last executing test programs: 22.047329146s ago: executing program 1 (id=136): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(0x0, 0x0, 0x0, 0x2a05404, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee2, 0x8031, r0, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3) r5 = socket$inet6(0xa, 0x80802, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0xc2800) sendmmsg$inet6(r5, &(0x7f0000000340)=[{{&(0x7f0000000100)={0xa, 0x4e1e, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x1c000) 20.616477341s ago: executing program 1 (id=137): r0 = semget$private(0x0, 0x6, 0x1b5) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x10}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_dev$vcsa(&(0x7f0000000380), 0x7b95b611, 0x802) writev(r4, &(0x7f00000003c0)=[{&(0x7f00000001c0)}], 0x1) semtimedop(r0, &(0x7f0000000040)=[{0x0, 0x200, 0x800}], 0x1, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r5, 0x11c, 0x1, 0x0, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000200)=""/179, 0xb3) io_uring_setup(0x1196, &(0x7f0000000140)={0x0, 0xc8a1, 0x2, 0x1, 0x800000c1}) 19.274949623s ago: executing program 3 (id=139): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$unlink(0x9, 0x0, 0xfffffffffffffffd) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x9, 0x1, 0xa8}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x80) 17.535849065s ago: executing program 3 (id=140): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x6, 0x2, 0xeab, 0x7fffffff, 0xffff, 0x0, 0x5, 0x40, 0xfffffff8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtfilter={0xa8, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x5, 0x4}, {}, {0x8, 0xfffa}}, [@filter_kind_options=@f_matchall={{0xd}, {0x74, 0x2, [@TCA_MATCHALL_ACT={0x70, 0x2, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x30, 0x1, {0x2, 0x3, 0x1, 0x3ff, 0x7f, {0x3, 0x2, 0x400, 0xb2a, 0x1}, {0x9, 0x0, 0x3, 0x34e5, 0xc, 0x5}, 0x9, 0xfffffffd, 0x7}}]]}, {0xfedf}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r9, &(0x7f0000002900)={&(0x7f0000000500)=@xdp={0x2c, 0x8, r8, 0x109}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000380)="da", 0x1}], 0x1}, 0x20000885) 15.660059871s ago: executing program 1 (id=142): syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000008c0), 0x0, 0xcb, &(0x7f0000008000)={0x0, 0x989680}) close(0xffffffffffffffff) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) setsockopt$nfc_llcp_NFC_LLCP_MIUX(0xffffffffffffffff, 0x118, 0x1, &(0x7f0000000000)=0x40180, 0x4) ioctl$SNDRV_PCM_IOCTL_UNLINK(r0, 0x40044160, 0x3) 15.659812021s ago: executing program 0 (id=143): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00538507", @ANYRES16, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x9a4) 13.791611346s ago: executing program 0 (id=144): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) connect$inet6(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000240)={0x0, 0xd58c, 0x80, 0x2, 0x1e2}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x40, 0x1}) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000440)) 13.299954178s ago: executing program 2 (id=146): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000240)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, 0x0) symlinkat(&(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') symlinkat(&(0x7f0000000740)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000880)='dummy_udc.0\x00', 0xc) r1 = syz_open_dev$video(&(0x7f00000008c0), 0x0, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4010565a, &(0x7f0000000900)={0x8000004}) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r1, 0x4010565b, &(0x7f0000000940)={0x8000004}) close(r1) 13.072421133s ago: executing program 2 (id=148): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@typedef={0x3}]}, {0x0, [0x5f, 0x61, 0x5f]}}, 0x0, 0x29, 0x0, 0x1, 0xfffffffb}, 0x28) pipe(&(0x7f0000000000)) inotify_init1(0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0xf0) fanotify_init(0x4, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) socket$packet(0x11, 0x3, 0x300) socket$inet_sctp(0x2, 0x1, 0x84) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x111, 0x6}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r2, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 12.815690299s ago: executing program 2 (id=149): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x74, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x5c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0x4}]}, 0x74}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 11.334179795s ago: executing program 1 (id=150): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$unlink(0x9, 0x0, 0xfffffffffffffffd) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x9, 0x1, 0xa8}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x80) 11.333911895s ago: executing program 2 (id=151): r0 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r1 = getpgrp(0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) setrlimit(0xa, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000180)=0x1001) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x100000000c2, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$session_to_parent(0x12) fcntl$getownex(r0, 0x10, 0x0) 11.333662945s ago: executing program 3 (id=152): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$rtc(0xffffff9c, 0x0, 0xc2440, 0x0) unshare(0x4000400) r3 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, r3, 0x0, '\x00', 0x0, 0x0}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[], 0x48) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000ac0)={r4, r5}, 0xc) 11.332801885s ago: executing program 0 (id=153): r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000086a82, 0x0) r1 = dup(r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) socket(0x28, 0x801, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f00000003c0)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f0000000040)={r6, 0x9}, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x28011, r1, 0x3554000) 9.119874149s ago: executing program 2 (id=154): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = msgget$private(0x0, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3) msgsnd(r0, &(0x7f0000000340)=ANY=[], 0x2000, 0x0) msgrcv(r0, &(0x7f0000001080)={0x0, ""/1}, 0x2000, 0x2, 0x3000) msgctl$IPC_SET(r0, 0x1, &(0x7f00000004c0)={{0x0, 0xee00, 0x0, 0x0, 0x0, 0x0, 0xfffe}, 0x0, 0x0, 0xb, 0x6f76, 0x7, 0x0, 0x1, 0x8, 0x7f, 0x3, 0x0, r1}) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) sched_setscheduler(r3, 0x1, 0x0) 9.07203407s ago: executing program 3 (id=155): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x100) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = socket(0x10, 0x3, 0x0) write(r1, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071104200000000001d400500000000004704000001ed00000703000000000000cd440000000000006b0a00fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a107464ffffff7f00000000617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce963b0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c3f000000315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b47623028271722fb515f31e0dd115a292f1e68481a62cd15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc82300000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffee9}, 0x48) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000003c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) ioctl$FICLONE(r0, 0x40049409, 0xffffffffffffffff) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}, {@index_off}, {@nfs_export_on}]}) 7.374626001s ago: executing program 1 (id=156): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r3 = open$dir(&(0x7f0000000300)='./file2\x00', 0x48500, 0x80) mknodat(r3, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r4, &(0x7f0000001180)={0x2020}, 0x2020) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x7313}, [@call={0x85, 0x0, 0x0, 0x11}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 6.337104646s ago: executing program 0 (id=157): mknodat$loop(0xffffffffffffff9c, 0x0, 0x6004, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) syz_mount_image$squashfs(&(0x7f0000000200), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000002500)={[], [{@fowner_eq}, {@euid_lt}, {@fscontext={'fscontext', 0x3d, 'root'}}, {@smackfsdef={'smackfsdef', 0x3d, ','}}, {@euid_eq}]}, 0x1, 0x1d0, &(0x7f00000002c0)="$eJzKKC4sZmdgYPj7sSaZQYABDBgZeBguMDAysDAwMKgzQsQYmCDUeij/BZSeCZW2gfKbofRCKF1xS3vdmlN+Z0566motk2VmaPXUlkcWk0vtMXKTXMwjwcwQmnpkUXFlVXZiTk5qUfFChopbyUkVp08wsFy3v6bSLMHp8EeewyFJ00GH6YiPR9aMxhLOSVKaYmxsmQpnz3yQX8emcYTh0QrmjXWeeY11halT89LykqqyqrLmTZy4cWZjZ2Pjyol1UWl+qxhbUlw2NXUyMjlsURPYzGyoPslGe8K79lUPkxxYezz8mk8ZK71OZb5kvLBI6tSKqpkTvijNZjT8znCHp2yFhIaGk8QVCYsGE4YjdbYNriAnpjQwpCmEMSapsYm1bTkzJ4SZn81tgUJL8gmm0KMcS2dKWBwQqjr501LzrUOi24xtTx3YzvAcPs6zpqBP0Oi4BIPTQsH/MiBjEhoayjTWMi21XfClSOOvhNdqY6cMBnd7pmWwAGVpAJEr+SA8WbCehOQVHjqamkYpyQkNmyQSktwKDJUZtu7hXC3QwIAUbSoMDAzbGWFxCwHXYIxRMApGwSgYBaNgFIyCUTAKRsEoGAUjAgACAAD///qgmNg=") r1 = getpid() prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getpgrp(0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000000)=0x80000000000003) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout_data(r4, 0x107, 0x16, 0x0, 0x0) 6.336780686s ago: executing program 3 (id=158): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = getpid() r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r3, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r1}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040021}, 0x30) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x3c, r6, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x5}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48014}, 0x4000000) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000180)={0x0, "f1ffffffffff63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee04200", 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r7, &(0x7f0000000200)={0x80000000}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000000000"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 4.452044482s ago: executing program 0 (id=159): getsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bind$bt_rfcomm(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r4, 0x13) tkill(r4, 0x12) waitid(0x1, r4, 0x0, 0x8, &(0x7f00000003c0)) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000b00), &(0x7f0000000b40)=0x4) syz_mount_image$hfsplus(&(0x7f0000000200), &(0x7f0000000180)='./file1\x00', 0x4810, &(0x7f00000001c0)=ANY=[], 0x14, 0x693, &(0x7f0000000880)="$eJzs3c1vHGcdB/DvrNcvm0qO26ZpQJUwjVQQEYkdK4VwSUAIBalCVThwthqnseKkwXFR2gNxAYkrB/6AcggXOIEQEhJSpHKGW8XN4lQJiUtPaQ8MmtlZe+3u2ptXO/TziWaf55ln5pnf/OZlXyJrAnxuXTiR9t10cuHEa7eq9sadhZWNOwvXevUkk0laSbtbpLieFB8k59Od8oVqZjNcMWw7v14+e/HDjzc+6rba2RqveukMD7A9yl6sN1Nmk4w15UPYNt4bDzbe5Fa12MxMlbDjvcTBfhtPUm7z46NbPYOUY32Nodc78PQouu+bfbrX/0xyKMlU7w1tvdvZevIR7um+7kXrjy8OAAAAODAO37ud3Mr0fscBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAT5Pm+f9FM7V69dkUvef/T/Q9Y39in8MdbvfIpnqVu60nEQwAAAAAAAAAPF5fupffXSzL6V67LOr/83+5bhypX5/J27mZpazmZG5lMWtZy2rmk8z0DTRxa3FtbXW+t+anZVkOWfP0wDVPjxhw51HsNQAAAAAAAAD83zjXlD/LhUzvcywAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBNkYx1i3o60qvPpNVOMpVkolpuPflHr/40u7vfAQAAAMATcPhe7uVWpnvtsqi/8x+tv/dP5e1cz1qWs5aVLOVS/VtA91t/a+POwsrGnYVr1fTZcb/9n636H6f3DKMeMd3fHgZv+Vi9RCeXs1zPOZk38lZWcimtes3KsV48g+N6r4qpONdVlqMl6FJTVnv+q6Y8GGbqjIxvZmSuia3KxrO7Z6L/6DzAlubT2vzl58h95Pzcrlsp/ts7Jod6c5Jnvr93zsfva2ceys5MnO47+47unonkK3/6/Y+urFy/eqVYP3FwTqP7MPmvratmZyYW+jLx4siZuHzz6czETq28sFm/kO/lhzmR2bye1SznJ1nMWpYym+/WtcXmfK5eZ3bP1Pltrdf3imKiOS5jO2L68uFuuVtML9frTmc5P8hbuZSlvFr/O535fCNnciZn+47wCyNc9a0BV/2fhwd//KtNpZPkl015MFR5fbYvr/333Jm6r39OK+Vkd73nHtm9cVP7i02lOhI/b8qDYTMTU9l8l+hF93wvA+MDM/Gb+rZyc+X61dUrizd2jFusD97eK9m++wfnRlKdL89VB6tubT87qr7nB/bN131HNvtaO/t+29ns2+tKnWg+w312pNN134sD+xbqvmN9fVuftz4ty7L7eQuAA+/Q1w5NdP7d+Xvn/c4vOlc6r019Z/Kbky9NZPxv499qz4290nqp+EPez0+z9zd0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgTzffeffq4srK0uqOSlmWt4d0PZZK2sm2OX/9S98ySeqHAY0+YLX0+VZSz2mnqdxfYLcfbHfee9Ak/LM5Jk8k4Y+kMjX0/NlZ+aQsy4MR8yiVsnFQ4tmPyr7eloAn4NTatRunbr7z7teXry2+ufTm0vWzZ86cnTt75tWFU5eXV5bmuq/7HSXwOPR9AgcAAAAAAAAAAACeEqP9cU7xcH/bAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAQLpxI+26KzM+dnKvaG3cWVqqpV99a8pMkrSTFbFJ8kJxPd8pM33DFsO2sJxc//Hjjo26r3Uz18q3d1hvNejNlNslYUw4wNWhmeXvYeEU9zo3h442o2NzDKmHHe4mD/fa/AAAA///tbhq7") syz_mount_image$hfsplus(&(0x7f0000000600), &(0x7f00000004c0)='./file1\x00', 0x804c10, &(0x7f0000000280)=ANY=[], 0xfe, 0x669, &(0x7f0000000640)="$eJzs3c1vHGcdB/DvrDd2Ni3BTZM2oEq1GgkQFolf5IK5EBBCPlSoKgfOVuI0VjZpsV3kVog6vF576B9QDr4gTkjcIxUOXODWG/KxEhKXXjCnRTs7a6/XL10njb1pP59o9nmeeWae+T2/2Zl9saIN8IW1MJn6gxRZmHxlvd3e2pxtbm3O3u3Wk4wl2UjqSWpJiv+2Wq0Pk+tJsTNM0Vfu8/7y/GsffbL1cadVr5Zy+9pR+/WpttvoW73RXTeRZKQqH8Ge8W488njFTuTXk1ypSjh1Z5K09vjZ35/e6enROGjvsycSI/B4FZ3XzX3Gk3PVhd5+H9B95a2dbHSDGxtwu/53EAAAAPCkGeQz8Je3s5314vwJhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACfCxu7v/9fVEutW59I0f39/9FqXar6cHnxeJs/eFxxAAAAAAAAAMAJenE721nP+W67VZR/83+pbFwsH5/KW1nNUlZyNetZzFrWspLpJOM9A42uL66trUwPsOfMgXvOfEqgY1XZ+GzmDQAAAAAAAACfM7/Kwu7f/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBgUyUinSHG/Z/V4avUkZ5OMtldsJP/s1p9kD047AAAAADgBY8l21nO+224VuZjkufI7gLN5K/eyluWspZml3Cy/F+h86q9tbc42tzZn77aX/eN+/z/HCqMcMZ3vHg4+8uVyi0ZuZblcczU38kaauZlauWfb5Sqe7qh9cd1vx1R8rzJgZDersj3z96pyn3ePNdnDHPPLlPEyI2d2MjJVxdbOxjPdM3PwGTrm2ek/0nRqO8Fe7DvS6N7JPFTOz1Vlez6/Oyznp6I/EzM9z77njs558vW//OmnU1V9eKY0mJGqbJWPjf2ZmO3JxPODZOJ2896d27dWJ5+0TOwzVWbi0k57IT/KTzKZibyalSzn51nMWpYykR+WtcXq5Bc9l/whmbq+p/Xqp0UyWj1DOyfreDG9VO57Psv5cd7IzSzl5fLfTKbz7cxlLvM9Z/jS0We4vOprh1z1rS8dGPyVb1SVRpLfV+VwaOf1mZ689t5zx8u+3jW7WbowQJaOeW+sf7WqtI/x66ocDv2ZmO7JxLNHZ+IP5W1ltXnvzsrtxTcHO9yF96pK+zr6bTIxPDeS9vPlQvtkla29z45237MH9k2XfRd3+mr7+i7t9HWu1I1Dr9TR6j3c/pFmyr7nD+ybLfsu9/Qd9H4LgKF37pvnRhv/bvyj8UHjN43bjVfO/mDsO2MvjObMX898tz418rXaC8Wf80F+ufv5HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeHirb79zZ7HZXFrpq7RarXcP6RqwUq+O8JC7P0IlE/96qn3kA7q6P2d2gvF85enk5OY+rJX/tVqtak1xyDZ//NvQJKpVGYrUnVLl9O5JwMm4tnb3zWurb7/zreW7i68vvb50b35ubn5qfu7l2Wu3lptLU53H044SeBx2X/RPOxIAAAAAAAAAAABgUCfx3wlOe44AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAk21hMvUHKTI9dXWq3d7anG22l259d8t6klqS4hdJ8WFyPZ0l4z3DFYcd5/3l+dc++mTr492x6t3ta0ftN5iNaslEkpFOef+zGu9GVR6pOGoKxc4M2wm70k0cnLb/BwAA//+o5gZ+") creat(0x0, 0x182) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000002c0)='./file1\x00') 251.828424ms ago: executing program 2 (id=160): r0 = io_uring_setup(0x17ce, &(0x7f0000000140)={0x0, 0x52c1, 0x1, 0x0, 0x31d}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_procfs$pagemap(r3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r6, 0x0, 0x0, 0x0, 0x0, 0x1}) close_range(r0, 0xffffffffffffffff, 0x0) 141.942806ms ago: executing program 1 (id=161): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/core/rd_mcp_0/ramdisk_0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/target/core/rd_mcp_0/ramdisk_0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000b00)='rd_pages=8\n', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/target/core/rd_mcp_0/ramdisk_0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000d00)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/target/usb_gadget/naa.1234567890123456\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000001200)='./config/target/core/rd_mcp_0/ramdisk_0\x00', 0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/d0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) write(r2, &(0x7f0000001500)='1\n', 0x2) close(r2) 86.947788ms ago: executing program 0 (id=162): openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) read(r0, &(0x7f0000000300)=""/96, 0x60) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setfsgid(0xee00) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) 0s ago: executing program 3 (id=163): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000280)={0xaa, 0x541}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) recvmsg(0xffffffffffffffff, 0x0, 0x12) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000f40)={0x3, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r3, 0x40103e05, &(0x7f0000000040)={""/32, 0x0, 0x0, 0x0, 0x2000000, 0x0}) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xb}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x60}}, 0x0) unshare(0x2c020400) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000100)='%+9llu \x00'}, 0x20) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f0000000440)={{r5, &(0x7f00000001c0)='\x00', 0x220300, &(0x7f0000000200)={@_ha_fsid={[0x8001, 0x7fff]}, {0xff75, 0x40, 0x3, 0xfffffffffffffff9}}, 0x5, &(0x7f0000000240)={@_ha_fsid}, &(0x7f00000002c0)=0x2fa}, {[0x400, 0x3, 0x2, 0x8]}, 0x5, 0xbd, &(0x7f0000000380)=""/189}) getsockopt$inet6_int(r4, 0x29, 0xcb, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f00006c6000/0x400000)=nil, &(0x7f0000685000/0x4000)=nil, 0x400000, 0x0, 0x18100}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.1' (ED25519) to the list of known hosts. [ 78.223557][ T5764] cgroup: Unknown subsys name 'net' [ 78.358528][ T5764] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 80.025755][ T5764] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.164544][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.173173][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.181161][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.189451][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.197218][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 82.205240][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.250039][ T5782] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 82.261527][ T5782] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 82.288800][ T5782] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 82.309157][ T5782] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 82.318871][ T5782] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 82.338516][ T5782] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 82.346089][ T5086] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.355561][ T5782] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.363269][ T5782] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.372932][ T5782] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.381303][ T5778] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 82.388969][ T5778] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 82.406449][ T5782] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.414624][ T5782] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.422634][ T5782] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.430828][ T5782] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 82.438936][ T5782] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 82.446317][ T5782] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 82.836370][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 82.922211][ T5787] chnl_net:caif_netlink_parms(): no params data found [ 82.991286][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 83.115090][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.125326][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.133641][ T5775] bridge_slave_0: entered allmulticast mode [ 83.141307][ T5775] bridge_slave_0: entered promiscuous mode [ 83.185787][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.193139][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.200540][ T5775] bridge_slave_1: entered allmulticast mode [ 83.208297][ T5775] bridge_slave_1: entered promiscuous mode [ 83.215566][ T5785] chnl_net:caif_netlink_parms(): no params data found [ 83.229993][ T5787] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.237147][ T5787] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.244445][ T5787] bridge_slave_0: entered allmulticast mode [ 83.252786][ T5787] bridge_slave_0: entered promiscuous mode [ 83.299750][ T5787] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.306971][ T5787] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.315513][ T5787] bridge_slave_1: entered allmulticast mode [ 83.322667][ T5787] bridge_slave_1: entered promiscuous mode [ 83.362772][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.374091][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.381488][ T5779] bridge_slave_0: entered allmulticast mode [ 83.388637][ T5779] bridge_slave_0: entered promiscuous mode [ 83.402446][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.434050][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.441307][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.448913][ T5779] bridge_slave_1: entered allmulticast mode [ 83.456348][ T5779] bridge_slave_1: entered promiscuous mode [ 83.465679][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.491402][ T5787] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.541871][ T5787] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.570691][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.583898][ T5775] team0: Port device team_slave_0 added [ 83.604957][ T5787] team0: Port device team_slave_0 added [ 83.619625][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.630704][ T5775] team0: Port device team_slave_1 added [ 83.650073][ T5787] team0: Port device team_slave_1 added [ 83.709647][ T5779] team0: Port device team_slave_0 added [ 83.725360][ T5785] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.733011][ T5785] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.740420][ T5785] bridge_slave_0: entered allmulticast mode [ 83.747498][ T5785] bridge_slave_0: entered promiscuous mode [ 83.767944][ T5779] team0: Port device team_slave_1 added [ 83.787588][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.794869][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.821437][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.836957][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.844210][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.870234][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.881969][ T5785] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.889584][ T5785] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.896819][ T5785] bridge_slave_1: entered allmulticast mode [ 83.904083][ T5785] bridge_slave_1: entered promiscuous mode [ 83.922016][ T5787] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.929126][ T5787] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.956167][ T5787] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.969909][ T5787] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.976897][ T5787] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.003196][ T5787] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.068023][ T5785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.079067][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.086094][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.112854][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.126570][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.133597][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.159654][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.185107][ T5785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.225992][ T5785] team0: Port device team_slave_0 added [ 84.252267][ T5775] hsr_slave_0: entered promiscuous mode [ 84.259910][ T5775] hsr_slave_1: entered promiscuous mode [ 84.270143][ T5785] team0: Port device team_slave_1 added [ 84.304403][ T5787] hsr_slave_0: entered promiscuous mode [ 84.311161][ T5787] hsr_slave_1: entered promiscuous mode [ 84.317347][ T5787] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.325413][ T5787] Cannot create hsr debugfs directory [ 84.339295][ T5782] Bluetooth: hci0: command tx timeout [ 84.388841][ T5779] hsr_slave_0: entered promiscuous mode [ 84.398481][ T5779] hsr_slave_1: entered promiscuous mode [ 84.404755][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.412694][ T5779] Cannot create hsr debugfs directory [ 84.418544][ T51] Bluetooth: hci1: command tx timeout [ 84.424399][ T5782] Bluetooth: hci2: command tx timeout [ 84.452943][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.460337][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.486708][ T5785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.497705][ T5782] Bluetooth: hci3: command tx timeout [ 84.503892][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.513974][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.540571][ T5785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.697545][ T5785] hsr_slave_0: entered promiscuous mode [ 84.707322][ T5785] hsr_slave_1: entered promiscuous mode [ 84.713926][ T5785] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.722222][ T5785] Cannot create hsr debugfs directory [ 85.077762][ T5787] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 85.090198][ T5787] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 85.104496][ T5787] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 85.125281][ T5787] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 85.182250][ T5779] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.195682][ T5779] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.207575][ T5779] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.219574][ T5779] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.332132][ T5775] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 85.345966][ T5775] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 85.356707][ T5775] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 85.367535][ T5775] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 85.477188][ T5785] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 85.501176][ T5785] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 85.512639][ T5785] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 85.524041][ T5785] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 85.546229][ T5787] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.596523][ T5787] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.626771][ T4071] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.634209][ T4071] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.672815][ T4071] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.680048][ T4071] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.708907][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.799958][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.843772][ T1021] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.851046][ T1021] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.895896][ T5785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.912599][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.924043][ T1021] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.931282][ T1021] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.985329][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.003548][ T5785] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.037474][ T4071] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.044733][ T4071] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.062544][ T4071] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.069803][ T4071] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.096165][ T1021] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.103412][ T1021] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.151014][ T1021] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.158292][ T1021] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.291529][ T5787] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.420153][ T5782] Bluetooth: hci0: command tx timeout [ 86.485237][ T5787] veth0_vlan: entered promiscuous mode [ 86.499975][ T5782] Bluetooth: hci2: command tx timeout [ 86.505443][ T5782] Bluetooth: hci1: command tx timeout [ 86.569069][ T5782] Bluetooth: hci3: command tx timeout [ 86.575518][ T5787] veth1_vlan: entered promiscuous mode [ 86.702852][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.723313][ T5787] veth0_macvtap: entered promiscuous mode [ 86.791166][ T5787] veth1_macvtap: entered promiscuous mode [ 86.865799][ T5787] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.882788][ T5787] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.916953][ T5779] veth0_vlan: entered promiscuous mode [ 86.937312][ T5785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.963468][ T5787] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.973783][ T5787] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.989070][ T5787] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.997823][ T5787] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.037608][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.072154][ T5779] veth1_vlan: entered promiscuous mode [ 87.160485][ T5785] veth0_vlan: entered promiscuous mode [ 87.267739][ T5779] veth0_macvtap: entered promiscuous mode [ 87.295891][ T5785] veth1_vlan: entered promiscuous mode [ 87.336594][ T5779] veth1_macvtap: entered promiscuous mode [ 87.381153][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.428521][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.453558][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.478841][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.500469][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.554062][ T5775] veth0_vlan: entered promiscuous mode [ 87.584097][ T1135] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.595946][ T5785] veth0_macvtap: entered promiscuous mode [ 87.602261][ T1135] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.616310][ T5775] veth1_vlan: entered promiscuous mode [ 87.630298][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.641233][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.655925][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.705607][ T5785] veth1_macvtap: entered promiscuous mode [ 87.722375][ T5779] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.735650][ T5779] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.745631][ T5779] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.754927][ T5779] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.842868][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.861296][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.874017][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.902898][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.916001][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.963762][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.982184][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.983871][ T5836] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 87.992205][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.992255][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.996418][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.062547][ T5785] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.072364][ T5785] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.082473][ T5785] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.091877][ T5785] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.126485][ T5775] veth0_macvtap: entered promiscuous mode [ 88.182274][ T5775] veth1_macvtap: entered promiscuous mode [ 88.228939][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.239976][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.328194][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.358939][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.375610][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.394169][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.404339][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.420832][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.439472][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.454420][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.465435][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.488671][ T5782] Bluetooth: hci0: command tx timeout [ 88.520578][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.532637][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.554711][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.566565][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.576712][ T5782] Bluetooth: hci1: command tx timeout [ 88.582537][ T5782] Bluetooth: hci2: command tx timeout [ 88.585984][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.601911][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.620819][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.654801][ T5775] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.666367][ T5782] Bluetooth: hci3: command tx timeout [ 88.674414][ T5775] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.687445][ T5775] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.698585][ T5775] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.714218][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.767060][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.926029][ T4305] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.939573][ T4305] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.991257][ T1135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.018014][ T1135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.083387][ T1135] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.111080][ T1135] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.498697][ T5875] tipc: Started in network mode [ 90.503845][ T5875] tipc: Node identity 3a7e72ede2a8, cluster identity 4711 [ 90.535910][ T5875] tipc: Enabled bearer , priority 0 [ 90.569662][ T5782] Bluetooth: hci0: command tx timeout [ 90.649190][ T5782] Bluetooth: hci2: command tx timeout [ 90.650363][ T51] Bluetooth: hci1: command tx timeout [ 90.676299][ T5877] syzkaller0: entered promiscuous mode [ 90.684371][ T5877] syzkaller0: entered allmulticast mode [ 90.691005][ T5877] tipc: Resetting bearer [ 90.728938][ T51] Bluetooth: hci3: command tx timeout [ 90.794932][ T5873] tipc: Resetting bearer [ 91.125475][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 91.137145][ T51] CPU: 0 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 91.144604][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 91.154868][ T51] Workqueue: hci2 hci_rx_work [ 91.159598][ T51] Call Trace: [ 91.162896][ T51] [ 91.165865][ T51] dump_stack_lvl+0x18c/0x250 [ 91.170620][ T51] ? show_regs_print_info+0x20/0x20 [ 91.175887][ T51] ? load_image+0x420/0x420 [ 91.180477][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 91.185635][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 91.190719][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 91.195454][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 91.200680][ T51] kobject_add_internal+0x617/0xc90 [ 91.205909][ T51] kobject_add+0x164/0x240 [ 91.210394][ T51] ? kobject_init+0x1d0/0x1d0 [ 91.215165][ T51] ? get_device_parent+0x366/0x390 [ 91.220367][ T51] device_add+0x3fa/0xc40 [ 91.224744][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 91.229709][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 91.235029][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 91.241325][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 91.247079][ T51] ? mutex_unlock+0x10/0x10 [ 91.251603][ T51] ? skb_pull_data+0xf0/0x1f0 [ 91.256301][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 91.261874][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 91.268831][ T51] hci_event_packet+0x7b4/0x1280 [ 91.273808][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 91.278849][ T51] ? lock_chain_count+0x20/0x20 [ 91.283720][ T51] ? bis_list+0x290/0x290 [ 91.288069][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 91.293310][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 91.298578][ T51] hci_rx_work+0x43a/0xd60 [ 91.303032][ T51] ? process_scheduled_works+0x975/0x1600 [ 91.308798][ T51] process_scheduled_works+0xa60/0x1600 [ 91.314389][ T51] ? worker_attach_to_pool+0x370/0x370 [ 91.319967][ T51] ? assign_work+0x3cc/0x5d0 [ 91.324591][ T51] worker_thread+0xa5e/0xfe0 [ 91.329300][ T51] kthread+0x2fa/0x390 [ 91.333397][ T51] ? pr_cont_work+0x550/0x550 [ 91.338100][ T51] ? kthread_blkcg+0xd0/0xd0 [ 91.342711][ T51] ret_from_fork+0x48/0x80 [ 91.347149][ T51] ? kthread_blkcg+0xd0/0xd0 [ 91.351761][ T51] ret_from_fork_asm+0x11/0x20 [ 91.356561][ T51] [ 91.362529][ T51] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 91.378563][ T51] Bluetooth: hci2: failed to register connection device [ 91.910058][ T5610] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 92.035045][ T23] cfg80211: failed to load regulatory.db [ 92.122722][ T5610] usb 4-1: Using ep0 maxpacket: 16 [ 92.147400][ T5610] usb 4-1: config 0 interface 0 has no altsetting 0 [ 92.157789][ T5610] usb 4-1: New USB device found, idVendor=0810, idProduct=0002, bcdDevice= 0.00 [ 92.174175][ T5610] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.207588][ T5610] usb 4-1: config 0 descriptor?? [ 92.789036][ T5610] pantherlord 0003:0810:0002.0001: unknown main item tag 0x1 [ 92.798729][ T5610] pantherlord 0003:0810:0002.0001: unknown main item tag 0x0 [ 92.824248][ T5610] pantherlord 0003:0810:0002.0001: unknown main item tag 0x0 [ 92.833155][ T5610] pantherlord 0003:0810:0002.0001: unknown main item tag 0x0 [ 92.847083][ T5610] pantherlord 0003:0810:0002.0001: unknown main item tag 0x0 [ 92.864505][ T5610] pantherlord 0003:0810:0002.0001: unknown main item tag 0x3 [ 92.885238][ T5610] pantherlord 0003:0810:0002.0001: hidraw0: USB HID v0.81 Device [HID 0810:0002] on usb-dummy_hcd.3-1/input0 [ 92.897615][ T5610] pantherlord 0003:0810:0002.0001: Force feedback for PantherLord/GreenAsia devices by Anssi Hannula [ 93.193256][ T5873] tipc: Disabling bearer [ 93.224568][ T27] tipc: Node number set to 3637932781 [ 93.279761][ T5610] usb 4-1: USB disconnect, device number 2 [ 94.902400][ T5946] syzkaller0: entered promiscuous mode [ 94.907951][ T5946] syzkaller0: entered allmulticast mode [ 96.835663][ T5965] syz.0.37[5965]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 96.887906][ T5965] loop0: detected capacity change from 0 to 128 [ 96.956638][ T5967] UDC core: g1: couldn't find an available UDC or it's busy [ 97.291493][ T5982] netlink: 4 bytes leftover after parsing attributes in process `syz.2.39'. [ 97.363197][ T5983] loop3: detected capacity change from 0 to 512 [ 97.520799][ T5983] EXT4-fs error (device loop3): ext4_xattr_inode_iget:441: inode #11: comm syz.3.40: ea_inode with extended attributes [ 97.609249][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 97.613112][ T5983] EXT4-fs error (device loop3): ext4_xattr_inode_iget:446: comm syz.3.40: error while reading EA inode 11 err=-117 [ 97.681337][ T5983] EXT4-fs (loop3): 1 orphan inode deleted [ 97.700355][ T5983] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 97.825408][ T5992] ipvlan2: entered promiscuous mode [ 97.836529][ T5992] ipvlan2: entered allmulticast mode [ 97.856261][ T5992] bridge0: entered allmulticast mode [ 97.895328][ T5992] team0: Device ipvlan2 failed to register rx_handler [ 97.977692][ T5983] EXT4-fs error (device loop3): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz.3.40: bad entry in directory: rec_len is smaller than minimal - offset=76, inode=0, rec_len=0, size=1024 fake=0 [ 98.093501][ T5995] loop9: detected capacity change from 0 to 7 [ 98.136993][ T5995] Dev loop9: unable to read RDB block 7 [ 98.158538][ T5995] loop9: unable to read partition table [ 98.164568][ T5995] loop9: partition table beyond EOD, truncated [ 98.215941][ T5995] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ [ 98.215941][ T5995] ) failed (rc=-5) [ 98.583895][ T5785] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 99.220089][ T6018] syzkaller0: entered promiscuous mode [ 99.225639][ T6018] syzkaller0: entered allmulticast mode [ 99.283804][ T6018] tipc: Enabled bearer , priority 0 [ 99.311352][ T6022] tipc: Enabling of bearer rejected, failed to enable media [ 99.333092][ T6017] tipc: Resetting bearer [ 99.413171][ T6017] tipc: Disabling bearer [ 99.432940][ T6020] syzkaller0: entered promiscuous mode [ 99.438822][ T6020] syzkaller0: entered allmulticast mode [ 99.508667][ T6025] tipc: Enabling of bearer rejected, failed to enable media [ 99.583676][ T6027] netlink: 44 bytes leftover after parsing attributes in process `syz.2.54'. [ 99.794094][ T6032] syzkaller0: entered promiscuous mode [ 99.801258][ T6032] syzkaller0: entered allmulticast mode [ 99.839020][ T6030] syzkaller0: entered promiscuous mode [ 99.874476][ T6030] syzkaller0: entered allmulticast mode [ 100.075956][ T6040] netlink: 'syz.0.60': attribute type 1 has an invalid length. [ 100.164585][ T6041] bond1 (unregistering): Released all slaves [ 100.302161][ T6046] loop3: detected capacity change from 0 to 16 [ 100.321023][ T6046] ======================================================= [ 100.321023][ T6046] WARNING: The mand mount option has been deprecated and [ 100.321023][ T6046] and is ignored by this kernel. Remove the mand [ 100.321023][ T6046] option from the mount to silence this warning. [ 100.321023][ T6046] ======================================================= [ 100.433923][ T6046] erofs: (device loop3): mounted with root inode @ nid 36. [ 100.524785][ T6046] erofs: (device loop3): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 100.568614][ T5818] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 100.574732][ T6046] erofs: (device loop3): z_erofs_readahead: readahead error at folio 2 @ nid 89 [ 100.622797][ T6046] erofs: (device loop3): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 100.658781][ T6046] erofs: (device loop3): z_erofs_readahead: readahead error at folio 1 @ nid 89 [ 100.687086][ T6046] erofs: (device loop3): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 100.712333][ T6046] erofs: (device loop3): z_erofs_readahead: readahead error at folio 0 @ nid 89 [ 100.736973][ T6046] erofs: (device loop3): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 100.750573][ T6046] erofs: (device loop3): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 100.764493][ T6046] erofs: (device loop3): z_erofs_read_folio: read error -117 @ 0 of nid 89 [ 100.775927][ T28] audit: type=1800 audit(1785175735.958:2): pid=6046 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.62" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 100.829171][ T5818] usb 2-1: unable to get BOS descriptor or descriptor too short [ 100.840246][ T5818] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 100.857047][ T5818] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 100.869450][ T5818] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.898825][ T5818] usb 2-1: Product: syz [ 100.903146][ T5818] usb 2-1: Manufacturer: syz [ 100.912394][ T5818] usb 2-1: SerialNumber: syz [ 101.178032][ T6066] netlink: 56 bytes leftover after parsing attributes in process `syz.2.67'. [ 101.218429][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 101.358425][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 101.568434][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 102.498428][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 102.558434][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 102.658772][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c0!!! [ 102.938421][ C0] sched: RT throttling activated [ 102.956304][ T6070] process 'syz.0.66' launched './file0' with NULL argv: empty string added [ 103.008439][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 103.065537][ T6051] Zero length message leads to an empty skb [ 103.124152][ T5818] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 103.139663][ T5818] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 103.148171][ T5818] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 103.178663][ T5818] usb 2-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 103.188259][ T5818] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 103.228461][ T5818] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 103.236307][ T5818] usb 2-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 103.274197][ T5818] usb 2-1: failed to enable PITCH for EP 0x82 [ 103.405433][ T5818] usb 2-1: USB disconnect, device number 2 [ 103.519472][ T6078] Driver unsupported XDP return value 0 on prog (id 5) dev N/A, expect packet loss! [ 104.385249][ T6082] udevd[6082]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 104.922907][ T6095] netlink: 'syz.2.68': attribute type 13 has an invalid length. [ 104.933739][ T6095] netlink: 8 bytes leftover after parsing attributes in process `syz.2.68'. [ 104.946635][ T6095] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 105.215694][ T6103] loop3: detected capacity change from 0 to 1024 [ 105.501908][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 105.513467][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 105.713988][ T6108] hfsplus: request for non-existent node 33423360 in B*Tree [ 105.805502][ T6108] hfsplus: request for non-existent node 33423360 in B*Tree [ 106.166151][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 106.182800][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 106.219703][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 106.239537][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 106.268057][ T6108] hfsplus: request for non-existent node 33423360 in B*Tree [ 106.285877][ T6108] hfsplus: request for non-existent node 33423360 in B*Tree [ 106.407590][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 106.447907][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.664749][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.680633][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.710018][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.727914][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.768926][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.776549][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.804599][ T6108] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.821047][ T6108] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.862025][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 107.884749][ T6103] hfsplus: request for non-existent node 33423360 in B*Tree [ 108.762012][ T6125] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 110.339158][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 110.748774][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 113.308496][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 115.541047][ T6148] syzkaller0: entered promiscuous mode [ 115.546596][ T6148] syzkaller0: entered allmulticast mode [ 117.354735][ T6156] syz.1.91: attempt to access beyond end of device [ 117.354735][ T6156] loop3: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 117.368330][ T6156] SQUASHFS error: Failed to read block 0x0: -5 [ 120.522923][ T6185] syzkaller0: entered promiscuous mode [ 120.535245][ T6185] syzkaller0: entered allmulticast mode [ 121.252493][ T6202] loop1: detected capacity change from 0 to 32768 [ 121.283329][ T6202] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.101 (6202) [ 122.719803][ T6183] syz.3.99 (6183): drop_caches: 2 [ 122.751256][ T6202] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 122.762265][ T6202] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 122.771032][ T6202] BTRFS info (device loop1): setting nodatacow, compression disabled [ 122.779198][ T6202] BTRFS info (device loop1): max_inline at 0 [ 123.118583][ T51] Bluetooth: hci0: command tx timeout [ 123.564491][ T6202] BTRFS info (device loop1): using free space tree [ 123.747461][ T6202] BTRFS info (device loop1): auto enabling async discard [ 125.665248][ T5775] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 126.284774][ T6243] tipc: Started in network mode [ 126.306252][ T6243] tipc: Node identity 56a181f24038, cluster identity 4711 [ 126.338337][ T6243] tipc: Enabled bearer , priority 0 [ 126.378868][ T6243] syzkaller0: entered promiscuous mode [ 126.388891][ T6243] syzkaller0: entered allmulticast mode [ 126.447888][ T6243] tipc: Resetting bearer [ 126.499492][ T6241] tipc: Resetting bearer [ 126.612578][ T6241] tipc: Disabling bearer [ 127.005067][ T6255] syzkaller0: entered promiscuous mode [ 127.015260][ T6255] syzkaller0: entered allmulticast mode [ 127.057286][ T6255] 0: reclassify loop, rule prio 0, protocol 800 [ 129.550867][ T6282] loop3: detected capacity change from 0 to 16 [ 129.600648][ T6282] erofs: (device loop3): mounted with root inode @ nid 36. [ 129.773670][ T5782] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress 4876 in[4096, 0] out[9000] [ 129.834692][ T6282] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress 4876 in[4096, 0] out[8192] [ 129.926707][ T28] audit: type=1800 audit(1785175765.028:3): pid=6282 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.115" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 130.385265][ T6282] syz.3.115 (6282) used greatest stack depth: 20104 bytes left [ 130.432254][ T5782] Bluetooth: hci3: command tx timeout [ 130.750008][ T6289] loop1: detected capacity change from 0 to 512 [ 130.826225][ T6289] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 130.893271][ T6289] ext4 filesystem being mounted at /19/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 132.875478][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 132.990361][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.997138][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.965842][ T6304] netlink: 48 bytes leftover after parsing attributes in process `syz.0.123'. [ 138.316553][ T6336] loop3: detected capacity change from 0 to 512 [ 138.364037][ T6336] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 138.435908][ T6336] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 138.518721][ T6325] loop0: detected capacity change from 0 to 131072 [ 138.534380][ T6325] F2FS-fs (loop0): invalid crc value [ 138.548180][ T6336] EXT4-fs (loop3): 1 truncate cleaned up [ 138.590189][ T6336] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 138.630281][ T6325] F2FS-fs (loop0): Found nat_bits in checkpoint [ 138.781237][ T6325] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 140.135050][ T5785] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.559445][ T6368] syzkaller0: entered promiscuous mode [ 144.565076][ T6368] syzkaller0: entered allmulticast mode [ 145.361478][ T6368] tipc: Enabled bearer , priority 0 [ 145.474914][ T6367] tipc: Resetting bearer [ 145.536542][ T6367] tipc: Disabling bearer [ 147.408814][ T8] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 149.205669][ T8] usb 1-1: device descriptor read/all, error -71 [ 149.401403][ T6392] tipc: Enabling of bearer rejected, failed to enable media [ 152.221115][ T6406] netlink: 28 bytes leftover after parsing attributes in process `syz.3.140'. [ 152.258662][ T6406] netlink: 28 bytes leftover after parsing attributes in process `syz.3.140'. [ 152.290998][ T6408] syzkaller0: entered promiscuous mode [ 152.296536][ T6408] syzkaller0: entered allmulticast mode [ 158.322468][ T6436] overlay: filesystem on ./file0 not supported as upperdir [ 158.685564][ T6443] loop0: detected capacity change from 0 to 8 [ 158.692561][ T6443] squashfs: Unknown parameter 'fowner' [ 160.226666][ T6081] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 160.942589][ T6448] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.132564][ T6448] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.320353][ T6448] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.471859][ T6448] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.684977][ T6448] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.723795][ T6448] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.762717][ T6448] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.864386][ T6459] loop0: detected capacity change from 0 to 1024 [ 164.520792][ T6448] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.949669][ T6467] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 164.967776][ T6467] [ 164.970164][ T6467] ====================================================== [ 164.977205][ T6467] WARNING: possible circular locking dependency detected [ 164.984281][ T6467] syzkaller #0 Not tainted [ 164.988723][ T6467] ------------------------------------------------------ [ 164.995765][ T6467] syz.1.161/6467 is trying to acquire lock: [ 165.001689][ T6467] ffff888148cf8670 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: configfs_depend_item_unlocked+0x157/0x430 [ 165.013255][ T6467] [ 165.013255][ T6467] but task is already holding lock: [ 165.020654][ T6467] ffff88805e1bb920 (&opts->dep_lock){+.+.}-{3:3}, at: usbg_make_tpg+0x148/0x580 [ 165.029763][ T6467] [ 165.029763][ T6467] which lock already depends on the new lock. [ 165.029763][ T6467] [ 165.040275][ T6467] [ 165.040275][ T6467] the existing dependency chain (in reverse order) is: [ 165.049316][ T6467] [ 165.049316][ T6467] -> #2 (&opts->dep_lock){+.+.}-{3:3}: [ 165.057011][ T6467] __mutex_lock+0x135/0xc80 [ 165.062086][ T6467] tcm_set_name+0x2a/0x90 [ 165.066978][ T6467] function_make+0x199/0x350 [ 165.072126][ T6467] configfs_mkdir+0x515/0x9e0 [ 165.077364][ T6467] vfs_mkdir+0x2a5/0x470 [ 165.082164][ T6467] do_mkdirat+0x1dc/0x450 [ 165.087050][ T6467] __x64_sys_mkdir+0x6e/0x80 [ 165.092194][ T6467] do_syscall_64+0x55/0xb0 [ 165.097171][ T6467] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 165.103629][ T6467] [ 165.103629][ T6467] -> #1 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 165.111949][ T6467] __mutex_lock+0x135/0xc80 [ 165.117036][ T6467] configfs_rmdir+0x63c/0x980 [ 165.122273][ T6467] vfs_rmdir+0x352/0x4b0 [ 165.127080][ T6467] do_rmdir+0x29f/0x590 [ 165.131798][ T6467] __x64_sys_rmdir+0x49/0x50 [ 165.136953][ T6467] do_syscall_64+0x55/0xb0 [ 165.141943][ T6467] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 165.148393][ T6467] [ 165.148393][ T6467] -> #0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 165.157154][ T6467] __lock_acquire+0x37ef/0x7d80 [ 165.162577][ T6467] lock_acquire+0x19e/0x420 [ 165.167638][ T6467] down_write+0x97/0x200 [ 165.172448][ T6467] configfs_depend_item_unlocked+0x157/0x430 [ 165.178986][ T6467] usbg_make_tpg+0x1f7/0x580 [ 165.184143][ T6467] target_fabric_make_tpg+0xa4/0x6d0 [ 165.189997][ T6467] configfs_mkdir+0x515/0x9e0 [ 165.195237][ T6467] vfs_mkdir+0x2a5/0x470 [ 165.200052][ T6467] do_mkdirat+0x1dc/0x450 [ 165.204938][ T6467] __x64_sys_mkdirat+0x89/0xa0 [ 165.210271][ T6467] do_syscall_64+0x55/0xb0 [ 165.215245][ T6467] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 165.221703][ T6467] [ 165.221703][ T6467] other info that might help us debug this: [ 165.221703][ T6467] [ 165.231961][ T6467] Chain exists of: [ 165.231961][ T6467] &sb->s_type->i_mutex_key#21 --> gadget_subsys.su_mutex --> &opts->dep_lock [ 165.231961][ T6467] [ 165.246708][ T6467] Possible unsafe locking scenario: [ 165.246708][ T6467] [ 165.254189][ T6467] CPU0 CPU1 [ 165.259580][ T6467] ---- ---- [ 165.264974][ T6467] lock(&opts->dep_lock); [ 165.269432][ T6467] lock(gadget_subsys.su_mutex); [ 165.277013][ T6467] lock(&opts->dep_lock); [ 165.283982][ T6467] lock(&sb->s_type->i_mutex_key#21); [ 165.289496][ T6467] [ 165.289496][ T6467] *** DEADLOCK *** [ 165.289496][ T6467] [ 165.297756][ T6467] 5 locks held by syz.1.161/6467: [ 165.302809][ T6467] #0: ffff888142ecc418 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 165.312129][ T6467] #1: ffff88807c390160 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 [ 165.322997][ T6467] #2: ffffffff8db2b450 (&subsys->su_mutex){+.+.}-{3:3}, at: configfs_mkdir+0x4b9/0x9e0 [ 165.332812][ T6467] #3: ffffffff8de58aa8 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf8/0x580 [ 165.342547][ T6467] #4: ffff88805e1bb920 (&opts->dep_lock){+.+.}-{3:3}, at: usbg_make_tpg+0x148/0x580 [ 165.352140][ T6467] [ 165.352140][ T6467] stack backtrace: [ 165.358077][ T6467] CPU: 0 PID: 6467 Comm: syz.1.161 Not tainted syzkaller #0 [ 165.365405][ T6467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 165.375591][ T6467] Call Trace: [ 165.378903][ T6467] [ 165.381861][ T6467] dump_stack_lvl+0x18c/0x250 [ 165.386573][ T6467] ? load_image+0x420/0x420 [ 165.391119][ T6467] ? show_regs_print_info+0x20/0x20 [ 165.396361][ T6467] ? print_circular_bug+0x12b/0x1a0 [ 165.401620][ T6467] check_noncircular+0x2fc/0x400 [ 165.406622][ T6467] ? look_up_lock_class+0x75/0x140 [ 165.411794][ T6467] ? print_deadlock_bug+0x5d0/0x5d0 [ 165.417036][ T6467] ? lockdep_lock+0xf5/0x230 [ 165.421683][ T6467] ? __lock_acquire+0x357f/0x7d80 [ 165.426777][ T6467] ? _find_first_zero_bit+0xd6/0x100 [ 165.432115][ T6467] __lock_acquire+0x37ef/0x7d80 [ 165.437027][ T6467] ? is_bpf_text_address+0x28f/0x2a0 [ 165.442351][ T6467] ? verify_lock_unused+0x140/0x140 [ 165.447592][ T6467] lock_acquire+0x19e/0x420 [ 165.452143][ T6467] ? configfs_depend_item_unlocked+0x157/0x430 [ 165.458353][ T6467] ? trace_raw_output_contention_end+0xd0/0xd0 [ 165.464562][ T6467] ? __might_sleep+0xe0/0xe0 [ 165.469196][ T6467] ? rcu_is_watching+0x15/0xb0 [ 165.474021][ T6467] ? read_lock_is_recursive+0x20/0x20 [ 165.479424][ T6467] ? trace_contention_end+0x39/0xe0 [ 165.484660][ T6467] ? __mutex_lock+0x30d/0xc80 [ 165.489365][ T6467] ? do_syscall_64+0x55/0xb0 [ 165.494000][ T6467] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 165.500098][ T6467] down_write+0x97/0x200 [ 165.504389][ T6467] ? configfs_depend_item_unlocked+0x157/0x430 [ 165.510566][ T6467] ? down_read_killable+0x340/0x340 [ 165.515793][ T6467] configfs_depend_item_unlocked+0x157/0x430 [ 165.521799][ T6467] usbg_make_tpg+0x1f7/0x580 [ 165.526435][ T6467] ? usbg_drop_tport+0x20/0x20 [ 165.531220][ T6467] ? vscnprintf+0x80/0x80 [ 165.535592][ T6467] target_fabric_make_tpg+0xa4/0x6d0 [ 165.540981][ T6467] ? target_fabric_release_wwn+0xb0/0xb0 [ 165.546670][ T6467] configfs_mkdir+0x515/0x9e0 [ 165.551375][ T6467] vfs_mkdir+0x2a5/0x470 [ 165.555635][ T6467] do_mkdirat+0x1dc/0x450 [ 165.559995][ T6467] ? vfs_mkdir+0x470/0x470 [ 165.564435][ T6467] __x64_sys_mkdirat+0x89/0xa0 [ 165.569224][ T6467] do_syscall_64+0x55/0xb0 [ 165.573667][ T6467] ? clear_bhb_loop+0x40/0x90 [ 165.578366][ T6467] ? clear_bhb_loop+0x40/0x90 [ 165.583111][ T6467] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 165.589036][ T6467] RIP: 0033:0x7f7106f9de99 [ 165.593489][ T6467] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 165.613114][ T6467] RSP: 002b:00007f7107ef6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 165.621550][ T6467] RAX: ffffffffffffffda RBX: 00007f7107225fa0 RCX: 00007f7106f9de99 [ 165.629543][ T6467] RDX: 00000000000001ff RSI: 0000200000001000 RDI: ffffffffffffff9c [ 165.637531][ T6467] RBP: 00007f7107033eaf R08: 0000000000000000 R09: 0000000000000000 [ 165.645521][ T6467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 165.653511][ T6467] R13: 00007f7107226038 R14: 00007f7107225fa0 R15: 00007ffec67ac388 [ 165.661528][ T6467] [ 165.725898][ T6471] netlink: 8 bytes leftover after parsing attributes in process `syz.3.163'.