4YE2laZpur7/7Sgr8j1Wi0yUAOqP8or85OxD9a3QdvJHdeLZ2AZTVe6541fb0RlKkqS66vm2n/mL94tiVPz6LvP03dVX7AwDr7+ts/vNkbf5Tvmp7BuOeBem25+vB2daIOyLizoi4KyLujoidEXnaeyPivhbzH1oUXzr/TK6vqmJNyuZ/z0TEXG9E3DL/K2Z/f6eDPUVsWwzEYFQrJ09PThwo2mRfVDedrE5OjKyQxzfP//RJvX1DxdyvfGX5l3PBohzXezfd+p4TY9Njt1freTc+yNcAZ+aWzH/n71xloV0RsbvlTz/+4unz2f9f7K2XonH9V9CG+0zp5xGP1+5tXokV6r/4/uRAse/I6OHh/picODBcHhVL/fDj1Vfr5X9b9W+DrP83F/d26/T/YGXh/dqp1vO4+svHda9pWjj+j5dbsuO/r/J6Hu4rtr03Nj19YSSir/Ly0u2j859Wxsv0N7bujHhkufon+TkuO8ay+u+JiOwgvj8iHoiIB4uyPxQRD0f+EcuZmYuI75579O3V1D9p1LBtkPX/iVv6Pxr0f+uBnjPffrWa+tdk/X8oD+0rtix//usvA/lZodkCtqMNAQAAYKNL8mfgK8n+IjwQSbJ/f8SWfG13czJ5bmr6iZPn3v3zRO1Z+cGoJuVKV209uLYeOlKsDZfx0UXxg8W68ac9A3l888IrdqAjtiwc//mCY238Z37tWf49zfzeBviP8Hst6F7GP3Qv4x+6V3Pjv3gKcWZtywKsr2a//9M1Lgew/pYb/3W/5t9cj8eSgfXi+h+6l/EP3cv4h+5l/ENXup3f9Qs0CMy03Lz9sVKavvYXNU1X+/ZI8kA608F2/qv4MyzNJV678pTPxDdOXC3G3UY5ROsHOndOAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaKd/AgAA//9XstwK") socket(0x10, 0x3, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r1, &(0x7f00000008c0)=[{&(0x7f0000000580)='`', 0x1}], 0x1) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000080)=0x6, 0x26) recvmmsg(r0, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) 3.089213267s ago: executing program 2 (id=617): openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB='utf8=0,shortname=lower,rodir,utf8=0,uni_xlate=1,utf8=0,iocharset=koi8-ru,shortname=lower,iocharset=utf8,check=relaxed,shortname=mixed,shortname=win95,showexec,shortname=winnt,shortname=win95,rodir,nonumtail=0,errors=continue,nnonuage=936,nonumtail=0,shortname=winnt,shortname=win95,obj_user=errors=remount-ro,\x00'], 0x1, 0x36b, &(0x7f0000000a00)="$eJzs3U1vG1UXAODTvM1H85I6C4QECHFVNrCxkvAHGqFWQkQChRoVFkhTMgEr0zjyWEGuEHTHlt9RsWSHhPgDWcCeHbtsWHZRdVDsuPloCIvUHgrPI0X3xPce+4zHM7qb0dm//d3drc2yuZn1Yup6iqmImHoYsTiIhi4djlODeCaOux9vNW7/9tqHH3/y3ura2o31lG6u3np7JaV09fWfvvzq+2s/9/7/0Q9Xf5yNvcVP9/9Y+X3vpb2X9x/f+qJdpnaZtju9lKU7nU4vu1PkaaNdbjVT+qDIszJP7e0y756Y3yw6Ozv9lG1vLMzvdPOyTNl2P23l/dTrpF63n7LPs/Z2ajabaWE++DutB+vr2eownjtn3fVJFcQYdLur2cE1PPvUTOtBLQUBALW66P5/5pnu/6fD/n+Sju//+bc62P/PHF6/J9n/AwAAAAAAAAAAAADA8+BhVTWqqmqMxmr0kPDh/zWXx5g9df5P/dVdH+N17MG9uYji293Wbms4DudXN6MdReSxFI14dHBbGBnGN99du7GUBhZj4e43g/xrv0S0/ncyfzkasXh2/vIwPz3Jj4NxOuaP569EI148O3/lzPyZePONY/nNaMSvn0UnitgY3N6O8r9eTumd99dO5c8O1gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw39BMI6/GsO/9biviSuwe9u9vHi1YPNkff5j/pL/+UjTi0dn9+ZfO7M9/OV65XO+xAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBI2b+3lRVF3p1UMOr5P3hlZhT8ddal4fL7p6auxARrLop86lm94eOqqsZV6txkT+VFgumI885gdfgrufhnvRAR56yZjYj6v41/YlDXHQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADqc9T0u+5KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqFPZv7eVFUXeHWNQ9zECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8T/4MAAD//yeQEY0=") bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x26, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x30, 0x0, &(0x7f00000041c0)) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) open(&(0x7f0000000200)='./file1\x00', 0x4827e, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_procfs(0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) accept$unix(r3, &(0x7f00000001c0), &(0x7f0000000280)=0x6e) epoll_create(0x9) socket$inet_tcp(0x2, 0x1, 0x0) 3.088916497s ago: executing program 4 (id=618): bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) write$P9_RLERRORu(r0, 0x0, 0x10) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x2], 0x0, 0x0, 0x1, 0x1}}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0, 0x1) bind$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x6, 0x9, 0x9, 0x90, 0x4, @remote}, 0x10) getdents64(r2, &(0x7f00000001c0)=""/45, 0x2d) mmap(&(0x7f0000030000/0x2000)=nil, 0x2000, 0x300000b, 0x13, 0xffffffffffffffff, 0xec776000) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300), 0x103000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r4 = gettid() tkill(r4, 0xb) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@bloom_filter={0x1e, 0x9, 0x3f3, 0x3, 0x100, r0, 0x5, '\x00', 0x0, r0, 0x3, 0x5, 0x1, 0x7}, 0x50) r5 = fsopen(&(0x7f0000000080)='binder\x00', 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x1) fsconfig$FSCONFIG_SET_PATH_EMPTY(r5, 0x4, 0x0, &(0x7f0000000180)='./file1\x00', 0xffffffffffffff9c) fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) 1.349308618s ago: executing program 0 (id=619): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r1}, 0x4) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0), 0xc) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0xa, 0x2400000001, 0x0) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000100)={0x2, @pix={0x712, 0x4e, 0x32315559, 0x4, 0x7, 0x9, 0x0, 0x2, 0x0, 0x6, 0x0, 0x2}}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, @none, 0x7f}, 0xa) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61105c00000000006113380000000000bfa00000000000000700000008ffffffd50301001874004095000600000000006916360000000000bf67000000000000360607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c747664e9f7478f8200000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) 1.327399009s ago: executing program 2 (id=620): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) close(r2) listen(0xffffffffffffffff, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0xff32, 0x8fc, &(0x7f0000000480)={0xa, 0x3a, 0x9, @loopback={0xff00000000000000}, 0x2}, 0x1c) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040), 0x4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='dummy_udc.0', 0xb) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x6, 0x0, 0x0, 0x500, 0x0, 0x71, 0x11, 0x24}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x288, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1f0, 0xffffff7a, 0xffffffff, 0x1f0, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0x130, 0x150, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "007f0100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x80, 0x3, {0x4}}}]}, @common=@unspec=@NFQUEUE3={0x20, 'NFQUEUE\x00', 0x3, {0x9, 0x38, 0x1d}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0x0, 0xff000000, 'team_slave_0\x00', 'ip6gre0\x00', {0xff}, {}, 0x6, 0x3}, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x0, 0x4}, {0x4, 0x5, 0x6}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e8) syz_open_dev$evdev(&(0x7f0000000000), 0x8c, 0x200) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x6, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="850008000000000295000000000000"], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x90}, 0x94) unlink(&(0x7f0000000300)='./config\x00') 1.209470822s ago: executing program 0 (id=621): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$netlink(0x10, 0x3, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffdf, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24000084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfdfffdfc, {0x0, 0x0, 0x0, r2, {0x4}, {0xffff, 0xffff}, {0xe, 0xa}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0x6}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x10000, 0x8, 0xbb}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x85c}, 0x0) 1.208579812s ago: executing program 4 (id=622): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x14, 0x10, 0x0, 0xfd, 0x0, 0x0, 0x6, 0x20002200}, [@RTA_TABLE={0x8, 0xf, 0x7fe}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) fsopen(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./tracing/events/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000800)='0', 0x1) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000018"], 0x44}}, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c8, &(0x7f0000000100)) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xfff3, 0xfff3}, {0x0, 0xfff3}, {0x1, 0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_VLAN_ID={0x6, 0x17, 0xe5e}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20041090}, 0x80) r8 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r8) r9 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsmount(r9, 0x1, 0x1) 142.842137ms ago: executing program 2 (id=623): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0xffffffff, 0x0, {{@in=@multicast1=0xe0000002, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0xfffc, 0x0, 0x3, 0xa, 0x0, 0x20}, {0x20000000, 0x7fffffffffffffff, 0x0, 0xffffffffffff0dac, 0x0, 0x14d, 0x0, 0xfffffffffffffffb}, {0x0, 0xfffffffffffffff7, 0x200000000000000}, 0x0, 0x0, 0x0, 0x1, 0x3, 0x2}}, 0xb8}}, 0x2c000010) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x8000, 0x0) mkdir(&(0x7f0000000140)='./config\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) open(&(0x7f00000002c0)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x241, 0x1ff) mkdir(&(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv\x00', 0x1ff) mkdir(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p\x00', 0x1ff) r2 = open(&(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/wWidth\x00', 0x241, 0x1ff) write(r2, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600), 0x0) close(0xffffffffffffffff) r3 = open(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/dwMaxVideoFrameBufferSize\x00', 0x241, 0x1ff) write(r3, &(0x7f00000006c0)='1843', 0x4) close(r3) write(0xffffffffffffffff, 0x0, 0x0) r4 = socket(0x2b, 0x1, 0x1) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000000)={'ip_vti0\x00', &(0x7f00000046c0)={'gre0\x00', 0x0, 0x78a1, 0x7, 0x180, 0x5, {{0x5, 0x4, 0x0, 0x6, 0x14, 0x65, 0x0, 0x1, 0x4, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0x11}}}}}) mkdir(&(0x7f00000007c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x0) symlink(&(0x7f0000000ac0)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x0) ioctl$COMEDI_BUFINFO(r1, 0xc02c640e, &(0x7f00000000c0)={0x300, 0x4, 0x3ff, 0xffffff01, 0x4, 0x2, 0xff}) readv(r0, &(0x7f0000003740)=[{&(0x7f00000004c0)=""/4096, 0x1000}], 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r5, &(0x7f00000001c0)="703a732f70202e2f66696c65303a301125", 0x11) read$char_usb(r5, &(0x7f0000000200)=""/88, 0x58) 6.76179ms ago: executing program 4 (id=624): r0 = socket$packet(0x11, 0x2, 0x300) openat$comedi(0xffffffffffffff9c, 0x0, 0x80400, 0x0) setsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, &(0x7f0000000000)=0x1, 0x4) syz_mount_image$msdos(&(0x7f00000000c0), &(0x7f00000001c0)='./file1\x00', 0x800082, &(0x7f0000000680)=ANY=[@ANYBLOB="756d61736b3d30303030303030303030303030303030303030333737372c616c6c6f775f7574696d653d30303030303030332c000000000083ec4c0d6e84de0249d09f31ef580c3d00000000"], 0x1, 0x1c5, &(0x7f0000000340)="$eJzs3UFr02AYB/AnXZdVUdhZPAS8eCrqJ6jKBsOAoPSgJ4XpZRPBXaKnfgu/gV/FryM57VZpU1Y2IlNoktX8fqeH95/mfd63kPfU9N39TyfHn88+/vj5PUajJIaTmMR5EvsxiJ2ozOKSpHYUANga5/N5/JpX/uLyZy20BAA07B/PfwDgP+D8B4D+cf4DQP+8fvP2xdM8P3iVZaOIcnZrOVrOimmVHx7lB4+ypf31p8qimO5c5I+rPLuc78btVf6kNk/j4YMqX2TPX+a7y2hYXVFM9+K4ruFJsvE9AAAAAAAAAAAAAAAAAAAAAACAto2zC7Xv9xmP0z/kVXV4lK7Grr7fZxj3hjUTpo0sAwAAAAAAAAAAAAAAAAAAALba2ddvJ+9PTz98ublFuYn7xKDbVdyNTd/5TuPf4N5qhhY36tq5knb7aaVY7PMNaONKce2jY9DogwkAAAAAAAAAAAAAAAAAAHpo/aPfrjsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgO6s//+/uWIxz6DrhQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0Gu/AwAA//+a6T6f") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) dup(r1) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1c0) landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x2001, 'sh\x00', 0x1, 0x0, 0x6d}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file1/file3\x00', 0x0) setns(0xc9, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000180)=0xd0) msgrcv(0x0, 0x0, 0x0, 0x3, 0x7800) syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000000)='./bus\x00', 0xc1000, 0x0, 0x0, 0x0, &(0x7f0000000000)) rmdir(&(0x7f0000000080)='./bus\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x18}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="50000000090005000008090002007332000080de00050001000700000009000200797a3100000000050001000717030000797a3100"/66], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x20008010) 0s ago: executing program 0 (id=625): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x240008c4) ioctl$NILFS_IOCTL_GET_BDESCS(0xffffffffffffffff, 0xc0186e87, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f000007e000/0x1000)=nil) mremap(&(0x7f000007e000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffd000/0x1000)=nil) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x94}}, 0x0) syz_open_dev$video4linux(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.102' (ED25519) to the list of known hosts. [ 77.485225][ T5759] cgroup: Unknown subsys name 'net' [ 77.615187][ T5759] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 78.988940][ T5759] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 80.312664][ T5772] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.329036][ T5772] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.336933][ T5772] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.345200][ T5772] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.353073][ T5772] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 80.360479][ T5772] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.425882][ T5083] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 80.447567][ T5083] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 80.458511][ T5083] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 80.471838][ T5777] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 80.483314][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 80.492061][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 80.499595][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 80.508658][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 80.515809][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 80.539366][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 80.558927][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 80.570044][ T5772] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 80.581526][ T5779] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.591103][ T5779] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.608122][ T5779] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 80.619002][ T5779] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 80.626893][ T5779] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 80.640376][ T5779] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.981385][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 81.024734][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 81.141455][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 81.153300][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.160582][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.167968][ T5770] bridge_slave_0: entered allmulticast mode [ 81.175750][ T5770] bridge_slave_0: entered promiscuous mode [ 81.189010][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.196215][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.203756][ T5770] bridge_slave_1: entered allmulticast mode [ 81.211047][ T5770] bridge_slave_1: entered promiscuous mode [ 81.238951][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 81.318447][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.325685][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.332941][ T5775] bridge_slave_0: entered allmulticast mode [ 81.339719][ T5775] bridge_slave_0: entered promiscuous mode [ 81.359081][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.379990][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.387140][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.396704][ T5775] bridge_slave_1: entered allmulticast mode [ 81.404390][ T5775] bridge_slave_1: entered promiscuous mode [ 81.425488][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.487571][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.507730][ T5770] team0: Port device team_slave_0 added [ 81.514944][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.522485][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.530107][ T5773] bridge_slave_0: entered allmulticast mode [ 81.537232][ T5773] bridge_slave_0: entered promiscuous mode [ 81.549473][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.578724][ T5770] team0: Port device team_slave_1 added [ 81.593605][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.601517][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.608872][ T5773] bridge_slave_1: entered allmulticast mode [ 81.615577][ T5773] bridge_slave_1: entered promiscuous mode [ 81.640543][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.647797][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.655197][ T5776] bridge_slave_0: entered allmulticast mode [ 81.662797][ T5776] bridge_slave_0: entered promiscuous mode [ 81.685129][ T5775] team0: Port device team_slave_0 added [ 81.703012][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.710061][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.736348][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.748604][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.755834][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.763915][ T5776] bridge_slave_1: entered allmulticast mode [ 81.771053][ T5776] bridge_slave_1: entered promiscuous mode [ 81.787793][ T5775] team0: Port device team_slave_1 added [ 81.794489][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.801694][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.828206][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.849230][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.863235][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.934559][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.941590][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.967636][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.981174][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.005995][ T5770] hsr_slave_0: entered promiscuous mode [ 82.013192][ T5770] hsr_slave_1: entered promiscuous mode [ 82.020653][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.027618][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.054517][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.072163][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.084440][ T5773] team0: Port device team_slave_0 added [ 82.094722][ T5773] team0: Port device team_slave_1 added [ 82.175048][ T5776] team0: Port device team_slave_0 added [ 82.201267][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.211194][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.237657][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.250797][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.257824][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.284034][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.296755][ T5776] team0: Port device team_slave_1 added [ 82.320002][ T5775] hsr_slave_0: entered promiscuous mode [ 82.326595][ T5775] hsr_slave_1: entered promiscuous mode [ 82.333234][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.342258][ T5775] Cannot create hsr debugfs directory [ 82.363450][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.372818][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.401996][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.419759][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.426768][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.429305][ T5779] Bluetooth: hci0: command tx timeout [ 82.452856][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.496274][ T5776] hsr_slave_0: entered promiscuous mode [ 82.502931][ T5776] hsr_slave_1: entered promiscuous mode [ 82.512606][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.520390][ T5776] Cannot create hsr debugfs directory [ 82.582695][ T5773] hsr_slave_0: entered promiscuous mode [ 82.591338][ T5773] hsr_slave_1: entered promiscuous mode [ 82.597508][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.605561][ T5773] Cannot create hsr debugfs directory [ 82.658359][ T5779] Bluetooth: hci1: command tx timeout [ 82.664033][ T5779] Bluetooth: hci2: command tx timeout [ 82.738811][ T5779] Bluetooth: hci3: command tx timeout [ 82.964473][ T5770] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.984124][ T5770] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 82.993652][ T5770] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.004960][ T5770] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.065754][ T5775] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.086442][ T5775] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.096488][ T5775] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.125666][ T5775] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 83.195898][ T5776] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 83.207559][ T5776] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 83.217861][ T5776] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 83.229474][ T5776] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 83.317656][ T5773] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 83.343692][ T5773] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 83.353388][ T5773] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 83.365053][ T5773] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 83.420630][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.470831][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.513646][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.527576][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.542433][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.568008][ T2933] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.575359][ T2933] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.586478][ T2933] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.593668][ T2933] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.619750][ T2969] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.627053][ T2969] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.657104][ T2969] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.664412][ T2969] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.685149][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.740853][ T2933] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.747994][ T2933] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.787705][ T2969] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.794893][ T2969] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.896475][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.961992][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.987584][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.994893][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.051251][ T2933] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.058457][ T2933] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.183159][ T5773] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 84.249674][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.362682][ T5770] veth0_vlan: entered promiscuous mode [ 84.391786][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.430123][ T5770] veth1_vlan: entered promiscuous mode [ 84.473697][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.503559][ T5777] Bluetooth: hci0: command tx timeout [ 84.553572][ T5776] veth0_vlan: entered promiscuous mode [ 84.565815][ T5770] veth0_macvtap: entered promiscuous mode [ 84.583491][ T5770] veth1_macvtap: entered promiscuous mode [ 84.610390][ T5776] veth1_vlan: entered promiscuous mode [ 84.622152][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.645721][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.677829][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.711319][ T5770] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.721642][ T5770] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.730551][ T5770] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.740468][ T5779] Bluetooth: hci2: command tx timeout [ 84.745914][ T5779] Bluetooth: hci1: command tx timeout [ 84.748512][ T5770] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.767281][ T5775] veth0_vlan: entered promiscuous mode [ 84.795825][ T5775] veth1_vlan: entered promiscuous mode [ 84.805343][ T5773] veth0_vlan: entered promiscuous mode [ 84.818846][ T5779] Bluetooth: hci3: command tx timeout [ 84.823653][ T5773] veth1_vlan: entered promiscuous mode [ 84.857453][ T5776] veth0_macvtap: entered promiscuous mode [ 84.868094][ T5776] veth1_macvtap: entered promiscuous mode [ 84.955181][ T5775] veth0_macvtap: entered promiscuous mode [ 84.969792][ T5775] veth1_macvtap: entered promiscuous mode [ 84.984872][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.996801][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.008205][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.018832][ T5773] veth0_macvtap: entered promiscuous mode [ 85.037233][ T145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.046419][ T145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.067647][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.082790][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.096054][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.105444][ T5773] veth1_macvtap: entered promiscuous mode [ 85.135335][ T2933] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.137576][ T5776] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.152803][ T2933] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.153018][ T5776] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.171392][ T5776] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.180535][ T5776] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.217485][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.239635][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.249618][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.260203][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.271861][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.285913][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.301783][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.312235][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.323291][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.333398][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.344038][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.356899][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.382124][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.404139][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.415176][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.434692][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.454206][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.475269][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.486968][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.498147][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.510601][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.524563][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.536601][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.560869][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.578017][ T5773] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.588187][ T5773] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.602051][ T5773] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.616756][ T5773] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.677359][ T5775] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.708950][ T5775] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.718423][ T5775] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.727287][ T5775] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.826157][ T145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.983213][ T145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.453721][ T145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.493374][ T145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.584903][ T5779] Bluetooth: hci0: command tx timeout [ 86.669168][ T145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.714413][ T145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.722892][ T2933] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.768650][ T2933] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.819461][ T5779] Bluetooth: hci1: command tx timeout [ 86.824952][ T5779] Bluetooth: hci2: command tx timeout [ 86.968856][ T5779] Bluetooth: hci3: command tx timeout [ 87.546678][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.568181][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.829352][ T2933] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.861784][ T2933] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.243199][ T5851] syz.1.6[5851]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 88.340800][ T5851] loop1: detected capacity change from 0 to 512 [ 88.471604][ T5851] EXT4-fs (loop1): 1 truncate cleaned up [ 88.988907][ T5851] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 90.002773][ T5872] EXT4-fs error (device loop1): ext4_validate_block_bitmap:439: comm syz.1.6: bg 0: block 465: padding at end of block bitmap is not set [ 90.077272][ T5872] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 90.093094][ T5872] EXT4-fs (loop1): This should not happen!! Data will be lost [ 90.093094][ T5872] [ 90.106553][ T5872] EXT4-fs (loop1): Total free blocks count 0 [ 90.113868][ T5872] EXT4-fs (loop1): Free/Dirty block details [ 90.123795][ T5872] EXT4-fs (loop1): free_blocks=0 [ 90.131951][ T5872] EXT4-fs (loop1): dirty_blocks=66 [ 90.142072][ T5872] EXT4-fs (loop1): Block reservation details [ 90.188438][ T5872] EXT4-fs (loop1): i_reserved_data_blocks=66 [ 90.892996][ T65] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 64 with error 28 [ 91.633468][ T5893] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 92.221315][ T9] cfg80211: failed to load regulatory.db [ 92.836155][ T5920] xt_HMARK: spi-set and port-set can't be combined [ 93.494746][ T5923] syzkaller0: entered promiscuous mode [ 93.519967][ T5923] syzkaller0: entered allmulticast mode [ 93.700636][ T5928] syzkaller0: entered promiscuous mode [ 93.756864][ T5928] syzkaller0: entered allmulticast mode [ 96.906106][ T5963] ip_tables: iptables: counters copy to user failed while replacing table [ 97.497638][ T5977] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 97.524434][ T5978] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 97.552448][ T5978] CIFS: Attempting to mount //127.0.0.1/share [ 97.572248][ T5978] CIFS: VFS: Error connecting to socket. Aborting operation. [ 97.580545][ T5978] CIFS: VFS: cifs_mount failed w/return code = -111 [ 98.260516][ T5977] CIFS: Attempting to mount //127.0.0.1/share [ 98.350360][ T5977] CIFS: VFS: Error connecting to socket. Aborting operation. [ 98.380413][ T5977] CIFS: VFS: cifs_mount failed w/return code = -111 [ 98.525569][ T5975] process 'syz.3.24' launched '/dev/fd/4' with NULL argv: empty string added [ 101.267001][ T6001] loop1: detected capacity change from 0 to 8192 [ 101.336731][ T6001] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 101.411687][ T6001] REISERFS (device loop1): found reiserfs format "3.6" with non-standard journal [ 101.459517][ T6001] REISERFS (device loop1): using ordered data mode [ 101.492647][ T6001] reiserfs: using flush barriers [ 101.514312][ T6001] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 101.766331][ T6001] REISERFS (device loop1): checking transaction log (loop1) [ 102.404725][ T6011] Process accounting resumed [ 102.683813][ T6001] REISERFS (device loop1): Using tea hash to sort names [ 102.744210][ T6001] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 103.219203][ T6001] REISERFS warning (device loop1): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 2) [ 103.401877][ T6001] REISERFS warning (device loop1): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 4) [ 103.458642][ T6001] REISERFS warning (device loop1): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 4) [ 103.628994][ T6001] REISERFS warning (device loop1): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 4) [ 105.284779][ T6035] loop0: detected capacity change from 0 to 4096 [ 105.356287][ T6035] ntfs3: loop0: Different NTFS sector size (4096) and media sector size (512). [ 105.530522][ T6035] ntfs3: loop0: Failed to initialize $Extend/$Reparse. [ 105.963326][ T5770] ntfs3: loop0: ino=1a, ntfs_sync_fs failed, -22. [ 106.626129][ T6061] loop1: detected capacity change from 0 to 256 [ 107.374414][ T6064] syzkaller0: entered promiscuous mode [ 107.411517][ T6064] syzkaller0: entered allmulticast mode [ 107.668670][ T6058] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 107.752408][ T6078] futex_wake_op: syz.1.44 tries to shift op by 144; fix this program [ 107.764376][ T6078] futex_wake_op: syz.1.44 tries to shift op by 144; fix this program [ 112.141926][ T6124] netlink: 4 bytes leftover after parsing attributes in process `syz.1.49'. [ 112.154124][ T6124] hsr0: entered promiscuous mode [ 112.159953][ T6124] hsr0: entered allmulticast mode [ 112.168432][ T6124] hsr_slave_0: entered allmulticast mode [ 112.196831][ T6124] hsr_slave_1: entered allmulticast mode [ 112.331846][ T6133] loop1: detected capacity change from 0 to 128 [ 112.373195][ T6134] syz.3.50 uses obsolete (PF_INET,SOCK_PACKET) [ 112.961893][ T6133] syz.1.53: attempt to access beyond end of device [ 112.961893][ T6133] loop1: rw=2049, sector=145, nr_sectors = 896 limit=128 [ 113.989301][ T2947] kworker/u4:7: attempt to access beyond end of device [ 113.989301][ T2947] loop1: rw=1, sector=150, nr_sectors = 1 limit=128 [ 114.042430][ T2947] Buffer I/O error on dev loop1, logical block 150, lost async page write [ 114.268230][ C0] sched: RT throttling activated [ 114.464449][ T5842] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 114.735132][ T5842] usb 4-1: config 0 has no interfaces? [ 114.798116][ T5842] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 114.959744][ T5842] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.244844][ T5842] usb 4-1: config 0 descriptor?? [ 115.371185][ T6154] mmap: syz.1.57 (6154) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 115.378618][ T6153] Bluetooth: MGMT ver 1.22 [ 115.559592][ T6158] loop1: detected capacity change from 0 to 512 [ 115.595290][ T5842] usb 4-1: USB disconnect, device number 2 [ 115.608045][ T6158] EXT4-fs error (device loop1): ext4_get_branch:178: inode #13: block 1024: comm syz.1.58: invalid block [ 115.643836][ T6158] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.58: invalid indirect mapped block 1024 (level 0) [ 115.671207][ T6158] EXT4-fs error (device loop1): ext4_validate_block_bitmap:439: comm syz.1.58: bg 0: block 35: padding at end of block bitmap is not set [ 115.687739][ T6158] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 115.697577][ T6158] EXT4-fs (loop1): 1 truncate cleaned up [ 115.704872][ T6158] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 116.983765][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.373820][ T6180] binder: 6179:6180 ioctl c0306201 200000000080 returned -14 [ 117.451693][ T6180] binder: 6179:6180 ioctl c0306201 2000000003c0 returned -14 [ 125.350673][ T6252] loop0: detected capacity change from 0 to 1024 [ 126.579345][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 126.600605][ T6261] loop0: detected capacity change from 0 to 32768 [ 126.633187][ T6261] XFS (loop0): DAX unsupported by block device. Turning off DAX. [ 126.643690][ T6261] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 126.704960][ T6261] XFS (loop0): Ending clean mount [ 126.724967][ T6261] XFS (loop0): Quotacheck needed: Please wait. [ 126.790802][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 126.795491][ T6261] XFS (loop0): Quotacheck: Done. [ 126.844001][ T9] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 126.858318][ T9] usb 4-1: config 0 has no interface number 0 [ 126.864537][ T9] usb 4-1: config 0 interface 12 has no altsetting 0 [ 126.967525][ T9] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 126.978060][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.999681][ T9] usb 4-1: Product: syz [ 127.004190][ T9] usb 4-1: Manufacturer: syz [ 127.009379][ T9] usb 4-1: SerialNumber: syz [ 127.021877][ T9] usb 4-1: config 0 descriptor?? [ 128.576368][ T5770] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 129.123980][ T6283] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5776] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[6283] [ 132.415786][ T9] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 132.468583][ T9] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 132.538374][ T9] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 132.577826][ T9] f81534: probe of 4-1:0.12 failed with error -71 [ 132.622278][ T6317] syzkaller0: entered promiscuous mode [ 132.636218][ T6317] syzkaller0: entered allmulticast mode [ 132.907558][ T9] usb 4-1: USB disconnect, device number 3 [ 133.131964][ T6324] netlink: 4 bytes leftover after parsing attributes in process `syz.3.96'. [ 133.184516][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.201139][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.884645][ T6327] syzkaller0: entered promiscuous mode [ 133.934696][ T6327] syzkaller0: entered allmulticast mode [ 135.403877][ T6355] warning: `syz.1.100' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 136.145820][ T6356] hub 8-0:1.0: USB hub found [ 136.161244][ T6356] hub 8-0:1.0: 1 port detected [ 137.116407][ T6365] syzkaller0: entered promiscuous mode [ 137.129365][ T6365] syzkaller0: entered allmulticast mode [ 138.784993][ T6384] syzkaller0: entered promiscuous mode [ 138.798582][ T6384] syzkaller0: entered allmulticast mode [ 140.571372][ T6400] loop3: detected capacity change from 0 to 128 [ 140.587398][ T6400] ======================================================= [ 140.587398][ T6400] WARNING: The mand mount option has been deprecated and [ 140.587398][ T6400] and is ignored by this kernel. Remove the mand [ 140.587398][ T6400] option from the mount to silence this warning. [ 140.587398][ T6400] ======================================================= [ 140.812286][ T6400] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 140.830557][ T6400] hpfs: filesystem error: improperly stopped [ 140.840910][ T6400] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 140.852057][ T6400] hpfs: You really don't want any checks? You are crazy... [ 140.861140][ T6400] hpfs: Code page directory magic doesn't match (magic = 7b3184b5) [ 140.870531][ T6400] hpfs: code page support is disabled [ 140.884174][ T6400] hpfs: hpfs_map_4sectors(): unaligned read [ 140.891193][ T6400] hpfs: hpfs_map_4sectors(): unaligned read [ 140.897206][ T6400] hpfs: filesystem error: unable to find root dir [ 141.266156][ T6401] loop1: detected capacity change from 0 to 512 [ 141.373648][ T6401] EXT4-fs: Ignoring removed oldalloc option [ 141.649386][ T6405] netlink: 4 bytes leftover after parsing attributes in process `syz.2.113'. [ 143.583004][ T6401] fscrypt: Error allocating hmac(sha512): -2 [ 145.382222][ T6421] loop1: detected capacity change from 0 to 64 [ 145.445552][ T6421] syz.1.117: attempt to access beyond end of device [ 145.445552][ T6421] loop1: rw=0, sector=1024, nr_sectors = 2 limit=64 [ 145.544660][ T6421] Buffer I/O error on dev loop1, logical block 512, async page read [ 145.917448][ T6421] syz.1.117: attempt to access beyond end of device [ 145.917448][ T6421] loop1: rw=0, sector=113152, nr_sectors = 2 limit=64 [ 146.386534][ T6421] Buffer I/O error on dev loop1, logical block 56576, async page read [ 147.438989][ T6431] syz.0.121: attempt to access beyond end of device [ 147.438989][ T6431] nbd0: rw=0, sector=1, nr_sectors = 1 limit=0 [ 147.456238][ T6431] qnx4: unable to read the superblock [ 147.565156][ T6433] loop1: detected capacity change from 0 to 512 [ 147.794057][ T6433] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 147.909144][ T6433] ext4 filesystem being mounted at /33/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 150.002404][ T6433] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 15: comm syz.1.122: lblock 2 mapped to illegal pblock 15 (length 1) [ 150.150208][ T6433] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 150.162653][ T6433] EXT4-fs error (device loop1): ext4_write_dquot:6933: comm syz.1.122: Failed to commit dquot type 0 [ 150.232100][ T6433] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #4: block 19: comm syz.1.122: lblock 2 mapped to illegal pblock 19 (length 1) [ 150.318996][ T6433] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 150.395965][ T6433] EXT4-fs error (device loop1): ext4_write_dquot:6933: comm syz.1.122: Failed to commit dquot type 1 [ 150.470100][ T6433] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Out of memory [ 150.538993][ T6433] EXT4-fs error (device loop1): ext4_dirty_inode:6144: inode #18: comm syz.1.122: mark_inode_dirty error [ 150.589099][ T6433] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 15: comm syz.1.122: lblock 2 mapped to illegal pblock 15 (length 1) [ 150.648570][ T6433] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 150.679296][ T6433] EXT4-fs error (device loop1): ext4_write_dquot:6933: comm syz.1.122: Failed to commit dquot type 0 [ 150.742240][ T6433] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #4: block 19: comm syz.1.122: lblock 2 mapped to illegal pblock 19 (length 1) [ 150.841677][ T6433] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 150.869222][ T6433] EXT4-fs error (device loop1): ext4_write_dquot:6933: comm syz.1.122: Failed to commit dquot type 1 [ 151.129373][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 151.630853][ T6454] loop2: detected capacity change from 0 to 128 [ 152.162830][ T6459] ubi16: attaching mtd0 [ 152.192821][ T6459] ubi16: scanning is finished [ 152.204591][ T6459] ubi16: empty MTD device detected [ 153.377907][ T6459] ubi16 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt16d", error -4 [ 156.372069][ T6478] bridge0: port 2(bridge_slave_1) entered disabled state [ 156.384776][ T6478] bridge0: port 1(bridge_slave_0) entered disabled state [ 156.421522][ T6478] bridge0: entered allmulticast mode [ 156.621665][ T6481] bridge_slave_1: left allmulticast mode [ 157.371822][ T6481] bridge_slave_1: left promiscuous mode [ 157.399322][ T6481] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.445075][ T6481] bridge_slave_0: left allmulticast mode [ 157.484415][ T6481] bridge_slave_0: left promiscuous mode [ 157.533198][ T6481] bridge0: port 1(bridge_slave_0) entered disabled state [ 158.440526][ T6486] slcan: can't register candev [ 158.464361][ T6486] Falling back ldisc for ttyS3. [ 158.653907][ T6494] tipc: Started in network mode [ 158.667795][ T6494] tipc: Node identity 6243116d8ebb, cluster identity 4711 [ 158.713269][ T6494] tipc: Enabled bearer , priority 0 [ 158.732719][ T6497] syzkaller0: entered promiscuous mode [ 158.747358][ T6497] syzkaller0: entered allmulticast mode [ 158.836842][ T6494] tipc: Resetting bearer [ 158.850834][ T6493] tipc: Resetting bearer [ 158.869742][ T6493] tipc: Disabling bearer [ 160.276502][ T6527] syzkaller0: entered promiscuous mode [ 160.288374][ T6527] syzkaller0: entered allmulticast mode [ 160.661321][ T6532] loop2: detected capacity change from 0 to 1024 [ 160.892456][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 160.916280][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 160.958552][ T6536] hfsplus: request for non-existent node 33423360 in B*Tree [ 160.976265][ T6536] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.047024][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.062862][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.394336][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.490546][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.723067][ T6536] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.767940][ T6536] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.840814][ T6539] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.849284][ T6543] fuse: Bad value for 'fd' [ 161.876945][ T6539] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.936776][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 161.998106][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 163.172766][ T6536] hfsplus: request for non-existent node 33423360 in B*Tree [ 163.208734][ T6536] hfsplus: request for non-existent node 33423360 in B*Tree [ 163.327846][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 163.348509][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 163.426098][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 163.456874][ T6532] hfsplus: request for non-existent node 33423360 in B*Tree [ 163.482993][ T6553] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 163.492344][ T6536] hfsplus: request for non-existent node 33423360 in B*Tree [ 163.504280][ T6536] hfsplus: request for non-existent node 33423360 in B*Tree [ 163.860606][ T6561] loop3: detected capacity change from 0 to 4096 [ 163.883940][ T6561] ntfs: (device loop3): parse_options(): Invalid mft_zone_multiplier. Using default value, i.e. 1. [ 163.917080][ T6561] ntfs: volume version 3.1. [ 164.094915][ T6561] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0x6, attribute type 0x80, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 164.214400][ T6565] loop2: detected capacity change from 0 to 32768 [ 164.239069][ T6565] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop2 scanned by syz.2.159 (6565) [ 164.319910][ T6561] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0x6, attribute type 0x80, vcn 0x0, offset 0x800 because its location on disk could not be determined even after retrying (error code -5). [ 165.008748][ T6565] BTRFS info (device loop2): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 165.020260][ T6565] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 165.030353][ T6565] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 165.040105][ T6565] BTRFS info (device loop2): use lzo compression, level 0 [ 165.047367][ T6565] BTRFS info (device loop2): force clearing of disk cache [ 165.054622][ T6565] BTRFS info (device loop2): using free space tree [ 165.066374][ T6561] ntfs: (device loop3): ntfs_cluster_alloc(): Failed to map page. [ 165.098298][ T6561] ntfs: (device loop3): ntfs_cluster_alloc(): Failed to allocate clusters, aborting (error -5). [ 165.158434][ T6561] ntfs: (device loop3): ntfs_attr_extend_allocation(): Cannot extend allocation of inode 0x44, attribute type 0x80, because the allocation of clusters failed with error code -5. [ 165.258888][ T6565] BTRFS info (device loop2): enabling ssd optimizations [ 165.265986][ T6565] BTRFS info (device loop2): auto enabling async discard [ 165.278912][ T6565] BTRFS info (device loop2): rebuilding free space tree [ 166.023516][ T6595] syz.2.159 (6595) used greatest stack depth: 20072 bytes left [ 166.403796][ T5773] BTRFS info (device loop2): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 167.663651][ T6607] syz.1.166 (6607): drop_caches: 2 [ 169.831710][ T6628] syzkaller0: entered promiscuous mode [ 169.842878][ T6628] syzkaller0: entered allmulticast mode [ 170.116482][ T6637] syzkaller0: entered promiscuous mode [ 170.159640][ T6637] syzkaller0: entered allmulticast mode [ 170.727347][ T6649] loop2: detected capacity change from 0 to 16 [ 170.784961][ T6649] erofs: (device loop2): mounted with root inode @ nid 36. [ 171.089345][ T6653] syz.2.176: attempt to access beyond end of device [ 171.089345][ T6653] loop2: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 171.190339][ T6653] syz.2.176: attempt to access beyond end of device [ 171.190339][ T6653] loop2: rw=0, sector=8, nr_sectors = 16 limit=16 [ 173.657065][ T6678] netlink: 12 bytes leftover after parsing attributes in process `syz.2.184'. [ 183.130836][ T6739] Bluetooth: MGMT ver 1.22 [ 185.298411][ T5862] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 185.500197][ T5862] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 185.518398][ T5862] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 185.549413][ T5862] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 185.559204][ T5862] usb 4-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 185.578515][ T5862] usb 4-1: Product: syz [ 185.592714][ T5862] usb 4-1: config 0 descriptor?? [ 185.640495][ T5862] hub 4-1:0.0: USB hub found [ 186.234472][ T5862] hub 4-1:0.0: 1 port detected [ 187.594601][ T5862] hub 4-1:0.0: activate --> -90 [ 188.525081][ T5862] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 188.769147][ T5862] usb 4-1-port1: connect-debounce failed [ 188.802783][ T5842] usb 4-1: USB disconnect, device number 4 [ 188.809525][ T5862] usb 4-1: Failed to suspend device, error -19 [ 193.728410][ T27] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 194.256274][ T27] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 194.299696][ T27] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 194.330812][ T27] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 194.360602][ T27] usb 3-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 194.374897][ T27] usb 3-1: Product: syz [ 194.401986][ T27] usb 3-1: config 0 descriptor?? [ 194.420522][ T27] hub 3-1:0.0: USB hub found [ 194.593910][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.604912][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.658869][ T27] hub 3-1:0.0: 1 port detected [ 195.203150][ T6825] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 195.243598][ T6825] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 195.340944][ T55] hub 3-1:0.0: activate --> -90 [ 195.821870][ T55] hub 3-1:0.0: hub_ext_port_status failed (err = -71) [ 195.833191][ T55] usb 3-1: Failed to suspend device, error -71 [ 195.834883][ T5827] usb 3-1: USB disconnect, device number 2 [ 196.298023][ T6825] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.307274][ T6825] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.379934][ T6825] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.398393][ T6825] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.602167][ T6832] IPv6: NLM_F_CREATE should be specified when creating new route [ 196.767782][ T6841] capability: warning: `syz.0.228' uses 32-bit capabilities (legacy support in use) [ 197.200510][ T6843] syzkaller0: entered promiscuous mode [ 197.226434][ T6843] syzkaller0: entered allmulticast mode [ 203.659469][ T6877] loop3: detected capacity change from 0 to 64 [ 211.465822][ T6914] netlink: 48 bytes leftover after parsing attributes in process `syz.0.249'. [ 212.560396][ T28] audit: type=1800 audit(1787631938.347:2): pid=6913 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.247" name="attr_qid_max" dev="configfs" ino=10470 res=0 errno=0 [ 212.593283][ T6919] Zero length message leads to an empty skb [ 214.406944][ T6930] netlink: 12 bytes leftover after parsing attributes in process `syz.1.251'. [ 222.862304][ T6983] syzkaller0: entered promiscuous mode [ 222.888373][ T6983] syzkaller0: entered allmulticast mode [ 222.923678][ T6983] tipc: Enabled bearer , priority 0 [ 222.973370][ T6983] tipc: Resetting bearer [ 222.994885][ T6982] tipc: Resetting bearer [ 223.078977][ T6982] tipc: Disabling bearer [ 223.307576][ T6981] Set syz1 is full, maxelem 6117 reached [ 223.459482][ T6991] sd 0:0:1:0: PR command failed: 1026 [ 223.465234][ T6991] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 223.472281][ T6991] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 234.098578][ T5827] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 234.300986][ T5827] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 234.311150][ T5827] usb 2-1: config 0 has no interface number 0 [ 234.317257][ T5827] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 234.348243][ T5827] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 234.376515][ T5827] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 234.410561][ T5827] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.455103][ T5827] usb 2-1: config 0 descriptor?? [ 234.692623][ T5827] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 235.069556][ T7062] netlink: 4 bytes leftover after parsing attributes in process `syz.0.279'. [ 235.189463][ T5827] usb 2-1: USB disconnect, device number 2 [ 239.138599][ T27] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 239.358434][ T27] usb 4-1: Using ep0 maxpacket: 16 [ 239.380136][ T27] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 239.409100][ T27] usb 4-1: config 0 has no interface number 0 [ 239.455518][ T27] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 239.475052][ T27] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.483926][ T27] usb 4-1: Product: syz [ 239.493181][ T27] usb 4-1: Manufacturer: syz [ 239.499146][ T27] usb 4-1: SerialNumber: syz [ 239.540386][ T27] usb 4-1: config 0 descriptor?? [ 239.575834][ T27] hub 4-1:0.132: bad descriptor, ignoring hub [ 239.597696][ T27] hub: probe of 4-1:0.132 failed with error -5 [ 239.621234][ T27] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.132/input/input5 [ 242.332357][ T27] usb 4-1: USB disconnect, device number 5 [ 244.452207][ T28] audit: type=1800 audit(1787631971.327:3): pid=7135 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.305" name="pnp_string" dev="configfs" ino=10856 res=0 errno=0 [ 245.714978][ T7145] bond0: (slave bond_slave_0): Releasing backup interface [ 247.483735][ T7145] bond0: (slave bond_slave_1): Releasing backup interface [ 247.596678][ T7145] team0: Port device team_slave_0 removed [ 247.604997][ T7145] team0: Port device team_slave_1 removed [ 247.611657][ T7145] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 247.628631][ T7145] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 248.133293][ T7153] netlink: 'syz.3.310': attribute type 10 has an invalid length. [ 248.347021][ T7159] loop1: detected capacity change from 0 to 64 [ 256.483901][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.538360][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 260.938788][ T7224] syzkaller0: entered promiscuous mode [ 260.958506][ T7224] syzkaller0: entered allmulticast mode [ 265.264632][ T7263] autofs4:pid:7263:autofs_fill_super: called with bogus options [ 265.437582][ T7264] loop2: detected capacity change from 0 to 2048 [ 265.680208][ T7264] Alternate GPT is invalid, using primary GPT. [ 265.687793][ T7264] loop2: p2 p3 p7 [ 266.233103][ T7222] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 266.395892][ T7222] udevd[7222]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 266.406555][ T7275] udevd[7275]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 266.463877][ T7277] udevd[7277]: inotify_add_watch(7, /dev/loop2p7, 10) failed: No such file or directory [ 266.846647][ T7285] MTD: Couldn't look up './dev/mtdblock0': -2 [ 273.019204][ T7345] syzkaller0: entered promiscuous mode [ 273.045754][ T7345] syzkaller0: entered allmulticast mode [ 273.750886][ T7345] tipc: Started in network mode [ 273.910895][ T7345] tipc: Node identity b67c4444a097, cluster identity 4711 [ 274.160997][ T7345] tipc: Enabled bearer , priority 0 [ 274.223300][ T7352] tipc: Resetting bearer [ 275.235817][ T7343] tipc: Resetting bearer [ 276.108876][ T7343] tipc: Disabling bearer [ 276.274503][ T5862] tipc: Node number set to 384517188 [ 279.039809][ T7384] hfsplus: unable to find HFS+ superblock [ 279.078847][ T28] audit: type=1326 audit(1787632005.957:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7380 comm="syz.3.366" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe96f99e0d9 code=0x0 [ 280.270608][ T28] audit: type=1326 audit(1787632007.147:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7378 comm="syz.1.365" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f490cd9e0d9 code=0x7fc00000 [ 280.982020][ T7407] loop1: detected capacity change from 0 to 64 [ 280.990739][ T7405] syzkaller0: entered promiscuous mode [ 280.996597][ T7405] syzkaller0: entered allmulticast mode [ 281.109616][ T7404] syzkaller0: entered promiscuous mode [ 281.115339][ T7404] syzkaller0: entered allmulticast mode [ 281.149538][ T7405] tipc: Started in network mode [ 281.157841][ T7405] tipc: Node identity d66953b0051e, cluster identity 4711 [ 281.180175][ T7405] tipc: Enabled bearer , priority 0 [ 281.222090][ T7404] tipc: Enabled bearer , priority 0 [ 281.290961][ T7405] tipc: Resetting bearer [ 281.308847][ T7404] tipc: Resetting bearer [ 282.002759][ T7402] tipc: Resetting bearer [ 284.320304][ T7402] tipc: Disabling bearer [ 284.357820][ T7403] tipc: Resetting bearer [ 284.425098][ T7403] tipc: Disabling bearer [ 284.461912][ T174] tipc: Node number set to 3547812784 [ 289.538863][ T55] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 289.759526][ T55] usb 4-1: Using ep0 maxpacket: 16 [ 289.785323][ T55] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 289.812054][ T55] usb 4-1: config 0 has no interface number 0 [ 289.842336][ T55] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 289.856498][ T55] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.865260][ T55] usb 4-1: Product: syz [ 289.872177][ T55] usb 4-1: Manufacturer: syz [ 290.629339][ T55] usb 4-1: SerialNumber: syz [ 290.637293][ T55] usb 4-1: config 0 descriptor?? [ 290.652485][ T7457] loop2: detected capacity change from 0 to 512 [ 290.665932][ T7457] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 290.694114][ T55] hub 4-1:0.132: bad descriptor, ignoring hub [ 290.706329][ T7457] EXT4-fs error (device loop2): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 290.724532][ T7457] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.384: corrupted inode contents [ 290.741345][ T55] hub: probe of 4-1:0.132 failed with error -5 [ 290.747615][ T7457] EXT4-fs error (device loop2): ext4_dirty_inode:6144: inode #11: comm syz.2.384: mark_inode_dirty error [ 290.762370][ T7457] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.384: invalid indirect mapped block 1 (level 1) [ 290.779645][ T55] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.132/input/input6 [ 290.789203][ T7457] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.384: corrupted inode contents [ 290.805142][ T7457] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 290.821117][ T7457] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.384: corrupted inode contents [ 290.837142][ T7457] EXT4-fs error (device loop2): ext4_truncate:4302: inode #11: comm syz.2.384: mark_inode_dirty error [ 290.848334][ C1] vxcan0: j1939_tp_rxtimer: 0xffff88805e860400: rx timeout, send abort [ 290.851354][ C1] vxcan0: j1939_xtp_rx_abort_one: 0xffff88805e860400: 0x0f000: (3) A timeout occurred and this is the connection abort to close the session. [ 290.990666][ T7457] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 291.000450][ T7457] EXT4-fs (loop2): 1 truncate cleaned up [ 291.008987][ T7457] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 293.189695][ T5862] usb 4-1: USB disconnect, device number 6 [ 293.221804][ T5773] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 296.273737][ T7500] loop3: detected capacity change from 0 to 128 [ 299.619679][ T27] IPVS: starting estimator thread 0... [ 300.949828][ T7521] IPVS: using max 17 ests per chain, 40800 per kthread [ 302.574577][ T7537] netlink: 32 bytes leftover after parsing attributes in process `syz.1.407'. [ 303.219228][ T7540] loop1: detected capacity change from 0 to 512 [ 303.257102][ T7540] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #16: comm syz.1.408: invalid indirect mapped block 4294967295 (level 0) [ 303.299784][ T7540] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #16: comm syz.1.408: invalid indirect mapped block 4294967295 (level 1) [ 303.368250][ T7540] EXT4-fs (loop1): 1 orphan inode deleted [ 303.374068][ T7540] EXT4-fs (loop1): 1 truncate cleaned up [ 303.409564][ T7540] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 307.677990][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 314.599744][ T7610] loop3: detected capacity change from 0 to 512 [ 315.073808][ T7610] EXT4-fs error (device loop3): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 315.088371][ T7610] EXT4-fs error (device loop3): ext4_do_update_inode:5256: inode #11: comm syz.3.427: corrupted inode contents [ 315.100532][ T7610] EXT4-fs error (device loop3): ext4_dirty_inode:6144: inode #11: comm syz.3.427: mark_inode_dirty error [ 315.112217][ T7610] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.427: invalid indirect mapped block 1 (level 1) [ 315.125738][ T7610] EXT4-fs error (device loop3): ext4_do_update_inode:5256: inode #11: comm syz.3.427: corrupted inode contents [ 315.137841][ T7610] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 315.146817][ T7610] EXT4-fs error (device loop3): ext4_do_update_inode:5256: inode #11: comm syz.3.427: corrupted inode contents [ 315.162485][ T7610] EXT4-fs error (device loop3): ext4_truncate:4302: inode #11: comm syz.3.427: mark_inode_dirty error [ 315.178862][ T7610] EXT4-fs error (device loop3) in ext4_process_orphan:345: Corrupt filesystem [ 315.188269][ T7610] EXT4-fs (loop3): 1 truncate cleaned up [ 315.194615][ T7610] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 316.194748][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.565193][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.573705][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.769621][ T7633] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 318.772353][ T7657] loop1: detected capacity change from 0 to 128 [ 319.587219][ T7664] loop1: detected capacity change from 0 to 64 [ 324.497525][ T7691] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 329.338064][ T7717] netlink: 32 bytes leftover after parsing attributes in process `syz.1.448'. [ 333.550506][ T7745] loop1: detected capacity change from 0 to 1024 [ 334.028047][ T7745] hfsplus: detected inconsistent attributes file, running fsck.hfsplus is recommended. [ 344.005469][ T7802] loop2: detected capacity change from 0 to 128 [ 349.928277][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 351.230593][ T5777] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 351.242106][ T5777] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 351.251130][ T5777] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 351.261866][ T5777] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 351.272764][ T5777] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 351.289685][ T5777] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 351.341116][ T5779] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 351.354351][ T5779] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 351.362741][ T5779] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 351.373418][ T5779] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 351.392442][ T5779] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 351.401982][ T5779] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 352.207213][ T7843] chnl_net:caif_netlink_parms(): no params data found [ 352.308487][ T7853] overlayfs: missing 'lowerdir' [ 352.461308][ T11] tipc: Left network mode [ 352.462176][ T7843] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.484853][ T7843] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.492251][ T7843] bridge_slave_0: entered allmulticast mode [ 352.500851][ T7843] bridge_slave_0: entered promiscuous mode [ 352.517853][ T7843] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.535532][ T7843] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.547993][ T7843] bridge_slave_1: entered allmulticast mode [ 352.560308][ T7843] bridge_slave_1: entered promiscuous mode [ 352.711128][ T7859] loop1: detected capacity change from 0 to 1024 [ 352.793124][ T7859] hfsplus: detected inconsistent attributes file, running fsck.hfsplus is recommended. [ 353.460633][ T5779] Bluetooth: hci2: command tx timeout [ 353.927220][ T7843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 354.626534][ T7876] overlayfs: failed to clone upperpath [ 354.651398][ T7843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 356.126448][ T5779] Bluetooth: hci2: command tx timeout [ 356.176158][ T7843] team0: Port device team_slave_0 added [ 356.247164][ T7843] team0: Port device team_slave_1 added [ 357.402561][ T7886] Mass Storage Function, version: 2009/09/11 [ 357.428904][ T7886] LUN: removable file: (no medium) [ 357.454406][ T28] audit: type=1800 audit(1787632084.337:6): pid=7886 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.496" name="cdrom" dev="configfs" ino=14349 res=0 errno=0 [ 357.579230][ T7843] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 357.586241][ T7843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 357.654306][ T7843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 357.685243][ T7843] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 357.703812][ T7843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 357.795780][ T7843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 358.178735][ T5779] Bluetooth: hci2: command tx timeout [ 358.843656][ T7843] hsr_slave_0: entered promiscuous mode [ 358.867816][ T7843] hsr_slave_1: entered promiscuous mode [ 358.888637][ T7843] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 358.898288][ T7843] Cannot create hsr debugfs directory [ 360.258790][ T5779] Bluetooth: hci2: command tx timeout [ 362.144140][ T7920] gadgetfs: bound to dummy_udc driver [ 362.153941][ T11] hsr_slave_0: left promiscuous mode [ 362.163793][ T11] hsr_slave_1: left promiscuous mode [ 367.856731][ T7947] (null): rxe_set_mtu: Set mtu to 4096 [ 368.099352][ T11] bond0 (unregistering): Released all slaves [ 368.230349][ T7947] lo speed is unknown, defaulting to 1000 [ 368.242939][ T7947] lo speed is unknown, defaulting to 1000 [ 368.252118][ T7947] lo speed is unknown, defaulting to 1000 [ 368.428427][ T7947] infiniband syz1: set active [ 368.433586][ T7947] infiniband syz1: added lo [ 368.528893][ T7947] RDS/IB: syz1: added [ 368.535437][ T7947] smc: adding ib device syz1 with port count 1 [ 368.542149][ T7947] smc: ib device syz1 port 1 has pnetid [ 368.597041][ T5862] lo speed is unknown, defaulting to 1000 [ 368.608004][ T7947] lo speed is unknown, defaulting to 1000 [ 368.878702][ T5842] lo speed is unknown, defaulting to 1000 [ 368.893802][ T7947] lo speed is unknown, defaulting to 1000 [ 369.108709][ T7947] lo speed is unknown, defaulting to 1000 [ 369.114708][ T7843] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 369.347289][ T7843] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 369.416736][ T7947] lo speed is unknown, defaulting to 1000 [ 369.460109][ T7843] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 369.514148][ T7843] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 370.052545][ T7843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 370.170258][ T7843] 8021q: adding VLAN 0 to HW filter on device team0 [ 370.899626][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.907835][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.004351][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.011566][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.998522][ T7977] se_device not configured yet, cannot port link [ 372.004244][ T5842] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 372.190450][ T5842] usb 3-1: Using ep0 maxpacket: 8 [ 372.214569][ T5842] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 372.258730][ T5842] usb 3-1: config 0 has no interfaces? [ 372.264359][ T5842] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 372.269443][ T7843] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 372.300135][ T5842] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.336819][ T5842] usb 3-1: config 0 descriptor?? [ 372.509747][ T8003] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 372.518663][ T8003] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 374.082528][ T5842] usb 3-1: USB disconnect, device number 3 [ 375.920734][ T8026] Bluetooth: ISO socket layer initialized [ 378.287694][ T28] audit: type=1326 audit(1787632104.187:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8035 comm="syz.1.526" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f490cd9e0d9 code=0x7ffc0000 [ 378.488360][ T28] audit: type=1326 audit(1787632104.187:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8035 comm="syz.1.526" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f490cd9e0d9 code=0x7ffc0000 [ 378.567308][ T28] audit: type=1326 audit(1787632105.107:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8035 comm="syz.1.526" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f490cd9e0d9 code=0x7ffc0000 [ 378.638749][ T28] audit: type=1326 audit(1787632105.107:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8035 comm="syz.1.526" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f490cd9e0d9 code=0x7ffc0000 [ 378.681994][ T8049] loop1: detected capacity change from 0 to 128 [ 378.744803][ T7843] veth0_vlan: entered promiscuous mode [ 378.904008][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.911025][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.062598][ T7843] veth1_vlan: entered promiscuous mode [ 379.339388][ T7843] veth0_macvtap: entered promiscuous mode [ 379.376007][ T7843] veth1_macvtap: entered promiscuous mode [ 379.426375][ T7843] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 379.488735][ T7843] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.521564][ T7843] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 379.536093][ T7843] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.546716][ T7843] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 379.557640][ T7843] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.571498][ T7843] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 379.582344][ T7843] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 379.593348][ T7843] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.603592][ T7843] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 379.614662][ T7843] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.630881][ T7843] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 379.722925][ T7843] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.780099][ T7843] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 379.995882][ T7843] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.025749][ T7843] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.066967][ T7843] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.084847][ T7843] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.318941][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 380.515222][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 380.523333][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 380.538285][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 380.574245][ T9] usb 2-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 380.601701][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.618267][ T9] usb 2-1: Product: syz [ 380.622547][ T2933] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 380.623524][ T9] usb 2-1: Manufacturer: syz [ 380.636831][ T9] usb 2-1: SerialNumber: syz [ 380.642280][ T2933] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 380.663399][ T9] usb 2-1: config 0 descriptor?? [ 380.883525][ T9] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 380.898987][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 380.913136][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 380.935478][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 380.942028][ T8078] Bluetooth: hci0: invalid length 0, exp 2 for type 20 [ 380.948281][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 380.991489][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 381.197463][ T8082] loop4: detected capacity change from 0 to 32768 [ 381.209862][ T9] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 381.239825][ T9] usb 2-1: media controller created [ 381.291751][ T8082] XFS (loop4): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 381.507884][ T8091] dvb-usb: bulk message failed: -22 (7/0) [ 381.514165][ T8091] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 381.525170][ T8091] ttusb2: i2c transfer failed. [ 382.194774][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 382.219299][ T9] usb 2-1: selecting invalid altsetting 3 [ 382.225101][ T9] ttusb2: set interface to alts=3 failed [ 382.274799][ T8082] XFS (loop4): Ending clean mount [ 382.332485][ T8082] XFS (loop4): Quotacheck needed: Please wait. [ 382.346524][ T9] DVB: Unable to find symbol tda10086_attach() [ 382.385032][ T9] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 382.534703][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 382.550174][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 382.977157][ T8082] XFS (loop4): Quotacheck: Done. [ 383.741367][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 383.747126][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 383.786066][ T7843] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 383.821474][ T9] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 383.843745][ T9] usb 2-1: USB disconnect, device number 3 [ 383.945334][ T9] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 384.512387][ T5827] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 384.727684][ T5827] usb 3-1: Using ep0 maxpacket: 8 [ 384.787066][ T5827] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 384.900537][ T5827] usb 3-1: config 0 has no interfaces? [ 384.957974][ T28] audit: type=1800 audit(1787632111.807:11): pid=8127 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.537" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 384.988780][ T5827] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 385.072795][ T5827] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.241271][ T5827] usb 3-1: config 0 descriptor?? [ 386.440278][ T5827] usb 3-1: USB disconnect, device number 4 [ 388.456253][ T8141] netlink: 24 bytes leftover after parsing attributes in process `syz.1.545'. [ 388.585404][ T8141] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 388.592457][ T8141] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 388.603169][ T8141] vhci_hcd vhci_hcd.0: Device attached [ 388.818210][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 388.951476][ T8150] vhci_hcd: connection closed [ 388.993591][ T8149] loop4: detected capacity change from 0 to 512 [ 389.058887][ T145] vhci_hcd: stop threads [ 389.104219][ T145] vhci_hcd: release socket [ 389.156622][ T8149] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 389.238364][ T27] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 389.260040][ T145] vhci_hcd: disconnect device [ 389.310300][ T8153] loop2: detected capacity change from 0 to 512 [ 389.321487][ T27] usb 35-1: enqueue for inactive port 0 [ 389.358619][ T8153] EXT4-fs error (device loop2): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 389.373241][ T8153] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.547: corrupted inode contents [ 389.415415][ T8153] EXT4-fs error (device loop2): ext4_dirty_inode:6144: inode #11: comm syz.2.547: mark_inode_dirty error [ 389.428255][ T27] vhci_hcd: vhci_device speed not set [ 389.449656][ T8153] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.547: invalid indirect mapped block 1 (level 1) [ 389.469054][ T8153] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.547: corrupted inode contents [ 389.483869][ T8153] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 389.908214][ T8153] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.547: corrupted inode contents [ 389.928309][ T8147] FAT-fs (loop4): error, fat_free_clusters: deleting FAT entry beyond EOF [ 389.947114][ T8153] EXT4-fs error (device loop2): ext4_truncate:4302: inode #11: comm syz.2.547: mark_inode_dirty error [ 389.960145][ T8153] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 389.970464][ T8153] EXT4-fs (loop2): 1 truncate cleaned up [ 389.976896][ T8153] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 391.012003][ T8164] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 13: comm syz.2.547: bad entry in directory: directory entry too close to block end - offset=76, inode=16, rec_len=940, size=1024 fake=0 [ 391.034213][ C0] vkms_vblank_simulate: vblank timer overrun [ 392.522752][ T5773] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 392.529401][ T8177] xt_cgroup: invalid path, errno=-2 [ 392.596475][ T8178] comedi comedi0: comedi_config --init_data is deprecated [ 398.217547][ T8225] sctp: [Deprecated]: syz.2.564 (pid 8225) Use of int in maxseg socket option. [ 398.217547][ T8225] Use struct sctp_assoc_value instead [ 399.073651][ T8229] loop1: detected capacity change from 0 to 512 [ 399.088452][ T8229] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 399.125707][ T8231] gadgetfs: bound to dummy_udc driver [ 400.591757][ T8235] FAT-fs (loop1): error, fat_free_clusters: deleting FAT entry beyond EOF [ 401.786211][ T8251] loop1: detected capacity change from 0 to 512 [ 401.878838][ T8251] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.571: invalid indirect mapped block 28777 (level 2) [ 401.976700][ T8251] EXT4-fs (loop1): 1 truncate cleaned up [ 402.025175][ T8251] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 402.185250][ T8255] loop4: detected capacity change from 0 to 32768 [ 403.175898][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 403.255855][ T8255] XFS (loop4): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 403.454569][ T8255] XFS (loop4): Ending clean mount [ 403.520042][ T8255] XFS (loop4): Quotacheck needed: Please wait. [ 403.664573][ T8255] XFS (loop4): Quotacheck: Done. [ 405.172066][ T7843] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 405.184903][ T8289] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 407.958348][ T174] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 408.626091][ T8306] syz.1.582 (8306) used greatest stack depth: 19816 bytes left [ 408.729375][ T174] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 65535, setting to 64 [ 409.324933][ T174] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 409.336176][ T174] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 409.350443][ T174] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 409.359959][ T174] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.368065][ T174] usb 3-1: Product: syz [ 409.372392][ T174] usb 3-1: Manufacturer: syz [ 409.377015][ T174] usb 3-1: SerialNumber: syz [ 409.391500][ T174] cdc_mbim 3-1:1.0: skipping garbage [ 409.603260][ T8293] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 409.649978][ T8293] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 411.399795][ T174] cdc_mbim 3-1:1.0: bind() failure [ 411.457995][ T174] cdc_ncm: probe of 3-1:1.1 failed with error -71 [ 411.510441][ T174] cdc_mbim: probe of 3-1:1.1 failed with error -71 [ 411.541033][ T174] usbtest: probe of 3-1:1.1 failed with error -71 [ 411.570463][ T174] usb 3-1: USB disconnect, device number 5 [ 415.818720][ T8360] 9pnet_fd: Insufficient options for proto=fd [ 416.324694][ T8364] loop2: detected capacity change from 0 to 32768 [ 416.390058][ T8364] XFS (loop2): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 416.609068][ T8364] XFS (loop2): Ending clean mount [ 416.633698][ T8364] XFS (loop2): Quotacheck needed: Please wait. [ 416.723817][ T8386] loop4: detected capacity change from 0 to 512 [ 416.737885][ T8364] XFS (loop2): Quotacheck: Done. [ 416.763157][ T8386] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 417.507029][ T8391] FAT-fs (loop4): error, fat_free_clusters: deleting FAT entry beyond EOF [ 417.533762][ T5773] XFS (loop2): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 417.544599][ T28] audit: type=1800 audit(1787632144.427:12): pid=8390 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.599" name="ifname" dev="configfs" ino=16175 res=0 errno=0 [ 419.869659][ T8400] netlink: 80 bytes leftover after parsing attributes in process `syz.0.601'. [ 421.331470][ T8404] comedi comedi3: pcl818: I/O port conflict (0x6,16) [ 421.348479][ T5842] IPVS: starting estimator thread 0... [ 422.818263][ T8412] IPVS: using max 34 ests per chain, 81600 per kthread [ 422.916339][ T8419] loop1: detected capacity change from 0 to 512 [ 422.957806][ T8419] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.606: invalid indirect mapped block 28777 (level 2) [ 422.999116][ T8419] EXT4-fs (loop1): 1 truncate cleaned up [ 423.006120][ T8419] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 423.542058][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 426.478337][ T8453] overlayfs: failed to clone upperpath [ 426.720083][ T8459] loop4: detected capacity change from 0 to 512 [ 426.758804][ T8459] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.616: invalid indirect mapped block 28777 (level 2) [ 426.900244][ T8459] EXT4-fs (loop4): 1 truncate cleaned up [ 426.907788][ T8459] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 427.642332][ T7843] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 427.839565][ T8466] loop2: detected capacity change from 0 to 512 [ 427.890257][ T8466] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 429.262157][ T28] audit: type=1800 audit(1787632156.137:13): pid=8471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.617" name="file1" dev="loop2" ino=1048628 res=0 errno=0 [ 429.293083][ T8471] FAT-fs (loop2): error, fat_free_clusters: deleting FAT entry beyond EOF [ 429.733067][ T8481] configfs-gadget.g1 gadget.0: HOST MAC 3e:09:da:ce:a4:14 [ 429.740692][ T8481] configfs-gadget.g1 gadget.0: MAC d6:b1:27:a3:c6:7c [ 430.048236][ T5842] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 430.861815][ T5842] usb 1-1: Dual-Role OTG device on HNP port [ 430.878593][ T5842] usb 1-1: New USB device found, idVendor=1234, idProduct=a4a1, bcdDevice= 6.06 [ 430.894653][ T5842] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.917286][ T8499] [ 430.919636][ T8499] ====================================================== [ 430.926722][ T8499] WARNING: possible circular locking dependency detected [ 430.933815][ T8499] syzkaller #0 Not tainted [ 430.938209][ T8499] ------------------------------------------------------ [ 430.945201][ T8499] syz.2.623/8499 is trying to acquire lock: [ 430.951068][ T8499] ffffffff8ddf6c50 (gadget_subsys.su_mutex){+.+.}-{3:3}, at: uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 430.963798][ T8499] [ 430.963798][ T8499] but task is already holding lock: [ 430.971139][ T8499] ffff888022e0c578 (&p->frag_sem){++++}-{3:3}, at: configfs_write_iter+0x215/0x400 [ 430.980502][ T8499] [ 430.980502][ T8499] which lock already depends on the new lock. [ 430.980502][ T8499] [ 430.990883][ T8499] [ 430.990883][ T8499] the existing dependency chain (in reverse order) is: [ 430.999871][ T8499] [ 430.999871][ T8499] -> #3 (&p->frag_sem){++++}-{3:3}: [ 431.007236][ T8499] down_write_killable+0xa7/0x230 [ 431.012857][ T8499] configfs_rmdir+0x3e4/0x980 [ 431.018048][ T8499] vfs_rmdir+0x352/0x4b0 [ 431.022820][ T8499] do_rmdir+0x29f/0x590 [ 431.027475][ T8499] __x64_sys_unlinkat+0xc4/0xe0 [ 431.032836][ T8499] do_syscall_64+0x55/0xb0 [ 431.037791][ T8499] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 431.044258][ T8499] [ 431.044258][ T8499] -> #2 (&sb->s_type->i_mutex_key#26){++++}-{3:3}: [ 431.052927][ T8499] down_write+0x97/0x200 [ 431.057690][ T8499] configfs_depend_item_unlocked+0x157/0x430 [ 431.064172][ T8499] usbg_make_tpg+0x1f7/0x580 [ 431.069326][ T8499] target_fabric_make_tpg+0xa4/0x6d0 [ 431.075137][ T8499] configfs_mkdir+0x515/0x9e0 [ 431.080319][ T8499] vfs_mkdir+0x2a5/0x470 [ 431.085061][ T8499] do_mkdirat+0x1dc/0x450 [ 431.089896][ T8499] __x64_sys_mkdir+0x6e/0x80 [ 431.094984][ T8499] do_syscall_64+0x55/0xb0 [ 431.099903][ T8499] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 431.106301][ T8499] [ 431.106301][ T8499] -> #1 (&opts->dep_lock){+.+.}-{3:3}: [ 431.113940][ T8499] __mutex_lock+0x135/0xc80 [ 431.118953][ T8499] tcm_set_name+0x2a/0x90 [ 431.123789][ T8499] function_make+0x199/0x350 [ 431.128903][ T8499] configfs_mkdir+0x515/0x9e0 [ 431.134085][ T8499] vfs_mkdir+0x2a5/0x470 [ 431.138831][ T8499] do_mkdirat+0x1dc/0x450 [ 431.143663][ T8499] __x64_sys_mkdir+0x6e/0x80 [ 431.148756][ T8499] do_syscall_64+0x55/0xb0 [ 431.153674][ T8499] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 431.160071][ T8499] [ 431.160071][ T8499] -> #0 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 431.168298][ T8499] __lock_acquire+0x37ef/0x7d80 [ 431.173681][ T8499] lock_acquire+0x19e/0x420 [ 431.178684][ T8499] __mutex_lock+0x135/0xc80 [ 431.183692][ T8499] uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 431.191744][ T8499] configfs_write_iter+0x312/0x400 [ 431.197355][ T8499] vfs_write+0x474/0x9a0 [ 431.202108][ T8499] ksys_write+0x151/0x260 [ 431.206938][ T8499] do_syscall_64+0x55/0xb0 [ 431.211948][ T8499] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 431.218346][ T8499] [ 431.218346][ T8499] other info that might help us debug this: [ 431.218346][ T8499] [ 431.228555][ T8499] Chain exists of: [ 431.228555][ T8499] gadget_subsys.su_mutex --> &sb->s_type->i_mutex_key#26 --> &p->frag_sem [ 431.228555][ T8499] [ 431.242958][ T8499] Possible unsafe locking scenario: [ 431.242958][ T8499] [ 431.250383][ T8499] CPU0 CPU1 [ 431.255721][ T8499] ---- ---- [ 431.261062][ T8499] rlock(&p->frag_sem); [ 431.265283][ T8499] lock(&sb->s_type->i_mutex_key#26); [ 431.273256][ T8499] lock(&p->frag_sem); [ 431.279908][ T8499] lock(gadget_subsys.su_mutex); [ 431.284926][ T8499] [ 431.284926][ T8499] *** DEADLOCK *** [ 431.284926][ T8499] [ 431.293045][ T8499] 4 locks held by syz.2.623/8499: [ 431.298046][ T8499] #0: ffff88802f824348 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 [ 431.307290][ T8499] #1: ffff88801feba418 (sb_writers#19){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 [ 431.316235][ T8499] #2: ffff88802fec8688 (&buffer->mutex#2){+.+.}-{3:3}, at: configfs_write_iter+0x81/0x400 [ 431.326219][ T8499] #3: ffff888022e0c578 (&p->frag_sem){++++}-{3:3}, at: configfs_write_iter+0x215/0x400 [ 431.335937][ T8499] [ 431.335937][ T8499] stack backtrace: [ 431.341816][ T8499] CPU: 0 PID: 8499 Comm: syz.2.623 Not tainted syzkaller #0 [ 431.349091][ T8499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 431.359129][ T8499] Call Trace: [ 431.362388][ T8499] [ 431.365300][ T8499] dump_stack_lvl+0x18c/0x250 [ 431.369965][ T8499] ? load_image+0x420/0x420 [ 431.374471][ T8499] ? show_regs_print_info+0x20/0x20 [ 431.379653][ T8499] ? print_circular_bug+0x12b/0x1a0 [ 431.384843][ T8499] check_noncircular+0x2fc/0x400 [ 431.389763][ T8499] ? print_deadlock_bug+0x5d0/0x5d0 [ 431.394953][ T8499] ? lockdep_lock+0xf5/0x230 [ 431.399524][ T8499] ? _find_first_zero_bit+0xd6/0x100 [ 431.404821][ T8499] __lock_acquire+0x37ef/0x7d80 [ 431.409650][ T8499] ? verify_lock_unused+0x140/0x140 [ 431.414829][ T8499] ? verify_lock_unused+0x140/0x140 [ 431.420012][ T8499] ? mark_lock+0x94/0x320 [ 431.424339][ T8499] ? __lock_acquire+0x1336/0x7d80 [ 431.429360][ T8499] lock_acquire+0x19e/0x420 [ 431.433870][ T8499] ? uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 431.441586][ T8499] ? __might_sleep+0xe0/0xe0 [ 431.446193][ T8499] ? read_lock_is_recursive+0x20/0x20 [ 431.451552][ T8499] ? verify_lock_unused+0x140/0x140 [ 431.456735][ T8499] __mutex_lock+0x135/0xc80 [ 431.461225][ T8499] ? uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 431.468931][ T8499] ? __might_fault+0xaa/0x120 [ 431.473617][ T8499] ? __lock_acquire+0x7d80/0x7d80 [ 431.478630][ T8499] ? uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 431.486332][ T8499] ? mutex_lock_nested+0x20/0x20 [ 431.491253][ T8499] ? kstrtoull+0x130/0x1d0 [ 431.495652][ T8499] uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 431.503181][ T8499] ? uvcg_frame_dw_max_video_frame_buffer_size_show+0x180/0x180 [ 431.510797][ T8499] ? down_read+0x1ac/0x2e0 [ 431.515221][ T8499] configfs_write_iter+0x312/0x400 [ 431.520320][ T8499] ? uvcg_frame_dw_max_video_frame_buffer_size_show+0x180/0x180 [ 431.527951][ T8499] vfs_write+0x474/0x9a0 [ 431.532180][ T8499] ? file_end_write+0x250/0x250 [ 431.537013][ T8499] ? __fget_files+0x3fc/0x460 [ 431.541678][ T8499] ? __fdget_pos+0x2a3/0x330 [ 431.546271][ T8499] ? ksys_write+0x74/0x260 [ 431.550687][ T8499] ksys_write+0x151/0x260 [ 431.555008][ T8499] ? __ia32_sys_read+0x90/0x90 [ 431.559756][ T8499] ? lockdep_hardirqs_on+0x98/0x150 [ 431.564939][ T8499] do_syscall_64+0x55/0xb0 [ 431.569334][ T8499] ? clear_bhb_loop+0x40/0x90 [ 431.573992][ T8499] ? clear_bhb_loop+0x40/0x90 [ 431.578648][ T8499] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 431.584532][ T8499] RIP: 0033:0x7f09aab9e0d9 [ 431.588935][ T8499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 431.608523][ T8499] RSP: 002b:00007f09ab9a3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 431.616914][ T8499] RAX: ffffffffffffffda RBX: 00007f09aae25fa0 RCX: 00007f09aab9e0d9 [ 431.624954][ T8499] RDX: 0000000000000004 RSI: 00002000000006c0 RDI: 0000000000000007 [ 431.632907][ T8499] RBP: 00007f09aac35024 R08: 0000000000000000 R09: 0000000000000000 [ 431.640862][ T8499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 431.648815][ T8499] R13: 00007f09aae26038 R14: 00007f09aae25fa0 R15: 00007fff4c311708 [ 431.656771][ T8499] [ 431.665610][ T5842] usb 1-1: SerialNumber: 1234567890 [ 431.687505][ T8503] loop4: detected capacity change from 0 to 256 [ 431.734762][ T5842] usb-storage 1-1:1.0: USB Mass Storage device detected [ 431.758694][ T5842] scsi host1: usb-storage 1-1:1.0 [ 433.356191][ T5842] cdc_ether 1-1:1.1 usb1: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 3e:09:da:ce:a4:14 [ 433.394657][ T49] scsi 1:0:0:0: Direct-Access Linux File-Stor Gadget 0606 PQ: 0 ANSI: 2 [ 433.423042][ T5842] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 433.457548][ T49] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 433.460729][ T8512] sd 1:0:0:0: Power-on or device reset occurred [ 433.474796][ T8308] sd 1:0:0:0: [sdb] Media removed, stopped polling [ 433.552308][ T8308] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 440.341927][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.349864][ T1291] ieee802154 phy1 wpan1: encryption failed: -22