last executing test programs: 5m31.072325423s ago: executing program 32 (id=1384): r0 = fsopen(&(0x7f0000000940)='configfs\x00', 0x1) readv(r0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)=""/253, 0xfd}], 0x1) 5m29.052273869s ago: executing program 33 (id=1400): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000280)=0x7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000980)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r3, &(0x7f00000009c0)={0x2, 0x4e20, @loopback}, 0x57) recvmmsg(r3, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000ac0)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) fcntl$setlease(r1, 0x400, 0x2) 5m24.607281563s ago: executing program 2 (id=1430): r0 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000000100)={&(0x7f0000000180)=@in6={0xa, 0x4e24, 0x4, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x800c}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000200)="b2", 0x1}], 0x1, &(0x7f0000000240)=[@dstaddrv4={0x18, 0x84, 0x7, @loopback}], 0x18, 0x408c}, 0x8050) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./proc_mnt\x00', &(0x7f0000000380)='proc\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x800, 0x0) 5m24.470430987s ago: executing program 2 (id=1432): r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX, @ANYRES8], 0x3, 0x240, &(0x7f0000000400)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") openat(r0, 0x0, 0xcc040, 0x56) unlinkat(0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) r1 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000680), 0x80080, 0x0) fcntl$notify(r1, 0x402, 0x80000037) syz_open_procfs(0x0, &(0x7f00000006c0)='net\x00') socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000740)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000780)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000007c0)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000800)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000840)={0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000880)=@abs, 0x6e) recvmmsg(r4, &(0x7f0000000940), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000980)=0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="3c010000140001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) syz_io_uring_setup(0x12ea, &(0x7f0000000c80)={0x0, 0xa982, 0x200, 0x4, 0x2a6}, &(0x7f0000000d00), &(0x7f0000000d40), &(0x7f0000000d80)) bpf$PROG_LOAD(0x5, 0x0, 0x0) 5m23.515341824s ago: executing program 2 (id=1436): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x3c}, 0x1, 0x0, 0x0, 0x4044050}, 0x4000000) 5m23.399401476s ago: executing program 2 (id=1437): syz_mount_image$ext4(&(0x7f00000006c0)='ext2\x00', &(0x7f0000000700)='./file1\x00', 0x0, &(0x7f0000000740), 0x1, 0x289, &(0x7f0000000780)="$eJzs3T1oc1UcB+D/vUn6GbQqiCh+gIhoodTBSQRdFAoiRURQoSLiJK1QLW6Nk4uDziqdXIq4WR3FpbgIXat2qAgiFgeLgw6Rm5tI3jRpQ9rc9E2eB9Kbc+8595yU/k4OpTkNYGItRMRTEVGKiMWIqERE0l7hgfyx0CzuzO6vRdTrL/yZNOrl5Vyr3XxE1CLSiCi3rm3tvXL89+GzD3/4buWhz/deni3gpZU6T5wcHz13+tnzH3y18thW2jxXbR7bX8cVuvvWLifLScTtQ+jsukjKox4B/Vh978sfs5DcEREPNvJfibQZ2Y82p76rxKOf9mr78R8H9xQ5VuDq1euV7D2wVgcmTtpYAyfpUuQL9mqk6dJSvob/qTSXvrWx+c7imxul9TfaZ40ilu/AsFQjjp75Zvrr+Y78/1bK8w+Mryz/L67u/pw9Pz3zmzJgLN2bH7L8L762/UjIP0wc+YfxMDdAG/mHsVAdsJH8w81uwOwOkP87fz14crDOgGulz/z/XuSYgGJY/8MYq7Se1Lpeln8YU9MXV+k7//7UF8ZOM/+Pp6MeCFC49vd/AGCy1KdH/QlkYFRGPf8AAAAAAAAAAAAAAAAAAABn7czur7UeEUkhfX7/ScTJ0xFR7uw/Gv/YIN+bbKbxde6vJKv2vyRv1jQ1UP+v3n+Z0V/eF8P/9HW5ozzTXrjll6H3f64f7hvOfd+/sdhzB8vt9YhaVnm5XD7785fEOXvj9bVj7m0XXK+83s9drk5nqp94qYhee38X/90tov/eVg4jvs3mn+Vu808adzWO3eefavsWywN6+59L3gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDC/BcAAP//yRpr4Q==") mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/1/root/var\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/1/root/var/run\x00', 0x1ff) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000480)=@file={0x1, './proc/1/root/var/run/gssproxy.sock\x00'}, 0x30) listen(r0, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc/net/rpc/use-gss-proxy\x00', 0x1, 0x20) write(r1, &(0x7f0000000a40)='1', 0x1) 5m23.089202378s ago: executing program 2 (id=1438): r0 = eventfd2(0x0, 0x0) ppoll(&(0x7f0000001980)=[{r0, 0xf129}, {r0, 0x1449}], 0x2, 0x0, 0x0, 0x0) writev(r0, 0x0, 0x0) 5m21.723027607s ago: executing program 2 (id=1446): socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000001c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000002c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000300), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000400)=0x2) ioprio_get$uid(0x3, 0x0) 5m21.327081658s ago: executing program 34 (id=1446): socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000001c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000002c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000300), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000400)=0x2) ioprio_get$uid(0x3, 0x0) 4m42.568695863s ago: executing program 5 (id=1655): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000bc0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000c00)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000c40)={0x1d, r1, 0x0, {0x0, 0x0, 0x1}, 0xfe}, 0x18) writev(r0, &(0x7f0000000c80)=[{&(0x7f0000000cc0)="3874517c2edc", 0xfdef}, {0x0}], 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000001140)={0x1d, r2}, 0x18) connect$can_j1939(0xffffffffffffffff, &(0x7f0000001180)={0x1d, r2, 0x0, {0x0, 0x0, 0x1}, 0x2}, 0x18) sendmsg$can_j1939(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001280)={&(0x7f0000000280)="2eaa472ae0fbcecbe1", 0x9}}, 0x200018ae) 4m41.043337799s ago: executing program 5 (id=1661): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f0000000300)={&(0x7f00000001c0)=@ieee802154={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0002}}}, 0x80, &(0x7f0000002640)=[{&(0x7f00000007c0)="27031c00f40e3400020000000000000006e1f0000000890900000002ee1680ca82973d2bd4b836954268e611c00aab9715", 0x31}, {0x0}], 0x2}, 0x24000008) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000480), 0x4) setns(0xc9, 0x0) socket(0x2a, 0x2, 0x5) recvmmsg(r2, &(0x7f00000004c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r2, &(0x7f0000000600)={&(0x7f0000000640)=@nameseq={0x1e, 0x1, 0x3, {0x1, 0x1, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20004800}, 0x4800) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newnexthop={0x18, 0x68, 0x601, 0x0, 0x0, {0x0, 0x0, 0x3}}, 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x103a42, 0x0) syz_emit_ethernet(0x52, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./proc\x00', 0x173) mount(0x0, &(0x7f0000000380)='./proc\x00', &(0x7f00000003c0)='proc\x00', 0x4000, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='14', 0x2) syz_open_dev$tty20(0xc, 0x4, 0x0) 4m38.024889947s ago: executing program 5 (id=1671): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="d8000000180081064e8100000000b904021d0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cfce1e090000001fb791643a5ee4ce1b14d6d930ede1d9d322fe7c9f8775730d165ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3f09ad809d5e1cace81ed0bffece0b42a9ecbee5dd6e4edef3d939641e0ec0f60cb180000008af26c8b7b55f4d2cb1df0966736a1dfe444c65ac5b348eac7c2ea4753", 0xcb}], 0x1}, 0x24040000) 4m37.80393076s ago: executing program 5 (id=1673): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000500)={r1, 0x81, 0x7, 0x7}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r2, 0x89fa, &(0x7f0000000580)={'sit0\x00', &(0x7f0000000540)={@mcast2, @remote, 0x19, 0xb}}) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200)=0x2000008, 0x4) connect$inet(r3, &(0x7f0000000240)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0xfffffdef}}, 0x1) recvfrom(r3, &(0x7f0000000380)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) mknodat$md(0xffffffffffffff9c, &(0x7f0000000080)='./md0\x00', 0x6180, 0x0) socket$inet(0x2, 0x2, 0x0) r5 = socket$kcm(0xa, 0x5, 0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x2c, 0x2, 0x6, 0x500, 0x0, 0x0, {0x3, 0x0, 0x2}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x84}, 0x4000080) sendmsg$kcm(r5, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x7fff, @local, 0x8}, 0x80, &(0x7f0000000340)=[{&(0x7f00000003c0)='`', 0x1}], 0x1}, 0x41) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0002}]}) close_range(r6, 0xffffffffffffffff, 0x0) 4m36.302299633s ago: executing program 5 (id=1683): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="d8000000180081064e8100000000b904021d0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cfce1e090000001fb791643a5ee4ce1b14d6d930ede1d9d322fe7c9f8775730d165ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3f09ad809d5e1cace81ed0bffece0b42a9ecbee5dd6e4edef3d939641e0ec0f60cb180000008af26c8b7b55f4d2cb1df0966736a1dfe444c65ac5b348eac7c2ea475327557ba566236c", 0xd2}], 0x1}, 0x24040000) 4m36.091776304s ago: executing program 5 (id=1685): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000003c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000400), 0x10106, 0x2, 0x0) unshare(0x42000000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r3, &(0x7f00000006c0)={0x18, 0x2, {0x0, @loopback}}, 0x1e) connect$pptp(r3, &(0x7f0000000700)={0x18, 0x2, {0x5678, @loopback}}, 0x1e) 4m20.523536263s ago: executing program 35 (id=1685): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000003c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000400), 0x10106, 0x2, 0x0) unshare(0x42000000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r3, &(0x7f00000006c0)={0x18, 0x2, {0x0, @loopback}}, 0x1e) connect$pptp(r3, &(0x7f0000000700)={0x18, 0x2, {0x5678, @loopback}}, 0x1e) 4m20.16162119s ago: executing program 6 (id=1724): socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000180)=ANY=[], 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="240000001b1401002abdd444d446df2508000100000000000900", @ANYRES32=r0], 0x24}, 0x1, 0x0, 0x0, 0x4000801}, 0x40c0810) 4m16.959307357s ago: executing program 6 (id=1735): rename(&(0x7f0000000c00)='./file0/file0\x00', &(0x7f0000000ec0)='./file1\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000001540)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000001580)=""/81, 0x51) 4m16.843861158s ago: executing program 6 (id=1738): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000500)={r1, 0x81, 0x7, 0x7}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r2, 0x89fa, &(0x7f0000000580)={'sit0\x00', &(0x7f0000000540)={@mcast2, @remote, 0x19, 0xb}}) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200)=0x2000008, 0x4) connect$inet(r3, &(0x7f0000000240)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0xfffffdef}}, 0x1) recvfrom(r3, &(0x7f0000000380)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) mknodat$md(0xffffffffffffff9c, &(0x7f0000000080)='./md0\x00', 0x6180, 0x0) socket$inet(0x2, 0x2, 0x0) socket$kcm(0xa, 0x5, 0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x2c, 0x2, 0x6, 0x500, 0x0, 0x0, {0x3, 0x0, 0x2}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x84}, 0x4000080) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0002}]}) 4m14.357124472s ago: executing program 6 (id=1744): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000100), &(0x7f00000002c0)='./file0\x00', 0x200008, &(0x7f0000000300)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYRESOCT], 0x1, 0x3af, &(0x7f0000000380)="$eJzs3b9vW9UXAPBTt4nTfr+JMyAkQIirbixWEv6BRqiVEJFAoUalA+KVOMWKG0e2FeQKQQckVv4D9oqRDQnxD2QAZsTCloWxQ1Qj/0rtxE0T0sRUfD6SdY99z3m+z09+OsvT3b317b2N9UZxPWtG7lqKXETkHkXMd6OeC/0x142nY9iDeLNw6/fXP/jo9rvLKyvXV1O6sXzzraWU0twbP33+xfdXf27+78Mf5n7Mx878x7t/Lf258/LOK7uPb35WaaRKI23WmilLd2q1ZnanWk5rlcZGMaX3q+WsUU6VzUa5PjK/Xq1tbbVStrk2e2WrXm40UrbZShvlVmrWUrPeStndrLKZisVimr0SPEvp4epqttyLZ47Iu3ZeC+IM1OvLWec/nD80U3o4kQUBABN12v5/+lj9/+3cUP8/E0/t/6fiUP+/90fvi/T/JzF1vLTh/v8fH4R/uU7/P93//47S/wMAAAAAAAAAAAAAwIvgUbtdaLfbhcHYHjwk3H8/4eVxxg5d/wOvSa+PszX04N5MRPWb7dJ2qTf25pfXoxLVKMdCFGKvc1sY6MU33lm5vpC65mP23lfd+qu/RJQujtYvRiHmx9cv9urTfn10xqm4Mly/FJ/ES+Prl8bWX4yF74bqi1GIXz+NWlRjrXt7e1L/5WJKb7+3cqA+380DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4L+hmAZei96+99uliMux3d+/v/gkYX50f/xe/f7++gtRiL3x+/MvjN2f/1K8emmy5w4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA43W/Y2sWi3XzysY7Pnf/WR6EDy96kIv/cGBqcsxmpx/1nFOGeROVHW5f5Jjph632+1ucPfr4x5w6rhLnTnfS/nbKcqnIuKInHb/Bzz9Uv8fEcOfXBzNyUfEgaqZ/nc/nx9qrhPkzu+iPLfgvO9EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMHn7m3533lyY9GoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYlEbr/kZWrZbrRwX5kyQfDiZ8igAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC+UvwMAAP//VssDZg==") open(&(0x7f0000000740)='./bus\x00', 0x14927e, 0x0) mount(&(0x7f0000000780)=@loop={'/dev/loop', 0x0}, &(0x7f00000007c0)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(0x0, 0x0, 0xa27b734c1a0bc97) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x7ffffffffffffffc, 0x3, 0x0, 0x0, 0x2, 0xd, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c000020c00200", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c20ff50c07ff2e50d000f000000000000000000004000", [0x0, 0x6]}) openat(0xffffffffffffff9c, &(0x7f0000000940)='./file1\x00', 0x42, 0x20) 4m14.132653805s ago: executing program 6 (id=1745): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000480), r0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)={0x20, r1, 0x321, 0x70bd25, 0x25dfdbfc, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000000) 4m11.465134897s ago: executing program 6 (id=1751): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="d8000000180081064e8100000000b904021d0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cfce1e090000001fb791643a5ee4ce1b14d6d930ede1d9d322fe7c9f8775730d165ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3f09ad809d5e1cace81ed0bffece0b42a9ecbee5dd6e4edef3d939641e0ec0f60cb180000008af26c8b7b55f4d2cb1df0966736a1dfe444c65ac5b348eac7c2ea475327557ba566236ceb00000000", 0xd7}], 0x1}, 0x24040000) 4m11.008557774s ago: executing program 36 (id=1751): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="d8000000180081064e8100000000b904021d0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cfce1e090000001fb791643a5ee4ce1b14d6d930ede1d9d322fe7c9f8775730d165ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3f09ad809d5e1cace81ed0bffece0b42a9ecbee5dd6e4edef3d939641e0ec0f60cb180000008af26c8b7b55f4d2cb1df0966736a1dfe444c65ac5b348eac7c2ea475327557ba566236ceb00000000", 0xd7}], 0x1}, 0x24040000) 4m2.017072152s ago: executing program 7 (id=1778): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0xc201}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0x4f}, @TCA_ROUTE4_IIF={0x8, 0x4, r3}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) 4m0.001615267s ago: executing program 7 (id=1779): r0 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000000100)={&(0x7f0000000180)=@in6={0xa, 0x4e24, 0x4, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x800c}, 0x1c, 0x0, 0x0, &(0x7f0000000240)=[@dstaddrv4={0x18, 0x84, 0x7, @loopback}], 0x18, 0x408c}, 0x8050) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./proc_mnt\x00', &(0x7f0000000380)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc_mnt/net/sctp/assocs\x00', 0x0, 0x0) lseek(r1, 0x800, 0x0) 3m59.655267242s ago: executing program 7 (id=1781): r0 = socket(0xa, 0x3, 0xff) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000440)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f0000000680)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x15}}}, 0x0, 0x8001}, 0x90) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, 0x0, &(0x7f0000000780)) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000500)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000580)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000600), 0x651, 0x0) recvmmsg(r4, &(0x7f0000000640), 0x10106, 0x2, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 3m57.185775445s ago: executing program 7 (id=1786): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000100), &(0x7f00000002c0)='./file0\x00', 0x200008, &(0x7f0000000300)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYRESOCT], 0x1, 0x3af, &(0x7f0000000380)="$eJzs3b9vW9UXAPBTt4nTfr+JMyAkQIirbixWEv6BRqiVEJFAoUalA+KVOMWKG0e2FeQKQQckVv4D9oqRDQnxD2QAZsTCloWxQ1Qj/0rtxE0T0sRUfD6SdY99z3m+z09+OsvT3b317b2N9UZxPWtG7lqKXETkHkXMd6OeC/0x142nY9iDeLNw6/fXP/jo9rvLKyvXV1O6sXzzraWU0twbP33+xfdXf27+78Mf5n7Mx878x7t/Lf258/LOK7uPb35WaaRKI23WmilLd2q1ZnanWk5rlcZGMaX3q+WsUU6VzUa5PjK/Xq1tbbVStrk2e2WrXm40UrbZShvlVmrWUrPeStndrLKZisVimr0SPEvp4epqttyLZ47Iu3ZeC+IM1OvLWec/nD80U3o4kQUBABN12v5/+lj9/+3cUP8/E0/t/6fiUP+/90fvi/T/JzF1vLTh/v8fH4R/uU7/P93//47S/wMAAAAAAAAAAAAAwIvgUbtdaLfbhcHYHjwk3H8/4eVxxg5d/wOvSa+PszX04N5MRPWb7dJ2qTf25pfXoxLVKMdCFGKvc1sY6MU33lm5vpC65mP23lfd+qu/RJQujtYvRiHmx9cv9urTfn10xqm4Mly/FJ/ES+Prl8bWX4yF74bqi1GIXz+NWlRjrXt7e1L/5WJKb7+3cqA+380DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4L+hmAZei96+99uliMux3d+/v/gkYX50f/xe/f7++gtRiL3x+/MvjN2f/1K8emmy5w4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA43W/Y2sWi3XzysY7Pnf/WR6EDy96kIv/cGBqcsxmpx/1nFOGeROVHW5f5Jjph632+1ucPfr4x5w6rhLnTnfS/nbKcqnIuKInHb/Bzz9Uv8fEcOfXBzNyUfEgaqZ/nc/nx9qrhPkzu+iPLfgvO9EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMHn7m3533lyY9GoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYlEbr/kZWrZbrRwX5kyQfDiZ8igAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC+UvwMAAP//VssDZg==") open(&(0x7f0000000740)='./bus\x00', 0x14927e, 0x0) mount(&(0x7f0000000780)=@loop={'/dev/loop', 0x0}, &(0x7f00000007c0)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000800)='./bus\x00', 0x0, 0xa27b734c1a0bc97) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x7ffffffffffffffc, 0x3, 0x0, 0x0, 0x2, 0xd, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c000020c00200", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c20ff50c07ff2e50d000f000000000000000000004000", [0x0, 0x6]}) openat(0xffffffffffffff9c, 0x0, 0x42, 0x20) 3m56.681737566s ago: executing program 7 (id=1788): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000500)={r1, 0x81, 0x7, 0x7}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r2, 0x89fa, &(0x7f0000000580)={'sit0\x00', &(0x7f0000000540)={@mcast2, @remote, 0x19, 0xb}}) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200)=0x2000008, 0x4) connect$inet(r3, &(0x7f0000000240)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0xfffffdef}}, 0x1) recvfrom(r3, &(0x7f0000000380)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) mknodat$md(0xffffffffffffff9c, &(0x7f0000000080)='./md0\x00', 0x6180, 0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x2c, 0x2, 0x6, 0x500, 0x0, 0x0, {0x3, 0x0, 0x2}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x84}, 0x4000080) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0002}]}) 3m54.736829985s ago: executing program 7 (id=1793): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r0], 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x10) 3m54.29247828s ago: executing program 37 (id=1793): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r0], 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x10) 3m47.070034477s ago: executing program 8 (id=1721): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x1400c, &(0x7f0000000840)={[{@stripe={'stripe', 0x3d, 0x3d}}, {@init_itable}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==") r0 = open(&(0x7f0000000080)='./file1\x00', 0x66842, 0x90) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x140000}], 0x14, 0x7800, 0x0, 0x3) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x242, 0x100) 3m46.400780195s ago: executing program 8 (id=1814): socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000001c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000002c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000300), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000400)=0x2) ioprio_get$uid(0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000440)={'veth1_virt_wifi\x00', &(0x7f0000000480)=@ethtool_dump={0x32, 0x9, 0x6, 0x15, "ad53a3712b67940eda0a0159c9030ecbb9013538fc"}}) r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, 0x0) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f00000004c0)=[{{&(0x7f0000000500)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000005c0)}}], 0x1, 0x2048001) mkdir(&(0x7f0000000340)='./dev\x00', 0x1fc) mount(0x0, &(0x7f0000000380)='./dev\x00', &(0x7f00000003c0)='devtmpfs\x00', 0x2, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./dev/sda\x00', 0x1c5e42, 0x0) write$P9_RUNLINKAT(r5, &(0x7f0000000580)={0xc, 0x4d, 0x1}, 0xffffffd7) 3m45.530233374s ago: executing program 8 (id=1816): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000012c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001300)={'syzkaller0\x00', 0x7001}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001340)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000001480), 0x0, 0x0) close(r5) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f00000014c0)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001500)={'syzkaller0\x00', 0x0}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000001540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newtfilter={0x90, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x60, 0x2, [@TCA_BASIC_ACT={0x5c, 0x3, [@m_simple={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x10, 0x3, '/de\x00\x00\x00\x00\x00\x00\x00\x00\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x8, 0x8, 0x4, 0x3, 0x1800}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(r4, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x0, r6, 0x22}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001800)="27030200080314000e00072f01000000000000113cfdcb00000080ed00827600000000000100", 0x26}, {&(0x7f0000001840)="99427f0000007f8f", 0x8}], 0x2}, 0x0) 3m45.195735849s ago: executing program 38 (id=1816): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000012c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001300)={'syzkaller0\x00', 0x7001}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001340)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000001480), 0x0, 0x0) close(r5) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f00000014c0)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001500)={'syzkaller0\x00', 0x0}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000001540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newtfilter={0x90, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x60, 0x2, [@TCA_BASIC_ACT={0x5c, 0x3, [@m_simple={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x10, 0x3, '/de\x00\x00\x00\x00\x00\x00\x00\x00\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x8, 0x8, 0x4, 0x3, 0x1800}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000016c0), 0x56) sendmsg$kcm(r4, &(0x7f0000001700)={&(0x7f0000001740)=@xdp={0x2c, 0x0, r6, 0x22}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001800)="27030200080314000e00072f01000000000000113cfdcb00000080ed00827600000000000100", 0x26}, {&(0x7f0000001840)="99427f0000007f8f", 0x8}], 0x2}, 0x0) 16.65906054s ago: executing program 3 (id=2577): setsockopt$SO_J1939_SEND_PRIO(0xffffffffffffffff, 0x6b, 0x3, &(0x7f0000000100)=0x3, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000240)=""/168, &(0x7f0000000400)=0xa8) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/serio/devices/serio0/drvctl\x00', 0x141441, 0x0) write(r1, &(0x7f0000000200)='atkbd', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) io_setup(0x6, &(0x7f0000001380)=0x0) io_submit(r3, 0x1, &(0x7f0000000340)=[&(0x7f0000000300)={0x1000000, 0x0, 0x0, 0x5, 0x8081, 0xffffffffffffffff, 0x0}]) write(r2, &(0x7f0000000100)='slave-24c02 0x1022', 0x12) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0a000000050000000100000007000000646c0000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYRESOCT=r4], 0x50) r6 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) landlock_restrict_self(r6, 0x8) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000340)=@o_path={&(0x7f0000000300)='./file0\x00', r5, 0x4000, r4}, 0x18) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r7, &(0x7f0000000180)='tcpci 0x2', 0x9) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000ac0)=@newqdisc={0x78, 0x24, 0xf0b, 0x70bd2c, 0x200, {0x0, 0x0, 0x12, 0x0, {0xc, 0xd}, {0xffff, 0x3}, {0x2, 0x1}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4000853, 0x1ff, 0x43ff, 0x1, 0x8005}, 0x0, 0x10000000, 0x2, 0x5, 0x6, 0x18, 0x13, 0xa, 0x0, 0x0, {0x0, 0x2521, 0xff, 0x9, 0x81, 0x8}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x4048810}, 0x2000000) socket$netlink(0x10, 0x3, 0xc) r8 = epoll_create1(0x0) r9 = fcntl$dupfd(r8, 0x2, 0xffffffffffffffff) r10 = fanotify_init(0x20, 0x0) fanotify_mark(r10, 0x445, 0x1003, r9, 0x0) write$P9_RFSYNC(r9, &(0x7f0000000040)={0x7, 0x33, 0x1}, 0x7) r11 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r11, 0xc0285700, &(0x7f0000000440)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r12, 0x40103e05, &(0x7f0000000480)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56"}) 13.52402942s ago: executing program 3 (id=2585): syz_emit_ethernet(0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaa"], 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000002240)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="73686f72746e616d653d77696e6e742c666c7573682c646d61736b3d30303030303030303030303030303030303137373737372c73686f72746e616d653d77696e39352c636865636b3d7374726963742c73686f72746e616d653d6d697865642c6e6f6e756d7461696c3d302c757466383d312c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c756e695f786c6174653d312c726f6469722c696f636861727365743d757466382c666d61736b3d30303030303030303030303030303030303030303030342c646d61736b3d30303030303030303030303030303030303030303030372c757466383d312c726f6469722c73686f72746e616d653d77696e39352c726f6469722c00743ccfec81d6c7d05b0f2a54ddce151ec4cbbaacb9552647fd950fedfdc024b3953e7669bc9d4f66e3beaecb80fe73633280b1d3e82023d4f5c7f5a4989406c0f0d0cf537f132dc1e63d84a17532cb78ae7a368bc0029207b9b166705972f4e8dad041e6be170bf43057b456d43f100c53b471aa6c8e3751", @ANYRES8=0x0], 0x1, 0x2c2, &(0x7f00000006c0)="$eJzs3T+LI2UYAPBndpNJ7iySwkoEB7SwOm6vtckiOThMpaRQC128O5AkCHew4CkGK1sbSz+BINj5JWwEP4DgB7DzioNXJpkh2btJsoHLrX9+vyL77Lzv877POzPZPyzz7sevziZ3i7j/9Ze/R7ebxdEgBvE4i34cRS2llGJl8G0AAP9mj1OKP9PSJVMG5UsWEd3DlgYAHMje3/9/OnhJAMCBvff+B++cjkbDd4uiG7dn35yPy9/sy4/L9tP78WlM417cjF48Wf4toP5poXy9nVKat4pSP96Yzc/HZebso1+q8U/riU6iF/1FdDH/zmh4Uiyt5c/LOq5X8w/K+W9FL15umP/OaHirIT/Gebz5+lr9N6IXv34Sn8U07i6KWOV/dVIUb6fv/vriw7K8Mj+bn487i34r6fjFXRUAAAAAAAAAAAAAAAAAAAAAAP7rblR753RisX9Peajaf+f4SflJO4pa/+L+PMv8rB7oqf2B5im+T6nTihgNbxZFkaqOq/xWvNKK1tWsGgAAAAAAAAAAAAAAAAAAAP5ZHn7+aHI2nd570BD8dj1iQ9OGoN4NoH6sf0fW8aamwdqR1+LR5KyzecC1pqMq3DJpHNd9soity4lWux65v9dJ2D+4tqnmH37cd8Du7j7tbefn+QT13TU5y6KxTyfqI936mv683iePS86Vb2pKu2+/tSBvbOrtvfb8pUUw39Insm2FvfXH8sxVR7KnV5EvzmpjenttN47me6P5Wmx6pzwjW7yt8+f3xQcAAAAAAAAAAAAAAAAAALhg9dDvM03XdqQepc7BygIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAF2r1///3COZV8iU65/Hg4RUvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BvwMAAP//QSRWPA==") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) 12.421988792s ago: executing program 3 (id=2589): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 12.222970843s ago: executing program 3 (id=2593): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x3a0001c, &(0x7f0000000200)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@barrier}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@nodiscard}, {@data_journal}]}, 0x1, 0x437, &(0x7f0000000900)="$eJzs289PHFUcAPDv7EKR/hBs6o/Sqmg1En9AobX24EWjiQdNTPRQjwi0wW6LKZjYhigaU4+miXfj0cS/wJNejHoy8ap306QxXFo9rZndGdhddrdAF7a6n08y8N7MW9777szbfW8eE0DPGk1/JBH7I+L3iBiqZusLjFZ/3Vpdnvl7dXkmiXL5rb+SSrmbq8szedH8dfvyTF9E4bMkjjSpd/HylfPTpdLcpSw/sXTh/YnFy1eem78wfW7u3NzFqdOnT56YfOHU1PMdiTON6+bIRwtHD7/2zrU3Zs5ce/fnb5M8/oY4OmS03cEny+UOV9ddB2rSSV8XG8KWFKvdNPor/X8oirF+8obi1U+72jhgR5XL5fIDrQ+vlIH/sSS63QKgO/Iv+nT+m2+7NPS4K9x4qToBSuO+lW3VI31RyMr0N8xvO2k0Is6s/PNVusXO3IcAAKjzfTr+ebbZ+K8QtfeF7s3WUIYj4r6IOBgRpyLiUETcH1Ep+2BEPNSskqR1/Y2LJBvHP4Xr2w5uE9Lx34vZ2lb9+C8f/cVwMcsdqMTfn5ydL80dz96TsegfSPOTber44ZXfvmh1rHb8l25p/flYMGvH9b6B+tfMTi9N30nMtW58EjHS1yz+ZG0lID19hyNiZJt1zD/9zdFWx24ffxsdWGcqfx3xVPX8r0RD/Lmk/frkxD1Rmjs+kV8VG/3y69U3W9V/R/F3QHr+9za9/tfiH05q12sXt17H1T8+bzmn2e71vyd5u27fh9NLS5cmI/Ykr1cbXbt/qqHc1Hr5NP6xY837/8FYfyeORER6ET8cEY9ExKNZ2x+LiMcj4lib+H96+Yn3thf/QJu/2hlp/LNbOv/riT3RuKd5onj+x+/qKh3ebPyRnf+TldRYtmczn3+badf2rmYAAAD47ylExP5ICuNr6UJhfLz6P/yHYm+htLC49MzZhQ8uzlafERiO/kJ+p2uo5n7oZDatz/NTDfkT2X3jL4uDlfz4zEJpttvBQ4/b16L/p/4sdrt1wI7zvBb0Lv0fepf+D71L/4fe1aT/D3ajHcDua/b9/3EX2gHsvob+b9kPeoj5P/Qu/R96l/4PPWlxMG7/kLyExIZEFO6KZkjsUKLbn0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACd8W8AAAD//zpS5t0=") syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000000, &(0x7f00000004c0)={[{@nodioread_nolock}], [{@audit}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@subj_role={'subj_role', 0x3d, 'debug_want_extra_isize'}}, {@euid_lt}]}, 0xfe, 0x2a4, &(0x7f0000000a80)="$eJzs3bFrJFUcB/DfzO4mxjuOUxsrEUREA+EsBMFGGw8O5BARQQ9O5LRRLkJM2qyVjYW9SiqbIFYaBRuxCTb+AVFTxMYmWBgUTDGyO7Oy2Ww2s+7srGQ/H9jZN5s3eW/Jft9MmJl9AcytqxHxbEQ0ImI5IloRkfRXeDh/XC1Wt5Z2b0dk2Uu/J916+Xqut92liGhHxNMRzd7PNnZeO/hz7/pjH663Hv1s59Wlut5fv8OD/ReOPr35wVc3ntxIi9cuF8/976NKyZDXmknE/dNo7H8iaZasuDjljnCOL37q5P6BiHikm/9WpEVkP1pb+L4VT3wyfLuFo3r7CUxDlrU6+8B2BsydtHsMnKQrEZGX03RlJT+G/7mRxDura+8tv7W6fvfOrEcq4FxfHmfZ6BpJO/+/d//5bxa/vjSQ/98aef5LeaqKDgN16+T/5Re3f+mUjxqz7g1Qg297hU7+l1/ffDzkHy6UMifX5B8umrInXuUf5tlY+U/r6RMwplHZHXF9lf0/zC/5h/lVNv/tGvsEVKTVKwxP8OT7/7+KKwj/exeBul3pLh3/w/wayH9xyUBxt2q5g/7rb955e3odBKp2q1fozz8AMF+yxRnfgAzMzKzHHwAAAAAAAAAAAAAAAAAA4LStpd3bvUddbf7wccThc/m0Rf3t59MWNIppR+7pLu/9Izkxu1Ey1mxHw92acPtJfV7x3dc3R8z3MMyVX6ttv/xfZKG7/PGhqtvPvX9y9czp8DbvRrQ7la81m6c//0nZaW/O/P33nbNh641yDVQlGVh/5pV62x90vD3b9m/sRXzXGX+uDRv/0niw+zx8/Lnc/xXL8e9Heizv/j1J7wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKjTPwEAAP//d/F4Hg==") socket(0x1a, 0x800, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32, @ANYBLOB="0100000002"], 0x40) bpf$ENABLE_STATS(0x20, 0x0, 0x0) unshare(0x22020600) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x3, 0x6, &(0x7f0000000540)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x16, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000800)={r4, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000880)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000008c0)={'xfrm0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000d40)="10131400e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000d80)={0x11, 0x0, r6}, 0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000640)="63eced8e46dc3f01000000000000", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/timer_list\x00', 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x28000, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1, 0x2, 0x3a0, 0x5}, 0x50) 9.788511151s ago: executing program 3 (id=2604): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) 9.479316003s ago: executing program 3 (id=2607): r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) 7.834154051s ago: executing program 0 (id=2617): socket$rxrpc(0x21, 0x2, 0x2) mkdirat(0xffffffffffffffff, 0x0, 0x4) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000001300)='./file0\x00', 0x2a0935e, &(0x7f0000001340)={[{@abort}, {@discard}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x5}}, {@dioread_nolock}, {@dioread_nolock}, {@oldalloc}, {@sysvgroups}]}, 0x2, 0x44a, &(0x7f00000013c0)="$eJzs281vFOUfAPDvzLbl9+OtFfEFRK0SY+NLSwsqBy8aTTxgNNEDHuu2EMJCDa2JECLVGLyYGBI9G48m/gXevBj1ZOJV74aEKBfQU83MzsDuslsobHcr+/kkA8+z82yf57vPPDPPzLMbwMAaz/5JIrZGxG8RMVrPNhcYr/939fLZ6t+Xz1aTWFl5688kL3fl8tlqWbR835YiM5FGpJ8kRSXNFk+fOT5bq82fKvJTSyfem1o8febZYydmj84fnT85c/Dggf3TLzw/81xX4sziurL7w4U9u15758Lr1cMX3v3p26y9W4v9jXF0y3gW+F8rudZ9T3S7sj7b1pBOhvrYENakEhFZdw3n4380KnG980bj1Y/72jhgXWXXpk2ddy+vAHexJPrdAqA/ygt9dv9bbj2aemwIl16q3wBlcV8ttvqeoUiLMsMt97fdNB4Rh5f/+SrbYp2eQwAANPqs+uWheKbd/C+N+xvKbS/WUMYi4p6I2BER90bEzoi4LyIv+0BEPLjG+luXhm6c/6QXbyuwW5TN/14s1raa53/l7C/GKkVuWx7/cHLkWG1+X/GZTMTwpiw/vUod37/y6+ed9jXO/7Itq7+cCxbtuDjU8oBubnZpNp+UdsGljyJ2D7WLP7m2EpBExK6I2L22P729TBx76ps9nQrdPP5VdGGdaeXriCfr/b8cLfGXktXXJ6f+F7X5fVPlUXGjn385/2an+u8o/i7I+n9z8/HfWmQsaVyvXVx7Hed//7TjPc3tHv8jydv5+WikeO2D2aWlU9MRI8mhPN/0+sz195b5snwW/8Te9uN/R/GeLP6HIiI7iB+OiEci4tGi7Y9FxOMRsXeV+H98ufO+jdD/c23Pf9eO/5b+X3uicvyH7zrVf2v9fyBPTRSv5Oe/m7jVBt7JZwcAAAD/FWn+HfgknbyWTtPJyfp3+HfG5rS2sLj09JGF90/O1b8rPxbDafmka7Theeh0slz8xXp+pnhWXO7fXzw3/qLy/zw/WV2ozfU5dhh0WzqM/8wflX63Dlh37dbRZkb60BCg51rHf9qcPfdGLxsD9JTfa8Pgusn4T3vVDqD3XP9hcLUb/+da8tYC4O7k+g+Dy/iHwWX8w+Ay/mEg3cnv+iUGORHphmiGxDol+n1mAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6I5/AwAA///K8u7c") prlimit64(0x0, 0xe, &(0x7f0000001840)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001880)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000018c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001940)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000019c0), 0x400000000000041, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x1004800, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x20) write(r3, &(0x7f00000003c0)='3', 0x4e) unlinkat(r3, 0x0, 0x0) 7.274022898s ago: executing program 4 (id=2619): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x601, 0x2, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xfff2}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=@newtfilter={0x38, 0x2c, 0x601, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r2, {0xb, 0x5}, {0x5, 0xffff}, {0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x8, 0x2, [@TCA_FLOW_EMATCHES={0x4}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2400c8d0}, 0x0) 7.272604118s ago: executing program 9 (id=2621): openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi0\x00', 0x8001, 0x0) epoll_create(0xb398) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001400), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f0000001440)) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000001340)={'rti800\x00', [0x100, 0x4005, 0x300, 0xe1, 0xe, 0x1, 0x69, 0x10000, 0x3, 0x0, 0x20000009, 0x4, 0x7, 0xffffff0b, 0x1, 0xfc, 0x0, 0x107ff, 0x2, 0x4, 0x89, 0x7ff, 0x80000, 0x7e4d, 0x7ff, 0xf39d, 0x3fb, 0x8, 0x1a4b5, 0x0, 0xfffffff8]}) 6.576707799s ago: executing program 0 (id=2622): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x161) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10) write(r0, &(0x7f0000000380)='100', 0x3) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x400000009) 6.56670565s ago: executing program 4 (id=2623): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000580), 0x48000) read(r0, &(0x7f0000000780)=""/202, 0xca) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x4058534c, &(0x7f0000000880)={0x80, 0x2, {0x1, 0x3, 0x453, 0x2, 0x2c3}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000140)={0x1000, 0xeb, 0x0, 'queue0\x00', 0xdc44}) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r0, 0x80045300, 0x0) 6.56644644s ago: executing program 1 (id=2624): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r0, &(0x7f0000000500)=ANY=[@ANYBLOB='b *:* r'], 0x8) write$cgroup_devices(r0, &(0x7f0000000140)=ANY=[@ANYBLOB='b *:4\tw'], 0xa) 6.56523218s ago: executing program 9 (id=2625): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000500)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000540), 0x103000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000580)={0x4, r0, 0x80000}) ioctl$DMA_BUF_SET_NAME_A(r2, 0x40086203, &(0x7f00000005c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000600)=0x1) close_range(r0, r1, 0x0) 5.77912424s ago: executing program 1 (id=2626): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r1) write$tun(r0, &(0x7f0000000340)={@val={0x0, 0x891f}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x67, 0x0, 0x3, 0x2f, 0x0, @private=0x1fe1, @multicast1}, {0xa000, 0x86dd, 0xc, 0x0, @opaque="2e97935b"}}}}}}, 0x32) 5.776532861s ago: executing program 9 (id=2627): socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x40080, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x63) r1 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c004}, 0x4c840) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r2, 0x0, 0x0) sendmmsg(r2, &(0x7f00000014c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x400c010) 4.780258072s ago: executing program 4 (id=2628): r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) 3.618701721s ago: executing program 0 (id=2629): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 3.618510401s ago: executing program 4 (id=2630): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) socket(0x400000000010, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = add_key(&(0x7f0000000140)='id_resolver\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f0000000280)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r6, r4, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000005c0), r7) sendmsg$NLBL_MGMT_C_ADD(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000006c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000040000000000001000000080000e000000105000100000000000800020005000000ad1c79393a496908bc7aff6ea8d89009ef1005d12f091077b6c7b0973346636c3e0a1da33a5b37cbfe7b22cfadaa3f9024a7b7699cfa7921bb23a59f568199efa8d42319c192d7"], 0x34}}, 0x2404c0c0) pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r6, r9, 0x100000000000a3) r10 = syz_io_uring_setup(0x2e4c, &(0x7f0000000440)={0x0, 0x3ae8, 0x2000, 0x1, 0x309, 0x0, r5}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) syz_ublk_setup_queues(r3, r1, &(0x7f0000000040)={0x0, 0x4d00, 0x10, 0xffeffffd, 0x230, 0x0, r10}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x402, 0x10, 0x8000003, 0x112, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x4000, 0x1, 0x3ac, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x20, 0x4003bfff, 0x299, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626f, 0x800, 0x11, 0x26d}}], 0x1, 0x0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0xffffc000) 3.618282101s ago: executing program 1 (id=2631): socket$rxrpc(0x21, 0x2, 0x2) mkdirat(0xffffffffffffffff, 0x0, 0x4) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000001300)='./file0\x00', 0x2a0935e, &(0x7f0000001340)={[{@abort}, {@discard}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x5}}, {@dioread_nolock}, {@dioread_nolock}, {@oldalloc}, {@sysvgroups}]}, 0x2, 0x44a, &(0x7f00000013c0)="$eJzs281vFOUfAPDvzLbl9+OtFfEFRK0SY+NLSwsqBy8aTTxgNNEDHuu2EMJCDa2JECLVGLyYGBI9G48m/gXevBj1ZOJV74aEKBfQU83MzsDuslsobHcr+/kkA8+z82yf57vPPDPPzLMbwMAaz/5JIrZGxG8RMVrPNhcYr/939fLZ6t+Xz1aTWFl5688kL3fl8tlqWbR835YiM5FGpJ8kRSXNFk+fOT5bq82fKvJTSyfem1o8febZYydmj84fnT85c/Dggf3TLzw/81xX4sziurL7w4U9u15758Lr1cMX3v3p26y9W4v9jXF0y3gW+F8rudZ9T3S7sj7b1pBOhvrYENakEhFZdw3n4380KnG980bj1Y/72jhgXWXXpk2ddy+vAHexJPrdAqA/ygt9dv9bbj2aemwIl16q3wBlcV8ttvqeoUiLMsMt97fdNB4Rh5f/+SrbYp2eQwAANPqs+uWheKbd/C+N+xvKbS/WUMYi4p6I2BER90bEzoi4LyIv+0BEPLjG+luXhm6c/6QXbyuwW5TN/14s1raa53/l7C/GKkVuWx7/cHLkWG1+X/GZTMTwpiw/vUod37/y6+ed9jXO/7Itq7+cCxbtuDjU8oBubnZpNp+UdsGljyJ2D7WLP7m2EpBExK6I2L22P729TBx76ps9nQrdPP5VdGGdaeXriCfr/b8cLfGXktXXJ6f+F7X5fVPlUXGjn385/2an+u8o/i7I+n9z8/HfWmQsaVyvXVx7Hed//7TjPc3tHv8jydv5+WikeO2D2aWlU9MRI8mhPN/0+sz195b5snwW/8Te9uN/R/GeLP6HIiI7iB+OiEci4tGi7Y9FxOMRsXeV+H98ufO+jdD/c23Pf9eO/5b+X3uicvyH7zrVf2v9fyBPTRSv5Oe/m7jVBt7JZwcAAAD/FWn+HfgknbyWTtPJyfp3+HfG5rS2sLj09JGF90/O1b8rPxbDafmka7Theeh0slz8xXp+pnhWXO7fXzw3/qLy/zw/WV2ozfU5dhh0WzqM/8wflX63Dlh37dbRZkb60BCg51rHf9qcPfdGLxsD9JTfa8Pgusn4T3vVDqD3XP9hcLUb/+da8tYC4O7k+g+Dy/iHwWX8w+Ay/mEg3cnv+iUGORHphmiGxDol+n1mAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6I5/AwAA///K8u7c") prlimit64(0x0, 0xe, &(0x7f0000001840)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001880)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000018c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001940)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000019c0), 0x400000000000041, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x1004800, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x20) write(r3, &(0x7f00000003c0)='3', 0x4e) unlinkat(r3, 0x0, 0x0) 3.617483691s ago: executing program 9 (id=2632): connect$vsock_stream(0xffffffffffffffff, &(0x7f0000002e40)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES16=r2, @ANYRES8=r1, @ANYRES32=r3, @ANYBLOB='\n\x004'], 0x28}}, 0x0) connect$can_bcm(r0, &(0x7f0000000040), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="0100"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) io_setup(0x2, &(0x7f0000000780)=0x0) io_submit(r6, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x8, 0x1, 0x6d, 0x1, 0x3, 0x2, 0x100000000}, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000840)={0x38, 0x6, 0x8, 0x0, 0x0, 0x9, 0xffffff7fffffffff, 0xfffffdfffffffffd, 0xffffffc0, 0xffffffff}, 0x0) r7 = signalfd4(0xffffffffffffffff, &(0x7f0000000880)={[0xffeffffffffffffa]}, 0x8, 0x800) r8 = syz_io_uring_setup(0xf0c, &(0x7f00000008c0)={0x0, 0x595d, 0x8, 0x1, 0x1000051}, &(0x7f0000000940)=0x0, &(0x7f0000000980)=0x0, &(0x7f00000009c0)=0x0) syz_io_uring_submit(r9, r10, r11, &(0x7f0000000a00)=@IORING_OP_POLL_ADD={0x6, 0x10, 0x0, @fd=r7, 0x0, 0x0, 0x0, {0x3208}}) io_uring_enter(r8, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r12 = gettid() timer_create(0x0, &(0x7f0000000a80)={0x0, 0x11, 0x4, @tid=r12}, &(0x7f0000000ac0)) timer_settime(0x0, 0x0, &(0x7f0000000b00)={{0x0, 0x1}, {0x0, 0xe4c}}, 0x0) sendmsg$802154_dgram(r5, &(0x7f0000000580)={&(0x7f0000000440)={0x24, @short={0x2, 0x1, 0x511466046f0ea0d6}}, 0x14, &(0x7f0000000540)={&(0x7f0000000480)="a69de28e79d99fff69dc3e5db5b21d99f426d4b508551b7c60a34aaaf1ce7ca64ec9e0375be8be625f4386d4915cc98521a2ed2e7d208863456d921970ca0550a9e2a993bde07af2c419398a1aac5829204846589b886f11324635e5b8c922bbf31611920cebd633ebbbe50af58dba3d4a2e0c290e125d5dc002d1517093fe1a0be57071aa67c8", 0x87}, 0x1, 0x0, 0x0, 0x40400}, 0x90) sendmsg$can_bcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="010000006b0100000100000000000000", @ANYRES64=0x0, @ANYRESOCT=r0, @ANYRES64=0x0, @ANYRES64=r4, @ANYBLOB="0000000003"], 0x48}}, 0x20000000) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000700)=@IORING_OP_TEE={0x21, 0x40, 0x0, @fd, 0x0, 0x0, 0x2ad6, 0x5}) io_uring_enter(0xffffffffffffffff, 0x1, 0x1, 0x1, 0x0, 0x0) 2.55501725s ago: executing program 0 (id=2633): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x601, 0x2, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xfff2}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=@newtfilter={0x38, 0x2c, 0x601, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r2, {0xb, 0x5}, {0x5, 0xffff}, {0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x8, 0x2, [@TCA_FLOW_EMATCHES={0x4}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2400c8d0}, 0x0) 2.535937112s ago: executing program 1 (id=2634): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e80)}, 0x400c044) 2.529278222s ago: executing program 4 (id=2635): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000500)=ANY=[@ANYBLOB='b *:* r'], 0x8) write$cgroup_devices(r1, &(0x7f0000000140)=ANY=[@ANYBLOB='b *:4\tw'], 0xa) 1.310370086s ago: executing program 0 (id=2636): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000080)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25555, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.310239197s ago: executing program 4 (id=2637): syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 1.310089057s ago: executing program 1 (id=2638): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) close_range(r0, r1, 0x0) 1.307503917s ago: executing program 9 (id=2639): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) socket(0x400000000010, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe}}}, &(0x7f0000000300)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r1) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff}, 0x80) r3 = add_key(&(0x7f0000000140)='id_resolver\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f0000000280)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r2, 0x0) 46.107715ms ago: executing program 0 (id=2640): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x8) r0 = openat$binderfs_feature(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000240)={0xffffffffffffffff, r0}, 0xc) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000480)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000580)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000600), 0x318, 0x0) recvmmsg(r2, &(0x7f0000000640), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) syz_open_dev$loop(0x0, 0x4, 0x4942) setitimer(0x1, &(0x7f00000006c0)={{}, {0x0, 0x2710}}, 0x0) r4 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x39, 0x0, 0x0) connect$inet6(r4, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/sda\x00', 0x101042, 0x5) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000140)={'sit0\x00', 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x40000000) 15.780489ms ago: executing program 1 (id=2641): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r1) write$tun(r0, &(0x7f0000000340)={@val={0x0, 0x891f}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x67, 0x0, 0x3, 0x2f, 0x0, @private=0x1fe1, @multicast1}, {0xa000, 0x86dd, 0xc, 0x0, @opaque="2e97935b"}}}}}}, 0x32) 0s ago: executing program 9 (id=2642): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000180)=@NCI_OP_CORE_RESET_RSP={0x0, 0x0, 0x2, 0x0, 0x3}, 0x6) write$nci(r0, &(0x7f00000001c0)=@NCI_OP_CORE_INIT_RSP={0x0, 0x0, 0x2, 0x1, 0x11, {{}, {0x0, 0x0, 0xff, 0xae}}}, 0x14) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x42}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x24}}, 0x0) write$nci(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="60400104"], 0xc) kernel console output (not intermixed with test programs): addresses unique to avoid problems! [ 432.996638][T10535] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 433.038695][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 433.062756][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 433.104626][T10535] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 433.122237][T10535] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 433.141337][T10535] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 433.158133][T11038] loop9: detected capacity change from 0 to 128 [ 433.182486][T10535] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 433.260653][T11038] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 433.346750][T11038] ext4 filesystem being mounted at /22/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 433.383391][T10712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 433.450654][ T5922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 433.480703][ T5922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 433.508904][T10712] 8021q: adding VLAN 0 to HW filter on device team0 [ 433.993433][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 434.016356][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 434.078233][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 434.151688][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 434.189464][ T4481] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.196691][ T4481] bridge0: port 1(bridge_slave_0) entered forwarding state [ 434.207892][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 434.224036][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 434.251402][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 434.289446][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 434.300814][ T4481] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.308073][ T4481] bridge0: port 2(bridge_slave_1) entered forwarding state [ 434.486917][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 434.522523][ T5922] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 434.530546][ T5922] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 434.540506][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 434.563320][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 434.583882][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 434.632968][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 434.660765][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 434.707340][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 434.727907][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 434.760091][T10312] EXT4-fs (loop9): unmounting filesystem. [ 434.788114][T10712] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 434.848265][T10712] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 434.935111][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 434.960260][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 435.032693][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 435.056504][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 435.096549][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 436.166949][T11092] device ip6tnl1 entered promiscuous mode [ 436.234692][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 436.260110][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 436.277904][T11094] loop9: detected capacity change from 0 to 128 [ 436.310564][T10712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 436.484726][T11099] netlink: 236 bytes leftover after parsing attributes in process `syz.9.1900'. [ 438.552293][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 438.580851][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 438.634243][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 438.643732][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 438.685368][T10712] device veth0_vlan entered promiscuous mode [ 438.704219][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 438.738137][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 438.776948][T10712] device veth1_vlan entered promiscuous mode [ 438.874624][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 438.892964][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 438.914478][T10712] device veth0_macvtap entered promiscuous mode [ 439.025186][T10712] device veth1_macvtap entered promiscuous mode [ 439.121345][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 439.161862][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 439.190125][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 439.217214][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 439.234368][T11153] loop3: detected capacity change from 0 to 128 [ 439.247640][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 439.277967][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 439.385586][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 439.445029][T11153] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 439.459184][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 439.472321][T11153] ext4 filesystem being mounted at /460/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 439.509489][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 439.588124][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 439.644201][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 439.686449][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 439.725634][T10712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 439.779360][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 439.788840][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 439.816485][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 439.852582][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 439.878117][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 439.906886][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 439.935041][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.941496][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.953580][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 440.033983][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.080158][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 440.124019][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.134314][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 440.161546][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.192009][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 440.211900][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.231872][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 440.252356][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.312265][T10712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 440.325126][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 440.335201][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 440.369167][T10712] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.403174][T10712] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.419366][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 440.452121][T10712] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.508434][T10712] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.731405][ T4412] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 440.790598][ T4412] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 440.861770][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 440.868126][T11192] loop3: detected capacity change from 0 to 128 [ 440.900070][T11103] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 440.952535][T11103] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 440.971986][ T6332] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 441.092103][T11197] netlink: 236 bytes leftover after parsing attributes in process `syz.3.1924'. [ 441.759621][T11215] loop4: detected capacity change from 0 to 128 [ 441.810949][T11215] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 441.835114][T11215] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 441.953479][T11221] loop6: detected capacity change from 0 to 7 [ 441.964516][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 441.974188][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.009434][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 442.019467][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.071764][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 442.082173][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.101903][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 442.111331][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.121038][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 442.130351][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.154026][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 442.163829][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.218084][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 442.227736][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.236512][T10577] ldm_validate_partition_table(): Disk read failed. [ 442.246136][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 442.256134][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.286057][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 442.295430][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.303843][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 442.313064][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 442.371524][T10577] Dev loop6: unable to read RDB block 0 [ 442.379924][T10577] loop6: unable to read partition table [ 442.403895][T10577] loop6: partition table beyond EOD, truncated [ 442.433880][T11221] ldm_validate_partition_table(): Disk read failed. [ 442.455258][T11221] Dev loop6: unable to read RDB block 0 [ 442.473834][T11221] loop6: unable to read partition table [ 442.500367][T11221] loop6: partition table beyond EOD, truncated [ 442.534605][T11221] loop_reread_partitions: partition scan of loop6 (úùƒå¡™‰ü¾SêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆŠ5) failed (rc=-5) [ 442.685679][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055f15000: rx timeout, send abort [ 442.694938][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888055f15000: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 443.009346][T10712] EXT4-fs (loop4): unmounting filesystem. [ 443.883868][T11269] loop4: detected capacity change from 0 to 128 [ 443.966496][T11269] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 444.017877][T11269] ext4 filesystem being mounted at /6/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 444.298015][T11278] device syzkaller0 entered promiscuous mode [ 444.399657][ T26] audit: type=1326 audit(1793738699.355:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 444.450819][T11291] netlink: 236 bytes leftover after parsing attributes in process `syz.0.1947'. [ 444.482810][ T26] audit: type=1326 audit(1793738699.365:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 444.596523][ T26] audit: type=1326 audit(1793738699.365:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 444.697957][ T26] audit: type=1326 audit(1793738699.365:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 444.818823][ T26] audit: type=1326 audit(1793738699.365:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 444.931294][ T26] audit: type=1326 audit(1793738699.365:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 445.038814][ T26] audit: type=1326 audit(1793738699.365:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 445.064554][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880546be800: rx timeout, send abort [ 445.074304][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff8880546be800: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 445.108645][T10712] EXT4-fs (loop4): unmounting filesystem. [ 445.201922][ T26] audit: type=1326 audit(1793738699.365:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 445.321665][ T26] audit: type=1326 audit(1793738699.365:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 445.440132][ T26] audit: type=1326 audit(1793738699.365:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.3.1948" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f819f39fb19 code=0x7ffc0000 [ 445.665841][T11319] loop4: detected capacity change from 0 to 512 [ 445.789101][T11319] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 445.857273][T11319] ext4 filesystem being mounted at /8/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 446.000138][T10712] EXT4-fs (loop4): unmounting filesystem. [ 446.923467][T11348] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1958'. [ 447.022743][T11349] block device autoloading is deprecated and will be removed. [ 447.036711][T11349] loop3: detected capacity change from 0 to 164 [ 447.084520][T10577] blk_print_req_error: 28 callbacks suppressed [ 447.084537][T10577] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 449.190694][ T30] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.395825][ T30] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.561749][T11371] loop1: detected capacity change from 0 to 512 [ 449.576533][ T30] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.662157][T11370] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 449.670412][T11370] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 449.679669][T11371] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 449.692192][T11371] ext4 filesystem being mounted at /9/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 449.751126][T11370] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 449.822136][T11370] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 449.862271][T11378] loop9: detected capacity change from 0 to 1764 [ 449.988768][T10535] EXT4-fs (loop1): unmounting filesystem. [ 449.997483][T11381] loop3: detected capacity change from 0 to 128 [ 450.165256][ T30] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 450.220108][T11387] netlink: 236 bytes leftover after parsing attributes in process `syz.3.1969'. [ 450.609535][ C1] vcan0: j1939_tp_rxtimer: 0xffff888056ece800: rx timeout, send abort [ 450.650282][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888056ece800: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 451.736494][T11428] loop9: detected capacity change from 0 to 512 [ 452.214735][T11437] FAULT_INJECTION: forcing a failure. [ 452.214735][T11437] name failslab, interval 1, probability 0, space 0, times 0 [ 452.228170][T11437] CPU: 1 PID: 11437 Comm: syz.9.1983 Not tainted syzkaller #0 [ 452.236997][T11437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 452.247599][T11437] Call Trace: [ 452.251031][T11437] [ 452.254483][T11437] dump_stack_lvl+0x188/0x24e [ 452.259718][T11437] ? show_regs_print_info+0x12/0x12 [ 452.264942][T11437] ? load_image+0x410/0x410 [ 452.269468][T11437] ? __might_sleep+0xd0/0xd0 [ 452.274073][T11437] ? __lock_acquire+0x7ea0/0x7ea0 [ 452.279377][T11437] should_fail_ex+0x390/0x4c0 [ 452.284098][T11437] should_failslab+0x5/0x20 [ 452.288641][T11437] slab_pre_alloc_hook+0x59/0x300 [ 452.293737][T11437] kmem_cache_alloc+0x56/0x2f0 [ 452.298855][T11437] ? getname_flags+0xb7/0x500 [ 452.303763][T11437] getname_flags+0xb7/0x500 [ 452.308293][T11437] __x64_sys_unlinkat+0xaa/0xe0 [ 452.313163][T11437] do_syscall_64+0x4c/0xa0 [ 452.317599][T11437] ? clear_bhb_loop+0x60/0xb0 [ 452.322293][T11437] ? clear_bhb_loop+0x60/0xb0 [ 452.326993][T11437] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 452.332905][T11437] RIP: 0033:0x7f17f299fb19 [ 452.337335][T11437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.359434][T11437] RSP: 002b:00007f17f38c3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 452.368697][T11437] RAX: ffffffffffffffda RBX: 00007f17f2c26180 RCX: 00007f17f299fb19 [ 452.377133][T11437] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 452.385997][T11437] RBP: 00007f17f2a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 452.394533][T11437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 452.402937][T11437] R13: 00007f17f2c26218 R14: 00007f17f2c26180 R15: 00007ffc2c0306a8 [ 452.411845][T11437] [ 452.703797][T11442] loop9: detected capacity change from 0 to 512 [ 452.765438][T11442] EXT4-fs error (device loop9): ext4_orphan_get:1435: comm syz.9.1986: bad orphan inode 15 [ 452.832545][T11442] ext4_test_bit(bit=14, block=18) = 1 [ 452.862593][T11442] is_bad_inode(inode)=0 [ 452.879241][T11442] NEXT_ORPHAN(inode)=1023 [ 452.954031][T11442] max_ino=32 [ 452.976319][T11442] i_nlink=0 [ 453.004502][T11442] EXT4-fs error (device loop9): ext4_xattr_delete_inode:2921: inode #15: comm syz.9.1986: corrupted xattr block 19 [ 453.059904][T11442] EXT4-fs warning (device loop9): ext4_evict_inode:301: xattr delete (err -117) [ 453.109703][T11442] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 453.132818][T11442] ext4 filesystem being mounted at /44/éq‰Y’3aK supports timestamps until 2038-01-19 (0x7fffffff) [ 453.261712][T10312] EXT4-fs (loop9): unmounting filesystem. [ 453.264330][ C0] vcan0: j1939_tp_rxtimer: 0xffff888077944000: rx timeout, send abort [ 453.276319][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888077944000: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 453.755453][T11475] loop4: detected capacity change from 0 to 512 [ 453.943808][T11475] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 453.964083][T11475] ext4 filesystem being mounted at /16/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 454.081218][T11488] loop1: detected capacity change from 0 to 512 [ 454.084606][T11487] loop3: detected capacity change from 0 to 128 [ 454.104633][T10712] EXT4-fs (loop4): unmounting filesystem. [ 454.430937][T11496] netlink: 236 bytes leftover after parsing attributes in process `syz.3.1997'. [ 454.785028][T11497] FAULT_INJECTION: forcing a failure. [ 454.785028][T11497] name failslab, interval 1, probability 0, space 0, times 0 [ 454.798905][T11497] CPU: 1 PID: 11497 Comm: syz.1.1998 Not tainted syzkaller #0 [ 454.806722][T11497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 454.817085][T11497] Call Trace: [ 454.821002][T11497] [ 454.823950][T11497] dump_stack_lvl+0x188/0x24e [ 454.829161][T11497] ? show_regs_print_info+0x12/0x12 [ 454.835070][T11497] ? load_image+0x410/0x410 [ 454.839734][T11497] ? __might_sleep+0xd0/0xd0 [ 454.844369][T11497] ? __lock_acquire+0x7ea0/0x7ea0 [ 454.850534][T11497] should_fail_ex+0x390/0x4c0 [ 454.856106][T11497] should_failslab+0x5/0x20 [ 454.861079][T11497] slab_pre_alloc_hook+0x59/0x300 [ 454.866153][T11497] kmem_cache_alloc+0x56/0x2f0 [ 454.871394][T11497] ? getname_flags+0xb7/0x500 [ 454.876659][T11497] getname_flags+0xb7/0x500 [ 454.881271][T11497] __x64_sys_unlinkat+0xaa/0xe0 [ 454.886186][T11497] do_syscall_64+0x4c/0xa0 [ 454.891712][T11497] ? clear_bhb_loop+0x60/0xb0 [ 454.896597][T11497] ? clear_bhb_loop+0x60/0xb0 [ 454.904685][T11497] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 454.910845][T11497] RIP: 0033:0x7f31cff9fb19 [ 454.915994][T11497] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 454.936241][T11497] RSP: 002b:00007f31d0eba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 454.944959][T11497] RAX: ffffffffffffffda RBX: 00007f31d0226180 RCX: 00007f31cff9fb19 [ 454.953499][T11497] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 454.961784][T11497] RBP: 00007f31d0037b70 R08: 0000000000000000 R09: 0000000000000000 [ 454.971174][T11497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 454.979614][T11497] R13: 00007f31d0226218 R14: 00007f31d0226180 R15: 00007ffd12534378 [ 454.988148][T11497] [ 455.751929][T11508] device syzkaller0 entered promiscuous mode [ 455.998983][ T30] device hsr_slave_0 left promiscuous mode [ 456.034923][ T30] device hsr_slave_1 left promiscuous mode [ 456.090622][ T30] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 456.100617][ T30] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 456.142871][ T30] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 456.150462][ T30] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 456.181770][ T30] device bridge_slave_1 left promiscuous mode [ 456.190577][ T30] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.211417][ T30] device bridge_slave_0 left promiscuous mode [ 456.218473][ T30] bridge0: port 1(bridge_slave_0) entered disabled state [ 456.254680][ T30] device veth1_macvtap left promiscuous mode [ 456.261491][ T30] device veth0_macvtap left promiscuous mode [ 456.270075][ T30] device veth1_vlan left promiscuous mode [ 456.286684][ T30] device veth0_vlan left promiscuous mode [ 456.793251][ C1] vcan0: j1939_tp_rxtimer: 0xffff888029388c00: rx timeout, send abort [ 456.801669][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888029388c00: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 456.828828][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802ac15800: rx timeout, send abort [ 456.842204][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88802ac15800: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 457.099819][T11545] FAULT_INJECTION: forcing a failure. [ 457.099819][T11545] name failslab, interval 1, probability 0, space 0, times 0 [ 457.114296][T11545] CPU: 1 PID: 11545 Comm: syz.0.2011 Not tainted syzkaller #0 [ 457.121984][T11545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 457.132201][T11545] Call Trace: [ 457.135908][T11545] [ 457.138943][T11545] dump_stack_lvl+0x188/0x24e [ 457.143652][T11545] ? show_regs_print_info+0x12/0x12 [ 457.148970][T11545] ? load_image+0x410/0x410 [ 457.154035][T11545] ? __might_sleep+0xd0/0xd0 [ 457.158911][T11545] ? __lock_acquire+0x7ea0/0x7ea0 [ 457.163965][T11545] should_fail_ex+0x390/0x4c0 [ 457.168672][T11545] should_failslab+0x5/0x20 [ 457.173543][T11545] slab_pre_alloc_hook+0x59/0x300 [ 457.178645][T11545] kmem_cache_alloc+0x56/0x2f0 [ 457.183423][T11545] ? getname_flags+0xb7/0x500 [ 457.188120][T11545] getname_flags+0xb7/0x500 [ 457.192639][T11545] __x64_sys_unlinkat+0xaa/0xe0 [ 457.197509][T11545] do_syscall_64+0x4c/0xa0 [ 457.201952][T11545] ? clear_bhb_loop+0x60/0xb0 [ 457.206641][T11545] ? clear_bhb_loop+0x60/0xb0 [ 457.211343][T11545] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 457.217262][T11545] RIP: 0033:0x7fc0e019fb19 [ 457.221720][T11545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 457.242375][T11545] RSP: 002b:00007fc0de3d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 457.251177][T11545] RAX: ffffffffffffffda RBX: 00007fc0e0426180 RCX: 00007fc0e019fb19 [ 457.259295][T11545] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 457.267994][T11545] RBP: 00007fc0e0237b70 R08: 0000000000000000 R09: 0000000000000000 [ 457.276943][T11545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 457.285771][T11545] R13: 00007fc0e0426218 R14: 00007fc0e0426180 R15: 00007ffebcac7ec8 [ 457.293876][T11545] [ 457.388143][T11547] loop1: detected capacity change from 0 to 128 [ 457.565813][T11549] netlink: 236 bytes leftover after parsing attributes in process `syz.1.2012'. [ 458.235628][ T30] team0 (unregistering): Port device team_slave_1 removed [ 458.290202][ T30] team0 (unregistering): Port device team_slave_0 removed [ 458.346955][ T30] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 458.399641][ T30] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 458.818710][ T30] bond0 (unregistering): Released all slaves [ 458.897380][T11519] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2007'. [ 458.984168][T11519] device hsr_slave_1 left promiscuous mode [ 459.325386][T11567] loop3: detected capacity change from 0 to 128 [ 459.505027][T11567] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 459.524745][T11577] usb usb5: usbfs: interface 0 claimed by hub while 'syz.9.2020' sets config #-1 [ 459.550359][T11567] ext4 filesystem being mounted at /477/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 459.622610][T11582] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 461.180648][T11594] loop1: detected capacity change from 0 to 128 [ 461.950836][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 462.104606][T11605] netlink: 236 bytes leftover after parsing attributes in process `syz.1.2024'. [ 462.349572][T11612] loop4: detected capacity change from 0 to 512 [ 462.804310][T11615] FAULT_INJECTION: forcing a failure. [ 462.804310][T11615] name failslab, interval 1, probability 0, space 0, times 0 [ 462.817060][T11615] CPU: 0 PID: 11615 Comm: syz.4.2029 Not tainted syzkaller #0 [ 462.824630][T11615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 462.834711][T11615] Call Trace: [ 462.838003][T11615] [ 462.840947][T11615] dump_stack_lvl+0x188/0x24e [ 462.845709][T11615] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 462.851395][T11615] ? show_regs_print_info+0x12/0x12 [ 462.856649][T11615] ? load_image+0x410/0x410 [ 462.861193][T11615] should_fail_ex+0x390/0x4c0 [ 462.865904][T11615] should_failslab+0x5/0x20 [ 462.870429][T11615] slab_pre_alloc_hook+0x59/0x300 [ 462.876181][T11615] kmem_cache_alloc+0x56/0x2f0 [ 462.880968][T11615] ? getname_flags+0xb7/0x500 [ 462.885668][T11615] getname_flags+0xb7/0x500 [ 462.890195][T11615] __x64_sys_unlinkat+0xaa/0xe0 [ 462.895076][T11615] do_syscall_64+0x4c/0xa0 [ 462.899519][T11615] ? clear_bhb_loop+0x60/0xb0 [ 462.904236][T11615] ? clear_bhb_loop+0x60/0xb0 [ 462.908939][T11615] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 462.914897][T11615] RIP: 0033:0x7f1bf519fb19 [ 462.919329][T11615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 462.938965][T11615] RSP: 002b:00007f1bf5f82028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 462.947424][T11615] RAX: ffffffffffffffda RBX: 00007f1bf5426180 RCX: 00007f1bf519fb19 [ 462.955436][T11615] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 462.963451][T11615] RBP: 00007f1bf5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 462.971487][T11615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 462.979505][T11615] R13: 00007f1bf5426218 R14: 00007f1bf5426180 R15: 00007ffce1b4bf48 [ 462.987524][T11615] [ 463.767273][T11631] usb usb5: usbfs: interface 0 claimed by hub while 'syz.4.2034' sets config #-1 [ 464.032178][T11638] loop4: detected capacity change from 0 to 512 [ 466.170704][T11638] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 466.724431][T11638] ext4 filesystem being mounted at /29/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 466.905883][T10712] EXT4-fs (loop4): unmounting filesystem. [ 467.057984][T11659] loop3: detected capacity change from 0 to 128 [ 467.097024][T11664] loop4: detected capacity change from 0 to 512 [ 467.159573][T11659] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 467.340895][T11659] ext4 filesystem being mounted at /480/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 467.593146][T11674] FAULT_INJECTION: forcing a failure. [ 467.593146][T11674] name failslab, interval 1, probability 0, space 0, times 0 [ 467.606826][T11674] CPU: 1 PID: 11674 Comm: syz.4.2041 Not tainted syzkaller #0 [ 467.614591][T11674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 467.626384][T11674] Call Trace: [ 467.629705][T11674] [ 467.632763][T11674] dump_stack_lvl+0x188/0x24e [ 467.637859][T11674] ? show_regs_print_info+0x12/0x12 [ 467.643837][T11674] ? load_image+0x410/0x410 [ 467.649008][T11674] ? __might_sleep+0xd0/0xd0 [ 467.654613][T11674] ? __lock_acquire+0x7ea0/0x7ea0 [ 467.660279][T11674] should_fail_ex+0x390/0x4c0 [ 467.664995][T11674] should_failslab+0x5/0x20 [ 467.670203][T11674] slab_pre_alloc_hook+0x59/0x300 [ 467.675459][T11674] kmem_cache_alloc+0x56/0x2f0 [ 467.680256][T11674] ? getname_flags+0xb7/0x500 [ 467.685882][T11674] getname_flags+0xb7/0x500 [ 467.690793][T11674] __x64_sys_unlinkat+0xaa/0xe0 [ 467.696123][T11674] do_syscall_64+0x4c/0xa0 [ 467.700979][T11674] ? clear_bhb_loop+0x60/0xb0 [ 467.706488][T11674] ? clear_bhb_loop+0x60/0xb0 [ 467.711684][T11674] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 467.718664][T11674] RIP: 0033:0x7f1bf519fb19 [ 467.723434][T11674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 467.743088][T11674] RSP: 002b:00007f1bf5f82028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 467.752219][T11674] RAX: ffffffffffffffda RBX: 00007f1bf5426180 RCX: 00007f1bf519fb19 [ 467.760771][T11674] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 467.769707][T11674] RBP: 00007f1bf5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 467.777731][T11674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 467.785790][T11674] R13: 00007f1bf5426218 R14: 00007f1bf5426180 R15: 00007ffce1b4bf48 [ 467.794735][T11674] [ 468.196816][T11682] usb usb5: usbfs: interface 0 claimed by hub while 'syz.4.2047' sets config #-1 [ 468.381378][T11690] loop9: detected capacity change from 0 to 128 [ 468.408850][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 468.584281][T11694] loop3: detected capacity change from 0 to 512 [ 468.621769][T11696] netlink: 236 bytes leftover after parsing attributes in process `syz.9.2050'. [ 468.744399][T11694] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 468.805908][T11694] ext4 filesystem being mounted at /481/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 469.615209][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 470.168379][T11723] loop4: detected capacity change from 0 to 512 [ 470.575818][T11731] FAULT_INJECTION: forcing a failure. [ 470.575818][T11731] name failslab, interval 1, probability 0, space 0, times 0 [ 470.590060][T11731] CPU: 0 PID: 11731 Comm: syz.4.2057 Not tainted syzkaller #0 [ 470.598001][T11731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 470.609047][T11731] Call Trace: [ 470.612462][T11731] [ 470.615414][T11731] dump_stack_lvl+0x188/0x24e [ 470.620224][T11731] ? show_regs_print_info+0x12/0x12 [ 470.625693][T11731] ? load_image+0x410/0x410 [ 470.631581][T11731] should_fail_ex+0x390/0x4c0 [ 470.636297][T11731] should_failslab+0x5/0x20 [ 470.641113][T11731] slab_pre_alloc_hook+0x59/0x300 [ 470.646696][T11731] kmem_cache_alloc+0x56/0x2f0 [ 470.652130][T11731] ? getname_flags+0xb7/0x500 [ 470.657010][T11731] getname_flags+0xb7/0x500 [ 470.661540][T11731] __x64_sys_unlinkat+0xaa/0xe0 [ 470.666784][T11731] do_syscall_64+0x4c/0xa0 [ 470.671239][T11731] ? clear_bhb_loop+0x60/0xb0 [ 470.675953][T11731] ? clear_bhb_loop+0x60/0xb0 [ 470.680659][T11731] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 470.686574][T11731] RIP: 0033:0x7f1bf519fb19 [ 470.691066][T11731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 470.711923][T11731] RSP: 002b:00007f1bf5f82028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 470.720453][T11731] RAX: ffffffffffffffda RBX: 00007f1bf5426180 RCX: 00007f1bf519fb19 [ 470.728443][T11731] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 470.736522][T11731] RBP: 00007f1bf5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 470.744562][T11731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 470.753403][T11731] R13: 00007f1bf5426218 R14: 00007f1bf5426180 R15: 00007ffce1b4bf48 [ 470.762490][T11731] [ 471.393954][T11746] usb usb5: usbfs: interface 0 claimed by hub while 'syz.3.2062' sets config #-1 [ 472.748083][T11783] loop4: detected capacity change from 0 to 512 [ 472.853393][T11783] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 472.901485][T11783] EXT4-fs (loop4): 1 truncate cleaned up [ 472.936542][T11783] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 473.314647][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805429d400: rx timeout, send abort [ 474.769173][T11800] device syzkaller0 entered promiscuous mode [ 475.143634][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805429d400: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 475.250381][T10712] EXT4-fs (loop4): unmounting filesystem. [ 476.091431][T11835] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2080'. [ 479.913620][T11877] loop4: detected capacity change from 0 to 164 [ 479.925284][T11877] rock: directory entry would overflow storage [ 479.932653][T11877] rock: sig=0x5252, size=5, remaining=3 [ 479.939051][T11877] isofs_fill_super: root inode is not a directory. Corrupted media? [ 480.027271][T11882] loop9: detected capacity change from 0 to 512 [ 480.067659][T11882] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 480.355448][T11882] EXT4-fs (loop9): 1 truncate cleaned up [ 480.385241][T11882] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 481.527001][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880265ea400: rx timeout, send abort [ 481.538978][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff8880265ea400: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 482.510150][T10312] EXT4-fs (loop9): unmounting filesystem. [ 482.771994][T11924] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2094'. [ 482.846517][T11925] tipc: Started in network mode [ 482.858439][T11925] tipc: Node identity 7621c7d29d14, cluster identity 4711 [ 482.940290][T11925] tipc: Enabled bearer , priority 0 [ 482.977471][T11919] tipc: Disabling bearer [ 483.743141][T11943] loop3: detected capacity change from 0 to 164 [ 483.753020][T11943] rock: directory entry would overflow storage [ 483.759415][T11943] rock: sig=0x5252, size=5, remaining=3 [ 483.765087][T11943] isofs_fill_super: root inode is not a directory. Corrupted media? [ 483.824963][T11863] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 484.649684][T11964] loop4: detected capacity change from 0 to 512 [ 484.697538][T11964] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 484.793968][T11964] EXT4-fs (loop4): 1 truncate cleaned up [ 484.858583][T11964] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 485.100051][T11972] tipc: Enabling of bearer rejected, failed to enable media [ 486.646439][ C1] vcan0: j1939_tp_rxtimer: 0xffff888054e04400: rx timeout, send abort [ 486.658275][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888054e04400: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 486.948611][T11995] usb usb5: usbfs: interface 0 claimed by hub while 'syz.9.2110' sets config #-1 [ 487.039378][T10712] EXT4-fs (loop4): unmounting filesystem. [ 488.538360][T12033] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2119'. [ 489.693318][T12048] tipc: Started in network mode [ 489.699226][T12048] tipc: Node identity 2afc8a4d1c11, cluster identity 4711 [ 489.756750][T12048] tipc: Enabled bearer , priority 0 [ 489.773839][T12050] loop3: detected capacity change from 0 to 512 [ 489.807066][T12050] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 489.825525][T12047] tipc: Disabling bearer [ 489.873232][T12050] EXT4-fs (loop3): 1 truncate cleaned up [ 489.879917][T12050] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 491.663719][ C1] vcan0: j1939_tp_rxtimer: 0xffff888028802400: rx timeout, send abort [ 491.673110][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888028802400: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 492.060936][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 492.361144][T12079] loop9: detected capacity change from 0 to 164 [ 492.373527][T12079] rock: directory entry would overflow storage [ 492.379760][T12079] rock: sig=0x5252, size=5, remaining=3 [ 492.385530][T12079] isofs_fill_super: root inode is not a directory. Corrupted media? [ 492.609915][T12089] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2132'. [ 493.694991][T12101] tipc: Enabled bearer , priority 0 [ 493.821425][T12101] device syzkaller0 entered promiscuous mode [ 493.860671][T12101] tipc: Resetting bearer [ 494.003717][T12100] tipc: Resetting bearer [ 494.828436][T12123] loop4: detected capacity change from 0 to 512 [ 494.901448][T12123] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 494.976400][T12123] EXT4-fs (loop4): 1 truncate cleaned up [ 495.001608][T12123] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 496.004938][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055839400: rx timeout, send abort [ 496.016149][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888055839400: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 496.630123][T12148] loop1: detected capacity change from 0 to 164 [ 496.643005][T12148] rock: directory entry would overflow storage [ 496.649258][T12148] rock: sig=0x5252, size=5, remaining=3 [ 496.655057][T12148] isofs_fill_super: root inode is not a directory. Corrupted media? [ 497.098694][T10712] EXT4-fs (loop4): unmounting filesystem. [ 497.120203][T11863] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 497.347215][T12158] loop4: detected capacity change from 0 to 128 [ 497.505648][T12161] netlink: 236 bytes leftover after parsing attributes in process `syz.4.2144'. [ 500.870272][T12187] usb usb5: usbfs: interface 0 claimed by hub while 'syz.1.2151' sets config #-1 [ 500.999750][T12100] tipc: Disabling bearer [ 501.007062][ T4377] tipc: Node number set to 3946170322 [ 501.277663][T12195] loop3: detected capacity change from 0 to 512 [ 501.323989][T12195] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 501.376380][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.382809][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.397740][T12195] EXT4-fs (loop3): 1 truncate cleaned up [ 501.408104][T12195] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 502.643859][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b0c0c00: rx timeout, send abort [ 502.654919][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88807b0c0c00: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 503.238033][T12212] loop1: detected capacity change from 0 to 164 [ 503.261858][T12212] rock: directory entry would overflow storage [ 503.269912][T12212] rock: sig=0x5252, size=5, remaining=3 [ 503.276125][T12212] isofs_fill_super: root inode is not a directory. Corrupted media? [ 503.641509][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 503.652828][T11863] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 504.538464][T12239] loop4: detected capacity change from 0 to 128 [ 504.698514][T12242] netlink: 236 bytes leftover after parsing attributes in process `syz.4.2162'. [ 505.402553][T12244] tipc: Enabled bearer , priority 0 [ 505.535184][T12255] usb usb5: usbfs: interface 0 claimed by hub while 'syz.4.2166' sets config #-1 [ 505.577339][T12244] device syzkaller0 entered promiscuous mode [ 505.599624][T12244] tipc: Resetting bearer [ 505.712624][T12243] tipc: Resetting bearer [ 506.416435][T12280] loop4: detected capacity change from 0 to 512 [ 506.446881][T12280] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 506.489678][T12280] EXT4-fs (loop4): 1 truncate cleaned up [ 506.503326][T12280] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 506.896659][ C0] vcan0: j1939_tp_rxtimer: 0xffff888053cbe800: rx timeout, send abort [ 507.425349][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888053cbe800: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 508.613345][T10712] EXT4-fs (loop4): unmounting filesystem. [ 508.904819][T12303] loop1: detected capacity change from 0 to 164 [ 508.918438][T12303] rock: directory entry would overflow storage [ 508.924835][T12303] rock: sig=0x5252, size=5, remaining=3 [ 508.930682][T12303] isofs_fill_super: root inode is not a directory. Corrupted media? [ 510.511858][T12324] loop9: detected capacity change from 0 to 128 [ 510.712584][T12326] netlink: 236 bytes leftover after parsing attributes in process `syz.9.2176'. [ 513.001733][T12243] tipc: Disabling bearer [ 513.034478][ T4377] tipc: Node number set to 921537101 [ 513.339338][T12353] loop3: detected capacity change from 0 to 512 [ 513.347741][T12354] usb usb5: usbfs: interface 0 claimed by hub while 'syz.1.2180' sets config #-1 [ 513.368536][T12353] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 513.427723][T12353] EXT4-fs (loop3): 1 truncate cleaned up [ 513.578723][T12353] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 513.816548][ T4293] Bluetooth: hci3: command 0x0406 tx timeout [ 514.528592][ C0] vcan0: j1939_tp_rxtimer: 0xffff888029fdfc00: rx timeout, send abort [ 514.537797][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888029fdfc00: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 515.836873][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 516.224648][T12387] loop4: detected capacity change from 0 to 128 [ 516.422946][T12394] netlink: 236 bytes leftover after parsing attributes in process `syz.4.2189'. [ 517.011426][T12392] tipc: Enabled bearer , priority 0 [ 517.110510][T12391] tipc: Disabling bearer [ 517.910831][T12424] loop3: detected capacity change from 0 to 512 [ 517.932227][T12424] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 517.998102][T12424] EXT4-fs (loop3): 1 truncate cleaned up [ 518.010918][T12424] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 518.176118][T12435] usb usb5: usbfs: interface 0 claimed by hub while 'syz.0.2197' sets config #-1 [ 518.833201][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802125c400: rx timeout, send abort [ 518.841724][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88802125c400: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 519.917623][T12441] loop1: detected capacity change from 0 to 164 [ 519.958770][T12441] rock: directory entry would overflow storage [ 519.965150][T12441] rock: sig=0x5252, size=5, remaining=3 [ 519.971862][T12441] isofs_fill_super: root inode is not a directory. Corrupted media? [ 520.749632][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 520.799726][T12453] loop4: detected capacity change from 0 to 128 [ 521.048795][T12457] netlink: 236 bytes leftover after parsing attributes in process `syz.4.2203'. [ 521.627264][T12462] tipc: Started in network mode [ 521.671846][T12462] tipc: Node identity 1a227b891e84, cluster identity 4711 [ 521.733420][T12462] tipc: Enabled bearer , priority 0 [ 522.007739][T12466] device syzkaller0 entered promiscuous mode [ 522.067111][T12466] tipc: Resetting bearer [ 522.182101][T12459] tipc: Resetting bearer [ 523.117014][T12497] usb usb5: usbfs: interface 0 claimed by hub while 'syz.9.2211' sets config #-1 [ 525.833537][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805427f400: rx timeout, send abort [ 525.843721][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805427f400: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 526.466092][T12515] loop9: detected capacity change from 0 to 128 [ 526.932658][T12518] netlink: 236 bytes leftover after parsing attributes in process `syz.9.2217'. [ 528.368669][T12459] tipc: Disabling bearer [ 528.420242][ T4366] tipc: Node number set to 78019465 [ 529.051970][ T4293] Bluetooth: hci2: command 0x0406 tx timeout [ 529.172023][T12554] loop4: detected capacity change from 0 to 164 [ 529.207884][T12554] rock: directory entry would overflow storage [ 529.214893][T12554] rock: sig=0x5252, size=5, remaining=3 [ 529.221014][T12554] isofs_fill_super: root inode is not a directory. Corrupted media? [ 530.902208][T12574] loop4: detected capacity change from 0 to 512 [ 530.932484][T12574] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 531.107898][T12574] EXT4-fs (loop4): 1 truncate cleaned up [ 531.122693][T12574] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 531.175654][T12584] loop1: detected capacity change from 0 to 128 [ 531.283444][T12586] tipc: Enabled bearer , priority 0 [ 531.404590][T12590] netlink: 236 bytes leftover after parsing attributes in process `syz.1.2232'. [ 532.356640][T12587] device syzkaller0 entered promiscuous mode [ 532.433915][T12587] tipc: Resetting bearer [ 532.490106][T12585] tipc: Resetting bearer [ 533.335128][T10712] EXT4-fs (loop4): unmounting filesystem. [ 533.770520][T12625] loop4: detected capacity change from 0 to 164 [ 533.785089][T12625] rock: directory entry would overflow storage [ 533.791336][T12625] rock: sig=0x5252, size=5, remaining=3 [ 533.797334][T12625] isofs_fill_super: root inode is not a directory. Corrupted media? [ 535.603278][T12643] loop4: detected capacity change from 0 to 512 [ 535.679399][T12643] EXT4-fs error (device loop4): __ext4_iget:5135: inode #11: block 1: comm syz.4.2241: invalid block [ 535.736495][T12643] EXT4-fs error (device loop4): ext4_orphan_get:1414: comm syz.4.2241: couldn't read orphan inode 11 (err -117) [ 535.776582][T12643] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 535.958748][T10712] EXT4-fs (loop4): unmounting filesystem. [ 536.807548][T12656] loop3: detected capacity change from 0 to 512 [ 536.821036][T12656] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 536.862662][T12656] EXT4-fs (loop3): 1 truncate cleaned up [ 536.913628][T12656] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 538.928568][T12665] loop4: detected capacity change from 0 to 164 [ 539.121140][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 539.142051][T12665] rock: directory entry would overflow storage [ 539.148380][T12665] rock: sig=0x5252, size=5, remaining=3 [ 539.154038][T12665] isofs_fill_super: root inode is not a directory. Corrupted media? [ 539.811475][T12585] tipc: Disabling bearer [ 539.998976][T12682] loop9: detected capacity change from 0 to 512 [ 540.121033][T12682] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 540.160518][T12682] ext4 filesystem being mounted at /94/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 540.199428][T12690] FAULT_INJECTION: forcing a failure. [ 540.199428][T12690] name failslab, interval 1, probability 0, space 0, times 0 [ 540.287232][T12690] CPU: 1 PID: 12690 Comm: syz.1.2253 Not tainted syzkaller #0 [ 540.295227][T12690] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 540.306888][T12690] Call Trace: [ 540.310196][T12690] [ 540.313160][T12690] dump_stack_lvl+0x188/0x24e [ 540.317905][T12690] ? show_regs_print_info+0x12/0x12 [ 540.323703][T12690] ? load_image+0x410/0x410 [ 540.330051][T12690] ? __might_sleep+0xd0/0xd0 [ 540.335458][T12690] ? __lock_acquire+0x7ea0/0x7ea0 [ 540.340537][T12690] should_fail_ex+0x390/0x4c0 [ 540.345752][T12690] should_failslab+0x5/0x20 [ 540.352480][T12690] slab_pre_alloc_hook+0x59/0x300 [ 540.357686][T12690] ? mutex_lock_nested+0x10/0x10 [ 540.362757][T12690] ? in6_dev_get+0x363/0x410 [ 540.367796][T12690] ? __ipv6_dev_mc_inc+0x47b/0xb20 [ 540.373603][T12690] __kmem_cache_alloc_node+0x4f/0x270 [ 540.379121][T12690] ? __ipv6_dev_mc_inc+0x47b/0xb20 [ 540.384367][T12690] kmalloc_trace+0x26/0xe0 [ 540.388826][T12690] __ipv6_dev_mc_inc+0x47b/0xb20 [ 540.393822][T12690] addrconf_join_solict+0x101/0x180 [ 540.399188][T12690] ? addrconf_mod_dad_work+0x120/0x120 [ 540.404874][T12690] ? do_raw_spin_unlock+0x11d/0x230 [ 540.410131][T12690] __ipv6_dev_ac_inc+0x644/0x820 [ 540.415193][T12690] ipv6_sock_ac_join+0x4a3/0x6b0 [ 540.420189][T12690] do_ipv6_setsockopt+0x1c70/0x3c30 [ 540.425643][T12690] ? sk_dst_reset+0xa0/0xa0 [ 540.430312][T12690] ? __schedule+0x1091/0x4140 [ 540.435193][T12690] ? mark_lock+0x94/0x320 [ 540.439580][T12690] ? __lock_acquire+0x1359/0x7ea0 [ 540.444780][T12690] ? release_firmware_map_entry+0x187/0x187 [ 540.451183][T12690] ? futex_wait_queue+0x23/0x1b0 [ 540.456183][T12690] ? futex_wait+0x525/0x640 [ 540.460731][T12690] ? verify_lock_unused+0x140/0x140 [ 540.466503][T12690] ? aa_label_sk_perm+0x501/0x6b0 [ 540.471723][T12690] ? futex_wait_setup+0x270/0x270 [ 540.476835][T12690] ? aa_sk_perm+0x8c0/0x8c0 [ 540.481418][T12690] ? __fget_files+0x28/0x460 [ 540.486089][T12690] ? __lock_acquire+0x7ea0/0x7ea0 [ 540.491339][T12690] ? do_futex+0x310/0x320 [ 540.495712][T12690] ? aa_sk_perm+0x795/0x8c0 [ 540.500264][T12690] ? __ia32_sys_get_robust_list+0x100/0x100 [ 540.506760][T12690] ? __fget_files+0x3fc/0x460 [ 540.511933][T12690] ? aa_sock_opt_perm+0x74/0x100 [ 540.516922][T12690] ipv6_setsockopt+0x55/0x190 [ 540.521728][T12690] ? sock_common_recvmsg+0x190/0x190 [ 540.527130][T12690] __sys_setsockopt+0x2bf/0x3d0 [ 540.533422][T12690] __x64_sys_setsockopt+0xb1/0xc0 [ 540.538520][T12690] do_syscall_64+0x4c/0xa0 [ 540.542999][T12690] ? clear_bhb_loop+0x60/0xb0 [ 540.547714][T12690] ? clear_bhb_loop+0x60/0xb0 [ 540.552869][T12690] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 540.558901][T12690] RIP: 0033:0x7f31cff9fb19 [ 540.563356][T12690] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 540.583505][T12690] RSP: 002b:00007f31d0efc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 540.591959][T12690] RAX: ffffffffffffffda RBX: 00007f31d0225fa0 RCX: 00007f31cff9fb19 [ 540.600763][T12690] RDX: 000000000000001b RSI: 0000000000000029 RDI: 0000000000000004 [ 540.609646][T12690] RBP: 00007f31d0037b70 R08: 0000000000000020 R09: 0000000000000000 [ 540.617741][T12690] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000000 [ 540.625851][T12690] R13: 00007f31d0226038 R14: 00007f31d0225fa0 R15: 00007ffd12534378 [ 540.634591][T12690] [ 540.678658][T10312] EXT4-fs (loop9): unmounting filesystem. [ 540.909087][T12712] loop3: detected capacity change from 0 to 512 [ 540.953373][T12712] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 540.972630][ T4294] Bluetooth: hci4: command 0x0406 tx timeout [ 541.024254][T12712] EXT4-fs (loop3): 1 truncate cleaned up [ 541.031522][T12712] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 543.291191][T12721] loop9: detected capacity change from 0 to 164 [ 543.312332][T12721] rock: directory entry would overflow storage [ 543.319024][T12721] rock: sig=0x5252, size=5, remaining=3 [ 543.324804][T12721] isofs_fill_super: root inode is not a directory. Corrupted media? [ 543.399746][T12722] tipc: Started in network mode [ 543.445702][T12722] tipc: Node identity 16d467d419df, cluster identity 4711 [ 543.502222][T12722] tipc: Enabled bearer , priority 0 [ 543.743694][T12723] device syzkaller0 entered promiscuous mode [ 543.797776][T12723] tipc: Resetting bearer [ 543.799966][T12159] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 543.836003][T12719] tipc: Resetting bearer [ 543.851955][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 544.274859][T12745] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2267'. [ 546.510482][T12765] loop1: detected capacity change from 0 to 256 [ 546.524911][T12765] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 546.560913][T12765] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 546.747706][T12767] loop1: detected capacity change from 0 to 512 [ 546.835040][T12767] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 546.844516][T12767] ext4 filesystem being mounted at /68/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 546.921669][T10535] EXT4-fs (loop1): unmounting filesystem. [ 547.029088][T12772] loop1: detected capacity change from 0 to 512 [ 547.036915][T12772] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 547.061222][T12772] EXT4-fs (loop1): 1 truncate cleaned up [ 547.071355][T12772] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 549.140890][T12719] tipc: Disabling bearer [ 549.199349][T10535] EXT4-fs (loop1): unmounting filesystem. [ 549.265553][ T4283] tipc: Node number set to 252405716 [ 549.547444][T12785] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2277'. [ 549.679784][T12789] loop1: detected capacity change from 0 to 164 [ 549.703052][T12789] rock: directory entry would overflow storage [ 549.703126][T12789] rock: sig=0x5252, size=5, remaining=3 [ 549.703183][T12789] isofs_fill_super: root inode is not a directory. Corrupted media? [ 550.230558][T11863] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 550.938942][T12814] loop1: detected capacity change from 0 to 128 [ 551.040289][T12818] tipc: Enabled bearer , priority 0 [ 551.942429][T12823] netlink: 236 bytes leftover after parsing attributes in process `syz.1.2287'. [ 553.676251][T12818] device syzkaller0 entered promiscuous mode [ 553.823449][T12818] tipc: Resetting bearer [ 553.868119][T12816] tipc: Resetting bearer [ 554.298181][T12838] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2292'. [ 554.442394][T12840] loop9: detected capacity change from 0 to 164 [ 554.556187][T12840] rock: directory entry would overflow storage [ 554.563174][T12840] rock: sig=0x5252, size=5, remaining=3 [ 554.568904][T12840] isofs_fill_super: root inode is not a directory. Corrupted media? [ 556.167710][T12858] ip_tables: iptables: counters copy to user failed while replacing table [ 556.349167][T12860] loop9: detected capacity change from 0 to 128 [ 557.415047][T12864] loop9: detected capacity change from 0 to 512 [ 557.437158][T12864] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 557.480873][T12864] EXT4-fs (loop9): 1 truncate cleaned up [ 557.493228][T12864] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 559.541989][T10312] EXT4-fs (loop9): unmounting filesystem. [ 559.829031][T12816] tipc: Disabling bearer [ 560.182199][T12883] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2305'. [ 560.345979][T12888] loop1: detected capacity change from 0 to 164 [ 560.364045][T12888] rock: directory entry would overflow storage [ 560.372884][T12888] rock: sig=0x5252, size=5, remaining=3 [ 560.380203][T12888] isofs_fill_super: root inode is not a directory. Corrupted media? [ 560.578615][T11863] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 562.087972][T12909] tipc: Enabled bearer , priority 0 [ 562.267858][T12909] device syzkaller0 entered promiscuous mode [ 562.360464][T12909] tipc: Resetting bearer [ 562.443452][T12908] tipc: Resetting bearer [ 562.816328][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.827617][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.178710][T12946] futex_wake_op: syz.3.2321 tries to shift op by -1; fix this program [ 564.193878][T12952] loop3: detected capacity change from 0 to 512 [ 564.271629][T12953] FAULT_INJECTION: forcing a failure. [ 564.271629][T12953] name failslab, interval 1, probability 0, space 0, times 0 [ 564.287844][T12953] CPU: 0 PID: 12953 Comm: syz.3.2323 Not tainted syzkaller #0 [ 564.295975][T12953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 564.306695][T12953] Call Trace: [ 564.310117][T12953] [ 564.313771][T12953] dump_stack_lvl+0x188/0x24e [ 564.318586][T12953] ? show_regs_print_info+0x12/0x12 [ 564.323824][T12953] ? load_image+0x410/0x410 [ 564.328364][T12953] ? __might_sleep+0xd0/0xd0 [ 564.333016][T12953] ? __lock_acquire+0x7ea0/0x7ea0 [ 564.338056][T12953] should_fail_ex+0x390/0x4c0 [ 564.342749][T12953] should_failslab+0x5/0x20 [ 564.347280][T12953] slab_pre_alloc_hook+0x59/0x300 [ 564.352355][T12953] kmem_cache_alloc+0x56/0x2f0 [ 564.357141][T12953] ? getname_flags+0xb7/0x500 [ 564.361866][T12953] getname_flags+0xb7/0x500 [ 564.366841][T12953] __x64_sys_unlinkat+0xaa/0xe0 [ 564.372424][T12953] do_syscall_64+0x4c/0xa0 [ 564.377710][T12953] ? clear_bhb_loop+0x60/0xb0 [ 564.383464][T12953] ? clear_bhb_loop+0x60/0xb0 [ 564.388153][T12953] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 564.394054][T12953] RIP: 0033:0x7f819f39fb19 [ 564.398475][T12953] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 564.418616][T12953] RSP: 002b:00007f81a01b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 564.427052][T12953] RAX: ffffffffffffffda RBX: 00007f819f626090 RCX: 00007f819f39fb19 [ 564.435031][T12953] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 564.443141][T12953] RBP: 00007f819f437b70 R08: 0000000000000000 R09: 0000000000000000 [ 564.451475][T12953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 564.460525][T12953] R13: 00007f819f626128 R14: 00007f819f626090 R15: 00007ffd75707e98 [ 564.468670][T12953] [ 566.016240][T12908] tipc: Disabling bearer [ 566.105901][T12961] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2326'. [ 567.165793][T12977] loop4: detected capacity change from 0 to 512 [ 567.177262][T12981] loop9: detected capacity change from 0 to 512 [ 567.245891][T12981] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 567.280203][T12988] FAULT_INJECTION: forcing a failure. [ 567.280203][T12988] name failslab, interval 1, probability 0, space 0, times 0 [ 567.293410][T12988] CPU: 0 PID: 12988 Comm: syz.4.2334 Not tainted syzkaller #0 [ 567.300894][T12988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 567.310954][T12988] Call Trace: [ 567.314233][T12988] [ 567.317159][T12988] dump_stack_lvl+0x188/0x24e [ 567.321855][T12988] ? show_regs_print_info+0x12/0x12 [ 567.327055][T12988] ? load_image+0x410/0x410 [ 567.331557][T12988] ? __might_sleep+0xd0/0xd0 [ 567.336146][T12988] ? __lock_acquire+0x7ea0/0x7ea0 [ 567.341176][T12988] should_fail_ex+0x390/0x4c0 [ 567.345860][T12988] should_failslab+0x5/0x20 [ 567.350359][T12988] slab_pre_alloc_hook+0x59/0x300 [ 567.355392][T12988] kmem_cache_alloc+0x56/0x2f0 [ 567.360151][T12988] ? getname_flags+0xb7/0x500 [ 567.364864][T12988] getname_flags+0xb7/0x500 [ 567.369385][T12988] __x64_sys_unlinkat+0xaa/0xe0 [ 567.374242][T12988] do_syscall_64+0x4c/0xa0 [ 567.378671][T12988] ? clear_bhb_loop+0x60/0xb0 [ 567.383370][T12988] ? clear_bhb_loop+0x60/0xb0 [ 567.388062][T12988] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 567.393958][T12988] RIP: 0033:0x7f1bf519fb19 [ 567.398370][T12988] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 567.418006][T12988] RSP: 002b:00007f1bf5fa3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 567.426418][T12988] RAX: ffffffffffffffda RBX: 00007f1bf5426090 RCX: 00007f1bf519fb19 [ 567.434385][T12988] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 567.442359][T12988] RBP: 00007f1bf5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 567.450327][T12988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 567.458418][T12988] R13: 00007f1bf5426128 R14: 00007f1bf5426090 R15: 00007ffce1b4bf48 [ 567.466429][T12988] [ 567.524608][T12981] EXT4-fs (loop9): 1 truncate cleaned up [ 567.533854][T12981] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 569.229721][T13018] netlink: 144 bytes leftover after parsing attributes in process `syz.0.2341'. [ 569.245132][T13015] tipc: Enabled bearer , priority 0 [ 569.446014][T13015] device syzkaller0 entered promiscuous mode [ 569.497336][T13015] tipc: Resetting bearer [ 569.568071][T13008] tipc: Resetting bearer [ 569.728633][T10312] EXT4-fs (loop9): unmounting filesystem. [ 570.769810][T13035] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2345'. [ 571.076632][T13044] loop1: detected capacity change from 0 to 512 [ 571.351596][T13049] FAULT_INJECTION: forcing a failure. [ 571.351596][T13049] name failslab, interval 1, probability 0, space 0, times 0 [ 571.365264][T13049] CPU: 1 PID: 13049 Comm: syz.1.2349 Not tainted syzkaller #0 [ 571.373046][T13049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 571.384183][T13049] Call Trace: [ 571.387695][T13049] [ 571.391125][T13049] dump_stack_lvl+0x188/0x24e [ 571.396494][T13049] ? show_regs_print_info+0x12/0x12 [ 571.401827][T13049] ? load_image+0x410/0x410 [ 571.406501][T13049] ? __might_sleep+0xd0/0xd0 [ 571.411147][T13049] ? __lock_acquire+0x7ea0/0x7ea0 [ 571.416249][T13049] should_fail_ex+0x390/0x4c0 [ 571.421277][T13049] should_failslab+0x5/0x20 [ 571.425811][T13049] slab_pre_alloc_hook+0x59/0x300 [ 571.431557][T13049] kmem_cache_alloc+0x56/0x2f0 [ 571.436701][T13049] ? getname_flags+0xb7/0x500 [ 571.441674][T13049] getname_flags+0xb7/0x500 [ 571.446273][T13049] __x64_sys_unlinkat+0xaa/0xe0 [ 571.451511][T13049] do_syscall_64+0x4c/0xa0 [ 571.456489][T13049] ? clear_bhb_loop+0x60/0xb0 [ 571.461700][T13049] ? clear_bhb_loop+0x60/0xb0 [ 571.467140][T13049] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 571.473201][T13049] RIP: 0033:0x7f31cff9fb19 [ 571.477954][T13049] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 571.498988][T13049] RSP: 002b:00007f31d0edb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 571.508019][T13049] RAX: ffffffffffffffda RBX: 00007f31d0226090 RCX: 00007f31cff9fb19 [ 571.515993][T13049] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 571.523967][T13049] RBP: 00007f31d0037b70 R08: 0000000000000000 R09: 0000000000000000 [ 571.533437][T13049] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 571.541770][T13049] R13: 00007f31d0226128 R14: 00007f31d0226090 R15: 00007ffd12534378 [ 571.550816][T13049] [ 572.183302][T13063] loop1: detected capacity change from 0 to 512 [ 572.216850][T13063] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 572.252826][T13063] EXT4-fs (loop1): 1 truncate cleaned up [ 572.260034][T13063] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 574.596003][T10535] EXT4-fs (loop1): unmounting filesystem. [ 574.995657][T13081] loop1: detected capacity change from 0 to 512 [ 575.042011][T13081] EXT4-fs error (device loop1): dx_probe:823: inode #2: comm syz.1.2356: Attempting to read directory block (0) that is past i_size (16) [ 575.091885][T13081] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -117 [ 575.116023][T13081] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 576.572560][T13083] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 255: padding at end of block bitmap is not set [ 577.253369][T13008] tipc: Disabling bearer [ 577.264194][T13038] netlink: 'syz.9.2347': attribute type 10 has an invalid length. [ 577.273344][T13038] device syz_tun entered promiscuous mode [ 577.287540][T13038] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 577.377207][T13087] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 577.393534][T13087] device syzkaller0 entered promiscuous mode [ 577.472545][T10535] EXT4-fs (loop1): unmounting filesystem. [ 577.669536][T13110] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.2362'. [ 577.699506][T13111] loop4: detected capacity change from 0 to 512 [ 578.028558][T13117] FAULT_INJECTION: forcing a failure. [ 578.028558][T13117] name failslab, interval 1, probability 0, space 0, times 0 [ 578.068743][T13117] CPU: 0 PID: 13117 Comm: syz.4.2363 Not tainted syzkaller #0 [ 578.076774][T13117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 578.087068][T13117] Call Trace: [ 578.091055][T13117] [ 578.094275][T13117] dump_stack_lvl+0x188/0x24e [ 578.099082][T13117] ? show_regs_print_info+0x12/0x12 [ 578.104493][T13117] ? load_image+0x410/0x410 [ 578.109267][T13117] ? __might_sleep+0xd0/0xd0 [ 578.114347][T13117] ? __lock_acquire+0x7ea0/0x7ea0 [ 578.120109][T13117] should_fail_ex+0x390/0x4c0 [ 578.124820][T13117] should_failslab+0x5/0x20 [ 578.129337][T13117] slab_pre_alloc_hook+0x59/0x300 [ 578.135144][T13117] kmem_cache_alloc+0x56/0x2f0 [ 578.141414][T13117] ? getname_flags+0xb7/0x500 [ 578.146391][T13117] getname_flags+0xb7/0x500 [ 578.151083][T13117] __x64_sys_unlinkat+0xaa/0xe0 [ 578.156482][T13117] do_syscall_64+0x4c/0xa0 [ 578.161369][T13117] ? clear_bhb_loop+0x60/0xb0 [ 578.167346][T13117] ? clear_bhb_loop+0x60/0xb0 [ 578.172142][T13117] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 578.178140][T13117] RIP: 0033:0x7f1bf519fb19 [ 578.182656][T13117] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 578.202556][T13117] RSP: 002b:00007f1bf5fa3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 578.211455][T13117] RAX: ffffffffffffffda RBX: 00007f1bf5426090 RCX: 00007f1bf519fb19 [ 578.220689][T13117] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 578.228752][T13117] RBP: 00007f1bf5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 578.237187][T13117] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 578.245457][T13117] R13: 00007f1bf5426128 R14: 00007f1bf5426090 R15: 00007ffce1b4bf48 [ 578.253446][T13117] [ 580.686419][T13109] netlink: 'syz.1.2361': attribute type 21 has an invalid length. [ 580.700313][T13123] netlink: 'syz.0.2365': attribute type 10 has an invalid length. [ 580.710876][T13123] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2365'. [ 580.730876][T13123] bridge0: port 3(bond0) entered blocking state [ 580.741320][T13123] bridge0: port 3(bond0) entered disabled state [ 580.755798][T13123] device bond0 entered promiscuous mode [ 580.765314][T13123] device bond_slave_0 entered promiscuous mode [ 580.771689][T13123] device bond_slave_1 entered promiscuous mode [ 580.786212][T13123] bridge0: port 3(bond0) entered blocking state [ 580.793164][T13123] bridge0: port 3(bond0) entered forwarding state [ 580.808250][T13137] loop1: detected capacity change from 0 to 512 [ 580.872805][T13137] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 580.990475][T13137] EXT4-fs (loop1): 1 truncate cleaned up [ 580.992159][T13144] netlink: 'syz.4.2370': attribute type 10 has an invalid length. [ 581.001386][T13137] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 581.279099][T13144] team0 (unregistering): Port device team_slave_0 removed [ 581.309506][T13144] team0 (unregistering): Port device team_slave_1 removed [ 582.205517][T13152] tipc: Enabling of bearer rejected, failed to enable media [ 582.940532][T13179] usb usb5: usbfs: interface 0 claimed by hub while 'syz.4.2374' sets config #-1 [ 583.164393][T10535] EXT4-fs (loop1): unmounting filesystem. [ 583.487145][T13198] netlink: 'syz.0.2382': attribute type 1 has an invalid length. [ 583.501969][T13198] netlink: 'syz.0.2382': attribute type 4 has an invalid length. [ 583.542448][T13198] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.2382'. [ 583.989002][T13214] loop1: detected capacity change from 0 to 512 [ 584.045022][T13214] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 584.143774][T13214] EXT4-fs (loop1): 1 truncate cleaned up [ 584.160668][T13214] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 586.291558][T10535] EXT4-fs (loop1): unmounting filesystem. [ 586.440911][T13253] netlink: 'syz.3.2396': attribute type 11 has an invalid length. [ 586.477447][T13253] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2396'. [ 586.788330][T13252] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 587.618202][T13278] netlink: 'syz.0.2405': attribute type 29 has an invalid length. [ 587.627203][T13278] netlink: 'syz.0.2405': attribute type 29 has an invalid length. [ 587.638458][T13278] netlink: 'syz.0.2405': attribute type 29 has an invalid length. [ 587.737244][T13280] loop1: detected capacity change from 0 to 512 [ 587.850092][T13280] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 587.927985][T13280] EXT4-fs (loop1): 1 truncate cleaned up [ 587.936997][T13280] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 588.009198][ C1] vcan0: j1939_tp_rxtimer: 0xffff888056eda400: rx timeout, send abort [ 588.018099][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888056eda400: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 589.672872][T13305] netlink: 'syz.0.2413': attribute type 10 has an invalid length. [ 589.735554][T13305] netlink: 55 bytes leftover after parsing attributes in process `syz.0.2413'. [ 590.232067][T10535] EXT4-fs (loop1): unmounting filesystem. [ 591.877533][T13352] loop9: detected capacity change from 0 to 512 [ 591.940100][T13352] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 592.126970][T13352] EXT4-fs (loop9): 1 truncate cleaned up [ 592.142916][T13352] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 592.540234][ C0] vcan0: j1939_tp_rxtimer: 0xffff888054708000: rx timeout, send abort [ 593.517892][T13367] device wg2 entered promiscuous mode [ 594.073093][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888054708000: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 594.433025][T10312] EXT4-fs (loop9): unmounting filesystem. [ 595.463857][T13424] loop1: detected capacity change from 0 to 512 [ 595.590502][T13424] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 595.657797][T13424] EXT4-fs (loop1): 1 truncate cleaned up [ 595.677583][T13424] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 596.664676][ C1] vcan0: j1939_tp_rxtimer: 0xffff888056385000: rx timeout, send abort [ 596.673609][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888056385000: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 598.129189][T10535] EXT4-fs (loop1): unmounting filesystem. [ 598.237792][T13447] usb usb5: usbfs: interface 0 claimed by hub while 'syz.3.2452' sets config #-1 [ 599.808728][T13494] loop1: detected capacity change from 0 to 512 [ 599.833881][T13494] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 599.963457][T13494] EXT4-fs (loop1): 1 truncate cleaned up [ 599.970084][T13494] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 600.349000][T13509] netlink: 'syz.3.2470': attribute type 10 has an invalid length. [ 600.719068][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880566b3800: rx timeout, send abort [ 600.733360][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880566b3800: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 600.844026][T13509] team0: Device veth1_vlan failed to register rx_handler [ 602.026656][T10535] EXT4-fs (loop1): unmounting filesystem. [ 603.218940][T13557] netlink: 'syz.4.2483': attribute type 10 has an invalid length. [ 603.251890][T13557] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2483'. [ 603.283137][T13557] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 603.287139][T13561] netlink: 'syz.9.2485': attribute type 3 has an invalid length. [ 603.347634][T13561] netlink: 132 bytes leftover after parsing attributes in process `syz.9.2485'. [ 603.603648][T13570] loop1: detected capacity change from 0 to 512 [ 603.621144][T13570] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 603.699481][T13570] EXT4-fs (loop1): 1 truncate cleaned up [ 603.725211][T13570] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 605.112971][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880293b2c00: rx timeout, send abort [ 605.121619][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff8880293b2c00: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 606.094220][T10535] EXT4-fs (loop1): unmounting filesystem. [ 606.257473][T13595] netlink: 'syz.0.2497': attribute type 1 has an invalid length. [ 606.373975][T13595] 8021q: adding VLAN 0 to HW filter on device bond2 [ 606.434270][T13599] bond2: (slave veth5): Enslaving as an active interface with a down link [ 606.789093][T13626] loop9: detected capacity change from 0 to 512 [ 606.853396][T13626] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 606.988129][T13633] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2508'. [ 607.014891][T13633] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2508'. [ 607.075607][T13626] EXT4-fs (loop9): 1 truncate cleaned up [ 607.249261][T13626] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 607.810580][T13639] loop4: detected capacity change from 0 to 256 [ 607.820797][T13639] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 607.835071][T13639] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 609.119413][ T4294] Bluetooth: hci0: command 0x2016 tx timeout [ 610.025296][T10312] EXT4-fs (loop9): unmounting filesystem. [ 610.220736][T13659] FAULT_INJECTION: forcing a failure. [ 610.220736][T13659] name failslab, interval 1, probability 0, space 0, times 0 [ 610.262865][T13659] CPU: 1 PID: 13659 Comm: syz.0.2517 Not tainted syzkaller #0 [ 610.270803][T13659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 610.281062][T13659] Call Trace: [ 610.284379][T13659] [ 610.287417][T13659] dump_stack_lvl+0x188/0x24e [ 610.292629][T13659] ? show_regs_print_info+0x12/0x12 [ 610.298473][T13659] ? load_image+0x410/0x410 [ 610.302982][T13659] ? __might_sleep+0xd0/0xd0 [ 610.307591][T13659] ? __lock_acquire+0x7ea0/0x7ea0 [ 610.312819][T13659] should_fail_ex+0x390/0x4c0 [ 610.317650][T13659] should_failslab+0x5/0x20 [ 610.322184][T13659] slab_pre_alloc_hook+0x59/0x300 [ 610.327344][T13659] kmem_cache_alloc+0x56/0x2f0 [ 610.332298][T13659] ? __proc_create+0x36f/0x8b0 [ 610.337248][T13659] __proc_create+0x36f/0x8b0 [ 610.342325][T13659] ? proc_symlink+0x210/0x210 [ 610.347014][T13659] ? proc_register+0x5d1/0x7e0 [ 610.352480][T13659] _proc_mkdir+0x5f/0x160 [ 610.357846][T13659] netfilter_net_init+0x2f2/0x350 [ 610.363735][T13659] ops_init+0x360/0x5e0 [ 610.368013][T13659] setup_net+0x4f2/0xbd0 [ 610.373047][T13659] ? copy_net_ns+0x5b0/0x5b0 [ 610.377900][T13659] ? copy_net_ns+0x324/0x5b0 [ 610.382594][T13659] ? down_read_killable+0x1cc/0x340 [ 610.387817][T13659] copy_net_ns+0x33e/0x5b0 [ 610.392247][T13659] create_new_namespaces+0x3ce/0x700 [ 610.397684][T13659] unshare_nsproxy_namespaces+0x116/0x160 [ 610.403672][T13659] ksys_unshare+0x4f6/0x8e0 [ 610.408297][T13659] ? sighand_ctor+0x40/0x40 [ 610.412868][T13659] ? lock_chain_count+0x20/0x20 [ 610.417785][T13659] ? syscall_enter_from_user_mode+0x21/0x80 [ 610.423800][T13659] __x64_sys_unshare+0x34/0x40 [ 610.429511][T13659] do_syscall_64+0x4c/0xa0 [ 610.434025][T13659] ? clear_bhb_loop+0x60/0xb0 [ 610.438707][T13659] ? clear_bhb_loop+0x60/0xb0 [ 610.443633][T13659] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 610.450452][T13659] RIP: 0033:0x7fc0e019fb19 [ 610.454887][T13659] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 610.474971][T13659] RSP: 002b:00007fc0e0f99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 610.483407][T13659] RAX: ffffffffffffffda RBX: 00007fc0e0425fa0 RCX: 00007fc0e019fb19 [ 610.491382][T13659] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000060040000 [ 610.500410][T13659] RBP: 00007fc0e0237b70 R08: 0000000000000000 R09: 0000000000000000 [ 610.508405][T13659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 610.516554][T13659] R13: 00007fc0e0426038 R14: 00007fc0e0425fa0 R15: 00007ffebcac7ec8 [ 610.525068][T13659] [ 610.582012][T13659] cannot create netfilter proc entry [ 610.864633][T13678] loop9: detected capacity change from 0 to 128 [ 611.191324][T13690] netlink: 236 bytes leftover after parsing attributes in process `syz.9.2525'. [ 612.130535][T11439] device offline error, dev sda, sector 794934 op 0x1:(WRITE) flags 0x0 phys_seg 2 prio class 2 [ 612.142217][T11439] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2037 starting block 99366) [ 612.155777][T11439] Buffer I/O error on device sda1, logical block 99328 [ 612.798321][T11439] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2037 starting block 99367) [ 612.838004][T13692] zram0: detected capacity change from 0 to 8 [ 612.854958][T11439] Buffer I/O error on device sda1, logical block 99329 [ 612.862553][ T3606] device offline error, dev sda, sector 1054566 op 0x1:(WRITE) flags 0x9800 phys_seg 3 prio class 2 [ 612.920040][ T3606] Aborting journal on device sda1-8. [ 612.940461][T11439] device offline error, dev sda, sector 717110 op 0x1:(WRITE) flags 0x0 phys_seg 2 prio class 2 [ 612.975070][ T3606] device offline error, dev sda, sector 1048886 op 0x1:(WRITE) flags 0x29800 phys_seg 1 prio class 2 [ 613.017257][T11439] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2031 starting block 89638) [ 613.046178][ T3606] buffer_io_error: 28 callbacks suppressed [ 613.046197][ T3606] Buffer I/O error on dev sda1, logical block 131072, lost sync page write [ 613.073832][ T4264] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz-executor: Detected aborted journal [ 613.096865][T11439] Buffer I/O error on device sda1, logical block 89600 [ 613.120181][ T3606] JBD2: I/O error when updating journal superblock for sda1-8. [ 613.140484][T11439] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2031 starting block 89639) [ 613.153291][T11439] Buffer I/O error on device sda1, logical block 89601 [ 613.227462][T13683] device offline error, dev sda, sector 318 op 0x1:(WRITE) flags 0x3000 phys_seg 1 prio class 2 [ 613.261566][ T4264] device offline error, dev sda, sector 310 op 0x1:(WRITE) flags 0x23800 phys_seg 1 prio class 2 [ 613.322165][T13683] Buffer I/O error on dev sda1, logical block 1, lost async page write [ 613.330611][ T4264] Buffer I/O error on dev sda1, logical block 0, lost sync page write [ 613.382135][ T4264] EXT4-fs (sda1): I/O error while writing superblock [ 613.389531][T13683] device offline error, dev sda, sector 1358 op 0x1:(WRITE) flags 0x3000 phys_seg 2 prio class 2 [ 613.414896][T13697] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2530: Detected aborted journal [ 613.437871][ T4264] EXT4-fs (sda1): Remounting filesystem read-only [ 613.456536][T13683] Buffer I/O error on dev sda1, logical block 131, lost async page write [ 613.475247][T13697] device offline error, dev sda, sector 310 op 0x1:(WRITE) flags 0x23800 phys_seg 1 prio class 2 [ 613.492076][T13697] Buffer I/O error on dev sda1, logical block 0, lost sync page write [ 613.500589][T13697] EXT4-fs (sda1): I/O error while writing superblock [ 613.502383][ T4264] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz-executor: Detected aborted journal [ 613.508129][T13697] EXT4-fs (sda1): Remounting filesystem read-only [ 613.530864][T13697] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2530: Detected aborted journal [ 613.542909][T13697] device offline error, dev sda, sector 310 op 0x1:(WRITE) flags 0x23800 phys_seg 1 prio class 2 [ 613.553533][T13697] Buffer I/O error on dev sda1, logical block 0, lost sync page write [ 613.564792][T13697] EXT4-fs (sda1): I/O error while writing superblock [ 613.572144][T13697] EXT4-fs (sda1): Remounting filesystem read-only [ 613.574786][T13683] Buffer I/O error on dev sda1, logical block 132, lost async page write [ 613.608658][T13702] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.1.2531: Detected aborted journal [ 613.610363][ T4264] device offline error, dev sda, sector 310 op 0x1:(WRITE) flags 0x23800 phys_seg 1 prio class 2 [ 613.623832][T13701] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.3.2533: Detected aborted journal [ 613.643737][ T4264] Buffer I/O error on dev sda1, logical block 0, lost sync page write [ 613.653838][ T4264] EXT4-fs (sda1): I/O error while writing superblock [ 613.661530][ T4264] EXT4-fs (sda1): Remounting filesystem read-only [ 613.665390][T13703] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.0.2532: Detected aborted journal [ 613.678572][ T4264] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz-executor: Detected aborted journal [ 613.679795][T13702] Buffer I/O error on dev sda1, logical block 0, lost sync page write [ 613.714631][T13703] EXT4-fs (sda1): previous I/O error to superblock detected [ 613.722905][T13703] Buffer I/O error on dev sda1, logical block 0, lost sync page write [ 613.731166][T13702] EXT4-fs (sda1): I/O error while writing superblock [ 613.741707][T13701] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.3.2533: Detected aborted journal [ 613.768975][T13703] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.0.2532: Detected aborted journal [ 614.022805][T13716] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 614.281516][T13683] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 614.447045][T13738] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2540'. [ 615.155724][T13747] loop3: detected capacity change from 0 to 512 [ 615.167627][T13747] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 615.238270][T13747] EXT4-fs (loop3): 1 truncate cleaned up [ 615.246465][T13747] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 617.236128][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 617.752537][T13810] 9pnet_virtio: no channels available for device syz [ 617.775842][T13810] gadgetfs: bound to dummy_udc driver [ 617.971992][ T4377] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 618.069535][T13827] ubi0: attaching mtd0 [ 618.085212][ T4387] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 618.111287][T13827] ubi0: scanning is finished [ 618.118701][T13827] ubi0: empty MTD device detected [ 618.210064][ T4377] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 618.238604][ C0] gadgetfs: connected [ 618.252046][ T4387] gadgetfs: disconnected [ 618.276618][ T4264] EXT4-fs error: 188 callbacks suppressed [ 618.276675][ T4264] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz-executor: Detected aborted journal [ 618.327240][T13828] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 618.360311][ T4377] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 618.413268][ T4264] EXT4-fs: 134 callbacks suppressed [ 618.413287][ T4264] EXT4-fs (sda1): Remounting filesystem read-only [ 618.569134][ C0] gadgetfs: connected [ 618.585888][ T4387] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 618.615743][ T4377] usb 5-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.00 [ 618.685524][T13829] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 618.706539][ T4264] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz-executor: Detected aborted journal [ 618.732567][ T4387] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 618.790094][ T4377] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.803389][T13790] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.1.2545: Detected aborted journal [ 618.830476][ T4387] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.858325][ T4264] EXT4-fs (sda1): Remounting filesystem read-only [ 618.913754][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #2001: block 270: comm dhcpcd: unable to read itable block [ 618.966290][T13825] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2554: Detected aborted journal [ 618.980402][T13825] EXT4-fs (sda1): Remounting filesystem read-only [ 618.987750][T13825] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2554: Detected aborted journal [ 619.000763][T13825] EXT4-fs (sda1): Remounting filesystem read-only [ 619.012635][T13825] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2554: Detected aborted journal [ 619.024546][T13825] EXT4-fs (sda1): Remounting filesystem read-only [ 619.035433][T13825] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2554: Detected aborted journal [ 619.046714][T13825] EXT4-fs (sda1): Remounting filesystem read-only [ 619.101977][ T4264] EXT4-fs (sda1): Remounting filesystem read-only [ 619.157462][T13825] EXT4-fs (sda1): Remounting filesystem read-only [ 619.165275][T13825] EXT4-fs (sda1): Remounting filesystem read-only [ 619.185690][T13790] EXT4-fs (sda1): Remounting filesystem read-only [ 619.231954][T13790] gadgetfs: suspended from state 3 [ 619.240920][ T4387] usb 1-1: can't set config #1, error -71 [ 619.240930][T13790] gadgetfs: disconnected [ 619.349870][ T4377] usb 5-1: interface 1 not found [ 619.366234][ T4387] usb 1-1: USB disconnect, device number 2 [ 619.623454][T13827] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 619.660458][T13827] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 619.679138][ T4283] usb 5-1: USB disconnect, device number 2 [ 619.729397][T13827] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 619.760755][T13827] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 619.818035][T13827] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 619.823264][T13844] loop3: detected capacity change from 0 to 512 [ 619.888281][T13844] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 619.918099][T13827] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 619.979761][T13844] EXT4-fs (loop3): 1 truncate cleaned up [ 619.997558][T13844] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 620.056027][T13827] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1717763415 [ 620.071851][T13827] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 620.089568][T13838] ubi0: background thread "ubi_bgt0d" started, PID 13838 [ 620.371240][T13856] futex_wake_op: syz.0.2560 tries to shift op by 144; fix this program [ 620.463498][T13856] futex_wake_op: syz.0.2560 tries to shift op by 144; fix this program [ 621.818264][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 621.896265][T13886] netlink: 24 bytes leftover after parsing attributes in process `syz.9.2564'. [ 622.374284][ T14] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 622.520544][T13922] loop1: detected capacity change from 0 to 512 [ 622.564041][ T14] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 622.594156][T13922] EXT4-fs error (device loop1): dx_probe:823: inode #2: comm syz.1.2570: Attempting to read directory block (0) that is past i_size (16) [ 622.628800][ T14] usb 1-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 622.681193][T13922] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -117 [ 622.698469][T13922] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 622.702044][ T14] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.763964][T13937] i2c-slave-eeprom 0-1022: i2c_slave_register: not supported by adapter [ 622.795447][T13937] i2c-slave-eeprom: probe of 0-1022 failed with error -95 [ 622.897046][T13948] loop4: detected capacity change from 0 to 512 [ 622.930797][T13941] tcpci: probe of 0-0002 failed with error -5 [ 622.947282][T13937] i2c i2c-0: new_device: Instantiated device slave-24c02 at 0x22 [ 622.972110][T13948] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 622.987554][T13948] EXT4-fs (loop4): 1 truncate cleaned up [ 622.995066][T13948] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 623.073099][T13941] i2c i2c-0: new_device: Instantiated device tcpci at 0x02 [ 623.207683][ T14] qmi_wwan 1-1:1.0: cdc-wdm0: USB WDM device [ 623.244261][ T14] qmi_wwan 1-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.0-1, WWAN/QMI device, a6:99:10:36:0c:1f [ 623.288840][ T4264] EXT4-fs error: 207 callbacks suppressed [ 623.288880][ T4264] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz-executor: Detected aborted journal [ 623.513322][T13888] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.0.2567: Detected aborted journal [ 623.555631][T13932] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.3.2577: Detected aborted journal [ 623.674402][ T4264] EXT4-fs: 109 callbacks suppressed [ 623.674733][ T4264] EXT4-fs (sda1): Remounting filesystem read-only [ 623.694027][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #2001: block 270: comm dhcpcd: unable to read itable block [ 623.783070][T13964] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2580: Detected aborted journal [ 623.812034][T13888] EXT4-fs (sda1): Remounting filesystem read-only [ 623.849231][T11863] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #1135: block 215: comm udevd: unable to read itable block [ 623.872106][T13888] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.0.2567: Detected aborted journal [ 623.895663][T13932] EXT4-fs (sda1): Remounting filesystem read-only [ 623.909007][ T4264] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz-executor: Detected aborted journal [ 623.921561][T13964] EXT4-fs (sda1): Remounting filesystem read-only [ 623.948217][T13932] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.3.2577: Detected aborted journal [ 623.972459][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #2001: block 270: comm dhcpcd: unable to read itable block [ 623.998748][T13888] EXT4-fs (sda1): Remounting filesystem read-only [ 624.021796][ T4264] EXT4-fs (sda1): Remounting filesystem read-only [ 624.042825][T13964] EXT4-fs (sda1): Remounting filesystem read-only [ 624.060344][T13888] EXT4-fs (sda1): Remounting filesystem read-only [ 624.072071][T13932] EXT4-fs (sda1): Remounting filesystem read-only [ 624.149431][T13888] EXT4-fs (sda1): Remounting filesystem read-only [ 624.230780][T13933] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input5 [ 624.272439][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.279263][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.579350][ T14] usb 1-1: USB disconnect, device number 3 [ 624.652711][ T14] qmi_wwan 1-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.0-1, WWAN/QMI device [ 624.862436][T10535] EXT4-fs (loop1): unmounting filesystem. [ 625.201000][T10712] EXT4-fs (loop4): unmounting filesystem. [ 625.844257][T13988] loop4: detected capacity change from 0 to 128 [ 625.925049][T13993] loop3: detected capacity change from 0 to 256 [ 626.044083][T13993] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 626.160963][T13993] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 627.162296][T14022] loop3: detected capacity change from 0 to 512 [ 627.215612][T14022] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 627.252312][T14031] device-mapper: table: 248:2: multipath: error getting device (-ENODEV) [ 627.261804][T14031] device-mapper: ioctl: error adding target to table [ 627.267958][T14022] EXT4-fs (loop3): 1 truncate cleaned up [ 627.315121][T14022] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 627.327454][T14029] FAULT_INJECTION: forcing a failure. [ 627.327454][T14029] name failslab, interval 1, probability 0, space 0, times 0 [ 627.346185][T14029] CPU: 1 PID: 14029 Comm: syz.4.2594 Not tainted syzkaller #0 [ 627.353794][T14029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 627.365354][T14029] Call Trace: [ 627.368921][T14029] [ 627.371882][T14029] dump_stack_lvl+0x188/0x24e [ 627.378148][T14029] ? show_regs_print_info+0x12/0x12 [ 627.383895][T14029] ? load_image+0x410/0x410 [ 627.388432][T14029] ? __might_sleep+0xd0/0xd0 [ 627.393150][T14029] ? __lock_acquire+0x7ea0/0x7ea0 [ 627.398481][T14029] ? finish_task_switch+0x262/0x8e0 [ 627.403985][T14029] ? verify_lock_unused+0x140/0x140 [ 627.409280][T14029] should_fail_ex+0x390/0x4c0 [ 627.414446][T14029] should_failslab+0x5/0x20 [ 627.419700][T14029] slab_pre_alloc_hook+0x59/0x300 [ 627.424942][T14029] ? __lock_acquire+0x142d/0x7ea0 [ 627.430172][T14029] ? snd_pcm_oss_change_params_locked+0x145/0x3bd0 [ 627.436865][T14029] __kmem_cache_alloc_node+0x4f/0x270 [ 627.442286][T14029] ? snd_pcm_oss_change_params_locked+0x145/0x3bd0 [ 627.449000][T14029] kmalloc_trace+0x26/0xe0 [ 627.453639][T14029] snd_pcm_oss_change_params_locked+0x145/0x3bd0 [ 627.460196][T14029] ? __mutex_trylock_common+0x15c/0x260 [ 627.465834][T14029] ? trace_raw_output_contention_end+0xd0/0xd0 [ 627.473467][T14029] ? locks_remove_file+0x372/0xe80 [ 627.480139][T14029] ? rcu_is_watching+0x11/0xa0 [ 627.485388][T14029] ? trace_contention_end+0x5f/0x170 [ 627.491263][T14029] ? __mutex_lock+0x1ab/0xb40 [ 627.497843][T14029] ? locks_remove_posix+0x680/0x680 [ 627.503090][T14029] ? fput+0xd9/0x1a0 [ 627.507023][T14029] ? __x64_sys_close+0x34/0x70 [ 627.511837][T14029] ? do_syscall_64+0x4c/0xa0 [ 627.516534][T14029] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 627.522742][T14029] ? snd_pcm_oss_sync+0x2b5/0xb10 [ 627.527813][T14029] ? snd_pcm_oss_read2+0x3d0/0x3d0 [ 627.533328][T14029] ? mutex_lock_nested+0x10/0x10 [ 627.538496][T14029] ? memset+0x1e/0x40 [ 627.542880][T14029] ? __fsnotify_parent+0x72a/0x820 [ 627.548480][T14029] snd_pcm_oss_sync+0x370/0xb10 [ 627.553635][T14029] snd_pcm_oss_release+0xfe/0x240 [ 627.558915][T14029] ? snd_pcm_oss_open+0x1ec0/0x1ec0 [ 627.564742][T14029] __fput+0x20a/0x8b0 [ 627.569308][T14029] task_work_run+0x1d0/0x260 [ 627.574261][T14029] ? task_work_cancel+0x220/0x220 [ 627.579692][T14029] ? exit_to_user_mode_loop+0x3b/0x110 [ 627.585310][T14029] exit_to_user_mode_loop+0xe6/0x110 [ 627.591347][T14029] exit_to_user_mode_prepare+0xee/0x180 [ 627.597169][T14029] syscall_exit_to_user_mode+0x16/0x40 [ 627.602775][T14029] do_syscall_64+0x58/0xa0 [ 627.607246][T14029] ? clear_bhb_loop+0x60/0xb0 [ 627.612214][T14029] ? clear_bhb_loop+0x60/0xb0 [ 627.617371][T14029] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 627.623288][T14029] RIP: 0033:0x7f1bf519fb19 [ 627.627705][T14029] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 627.647496][T14029] RSP: 002b:00007f1bf5fc4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 627.655946][T14029] RAX: 0000000000000000 RBX: 00007f1bf5425fa0 RCX: 00007f1bf519fb19 [ 627.663961][T14029] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 627.672764][T14029] RBP: 00007f1bf5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 627.682089][T14029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 627.690077][T14029] R13: 00007f1bf5426038 R14: 00007f1bf5425fa0 R15: 00007ffce1b4bf48 [ 627.698105][T14029] [ 628.228310][T14048] loop9: detected capacity change from 0 to 128 [ 628.329265][T14046] EXT4-fs error: 117 callbacks suppressed [ 628.329286][T14046] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2598: Detected aborted journal [ 628.372956][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #2001: block 270: comm dhcpcd: unable to read itable block [ 628.462258][T14053] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.4.2599: Detected aborted journal [ 628.736680][T14053] EXT4-fs: 75 callbacks suppressed [ 628.736697][T14053] EXT4-fs (sda1): Remounting filesystem read-only [ 628.759183][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #2001: block 270: comm dhcpcd: unable to read itable block [ 629.118462][T14046] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2598: Detected aborted journal [ 629.129734][T14046] EXT4-fs (sda1): Remounting filesystem read-only [ 629.149051][T14053] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.4.2599: Detected aborted journal [ 629.149244][T14055] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.1.2600: Detected aborted journal [ 629.204405][T14057] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.0.2601: Detected aborted journal [ 629.215860][T14053] EXT4-fs (sda1): Remounting filesystem read-only [ 629.354954][ T3643] EXT4-fs error (device sda1): __ext4_find_entry:1687: inode #259: comm udevd: reading directory lblock 0 [ 629.387503][T14055] EXT4-fs (sda1): Remounting filesystem read-only [ 629.397659][T14057] EXT4-fs (sda1): Remounting filesystem read-only [ 629.418986][ T3643] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #1222: block 221: comm udevd: unable to read itable block [ 629.456821][T14057] EXT4-fs (sda1): Remounting filesystem read-only [ 629.479769][T14055] EXT4-fs (sda1): Remounting filesystem read-only [ 629.566016][T14067] EXT4-fs (sda1): Remounting filesystem read-only [ 629.583675][ T4278] EXT4-fs (loop3): unmounting filesystem. [ 629.640426][T14067] EXT4-fs (sda1): Remounting filesystem read-only [ 629.664335][T14071] EXT4-fs (sda1): Remounting filesystem read-only [ 629.796627][T14083] FAULT_INJECTION: forcing a failure. [ 629.796627][T14083] name failslab, interval 1, probability 0, space 0, times 0 [ 629.847332][T14083] CPU: 0 PID: 14083 Comm: syz.4.2603 Not tainted syzkaller #0 [ 629.854887][T14083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 629.864984][T14083] Call Trace: [ 629.868338][T14083] [ 629.871290][T14083] dump_stack_lvl+0x188/0x24e [ 629.876010][T14083] ? show_regs_print_info+0x12/0x12 [ 629.881317][T14083] ? load_image+0x410/0x410 [ 629.885874][T14083] ? __lock_acquire+0x7ea0/0x7ea0 [ 629.890950][T14083] should_fail_ex+0x390/0x4c0 [ 629.895674][T14083] should_failslab+0x5/0x20 [ 629.900218][T14083] slab_pre_alloc_hook+0x59/0x300 [ 629.905292][T14083] ? __vmalloc_node_range+0x584/0x1380 [ 629.910879][T14083] __kmem_cache_alloc_node+0x4f/0x270 [ 629.916293][T14083] ? __vmalloc_node_range+0x584/0x1380 [ 629.921805][T14083] __kmalloc_node+0xa2/0x240 [ 629.926415][T14083] __vmalloc_node_range+0x584/0x1380 [ 629.931877][T14083] ? free_vm_area+0x50/0x50 [ 629.936526][T14083] ? kvmalloc_node+0x6c/0x180 [ 629.941207][T14083] ? kvmalloc_node+0x6c/0x180 [ 629.945887][T14083] ? __kmalloc_node+0xe3/0x240 [ 629.950669][T14083] ? bpf_check+0x227/0x11060 [ 629.955389][T14083] vzalloc+0x75/0x80 [ 629.959295][T14083] ? bpf_check+0x227/0x11060 [ 629.963887][T14083] bpf_check+0x227/0x11060 [ 629.968324][T14083] ? mark_lock+0x94/0x320 [ 629.972677][T14083] ? verify_lock_unused+0x140/0x140 [ 629.977921][T14083] ? bpf_get_btf_vmlinux+0x60/0x60 [ 629.983095][T14083] ? xfd_validate_state+0x69/0x140 [ 629.988322][T14083] ? save_fpregs_to_fpstate+0x9a/0x1f0 [ 629.993840][T14083] ? mark_lock+0x94/0x320 [ 629.998178][T14083] ? __lock_acquire+0x142d/0x7ea0 [ 630.003227][T14083] ? verify_lock_unused+0x140/0x140 [ 630.008436][T14083] ? __schedule+0x1091/0x4140 [ 630.013125][T14083] ? verify_lock_unused+0x140/0x140 [ 630.018351][T14083] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 630.024424][T14083] ? __lock_acquire+0x7ea0/0x7ea0 [ 630.029487][T14083] ? lock_chain_count+0x20/0x20 [ 630.034363][T14083] ? seqcount_lockdep_reader_access+0x127/0x1d0 [ 630.040700][T14083] ? lockdep_hardirqs_on+0x94/0x140 [ 630.045913][T14083] ? ktime_get_with_offset+0xff/0x320 [ 630.051292][T14083] ? seqcount_lockdep_reader_access+0x18d/0x1d0 [ 630.057542][T14083] ? ktime_get_real_ts64+0x440/0x440 [ 630.062855][T14083] ? preempt_schedule_thunk+0x16/0x18 [ 630.068311][T14083] ? __might_fault+0xc2/0x120 [ 630.073005][T14083] ? memset+0x1e/0x40 [ 630.077001][T14083] ? bpf_obj_name_cpy+0x190/0x1d0 [ 630.082133][T14083] bpf_prog_load+0x100e/0x1530 [ 630.086937][T14083] ? map_freeze+0x390/0x390 [ 630.091475][T14083] ? __might_fault+0xa6/0x120 [ 630.096169][T14083] ? __might_fault+0xa6/0x120 [ 630.100856][T14083] ? __might_fault+0xc2/0x120 [ 630.105536][T14083] ? __might_fault+0xa6/0x120 [ 630.110220][T14083] ? bpf_lsm_bpf+0x5/0x10 [ 630.114570][T14083] ? security_bpf+0x7a/0xa0 [ 630.119114][T14083] __sys_bpf+0x5b8/0x780 [ 630.123433][T14083] ? bpf_link_show_fdinfo+0x550/0x550 [ 630.128882][T14083] ? lock_chain_count+0x20/0x20 [ 630.133756][T14083] __x64_sys_bpf+0x78/0x90 [ 630.138188][T14083] do_syscall_64+0x4c/0xa0 [ 630.142646][T14083] ? clear_bhb_loop+0x60/0xb0 [ 630.147334][T14083] ? clear_bhb_loop+0x60/0xb0 [ 630.152021][T14083] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 630.157925][T14083] RIP: 0033:0x7f1bf519fb19 [ 630.162341][T14083] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 630.181952][T14083] RSP: 002b:00007f1bf5fc4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 630.190367][T14083] RAX: ffffffffffffffda RBX: 00007f1bf5425fa0 RCX: 00007f1bf519fb19 [ 630.198406][T14083] RDX: 0000000000000080 RSI: 0000200000000680 RDI: 0000000000000005 [ 630.206493][T14083] RBP: 00007f1bf5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 630.216776][T14083] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 630.224850][T14083] R13: 00007f1bf5426038 R14: 00007f1bf5425fa0 R15: 00007ffce1b4bf48 [ 630.233043][T14083] [ 630.854991][ T26] kauditd_printk_skb: 33 callbacks suppressed [ 630.855150][ T26] audit: type=1326 audit(1793738885.815:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 630.968865][ T26] audit: type=1326 audit(1793738885.815:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 631.100221][ T26] audit: type=1326 audit(1793738885.815:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 631.153783][ T26] audit: type=1326 audit(1793738885.815:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 631.188926][ T4380] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 631.206521][ T26] audit: type=1326 audit(1793738885.815:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 631.236414][ T26] audit: type=1326 audit(1793738885.825:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 631.305461][ T26] audit: type=1326 audit(1793738885.825:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 631.336801][ T4380] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 631.356398][ T26] audit: type=1326 audit(1793738885.825:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 631.397253][ T26] audit: type=1326 audit(1793738885.825:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=311 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 631.455024][ T26] audit: type=1326 audit(1793738885.825:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f31cff9fb19 code=0x7ffc0000 [ 631.456186][ T4380] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 631.648074][ T4380] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 631.804197][T14139] FAULT_INJECTION: forcing a failure. [ 631.804197][T14139] name failslab, interval 1, probability 0, space 0, times 0 [ 631.816986][T14139] CPU: 1 PID: 14139 Comm: syz.0.2617 Not tainted syzkaller #0 [ 631.824483][T14139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 631.834862][T14139] Call Trace: [ 631.838281][T14139] [ 631.841258][T14139] dump_stack_lvl+0x188/0x24e [ 631.846209][T14139] ? show_regs_print_info+0x12/0x12 [ 631.851463][T14139] ? load_image+0x410/0x410 [ 631.856036][T14139] ? __might_sleep+0xd0/0xd0 [ 631.860705][T14139] ? __lock_acquire+0x7ea0/0x7ea0 [ 631.865954][T14139] should_fail_ex+0x390/0x4c0 [ 631.870770][T14139] should_failslab+0x5/0x20 [ 631.875317][T14139] slab_pre_alloc_hook+0x59/0x300 [ 631.880476][T14139] kmem_cache_alloc+0x56/0x2f0 [ 631.885287][T14139] ? getname_flags+0xb7/0x500 [ 631.890016][T14139] getname_flags+0xb7/0x500 [ 631.894596][T14139] __x64_sys_unlinkat+0xaa/0xe0 [ 631.899477][T14139] do_syscall_64+0x4c/0xa0 [ 631.903948][T14139] ? clear_bhb_loop+0x60/0xb0 [ 631.908665][T14139] ? clear_bhb_loop+0x60/0xb0 [ 631.913388][T14139] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 631.919326][T14139] RIP: 0033:0x7fc0e019fb19 [ 631.923861][T14139] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 631.943501][T14139] RSP: 002b:00007fc0de3f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 631.952007][T14139] RAX: ffffffffffffffda RBX: 00007fc0e0426090 RCX: 00007fc0e019fb19 [ 631.960009][T14139] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 631.968005][T14139] RBP: 00007fc0e0237b70 R08: 0000000000000000 R09: 0000000000000000 [ 631.976180][T14139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 631.984408][T14139] R13: 00007fc0e0426128 R14: 00007fc0e0426090 R15: 00007ffebcac7ec8 [ 631.995205][T14139] [ 632.043694][ T4380] tipc: Left network mode [ 632.881474][T14182] FAULT_INJECTION: forcing a failure. [ 632.881474][T14182] name failslab, interval 1, probability 0, space 0, times 0 [ 632.899343][T14182] CPU: 0 PID: 14182 Comm: syz.0.2622 Not tainted syzkaller #0 [ 632.906909][T14182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 632.916966][T14182] Call Trace: [ 632.920247][T14182] [ 632.923232][T14182] dump_stack_lvl+0x188/0x24e [ 632.927945][T14182] ? show_regs_print_info+0x12/0x12 [ 632.933177][T14182] ? load_image+0x410/0x410 [ 632.937693][T14182] ? __might_sleep+0xd0/0xd0 [ 632.942320][T14182] ? __lock_acquire+0x7ea0/0x7ea0 [ 632.947366][T14182] should_fail_ex+0x390/0x4c0 [ 632.952058][T14182] should_failslab+0x5/0x20 [ 632.956561][T14182] slab_pre_alloc_hook+0x59/0x300 [ 632.961618][T14182] kmem_cache_alloc+0x56/0x2f0 [ 632.966390][T14182] ? __kernfs_new_node+0xe1/0x7f0 [ 632.971543][T14182] __kernfs_new_node+0xe1/0x7f0 [ 632.976552][T14182] ? __lock_acquire+0x7ea0/0x7ea0 [ 632.981626][T14182] ? kernfs_new_node+0x250/0x250 [ 632.986595][T14182] kernfs_new_node+0x148/0x250 [ 632.991386][T14182] __kernfs_create_file+0x47/0x2e0 [ 632.996503][T14182] sysfs_add_file_mode_ns+0x233/0x2f0 [ 633.001885][T14182] internal_create_group+0x490/0xce0 [ 633.007328][T14182] ? sysfs_create_group+0x20/0x20 [ 633.012379][T14182] ? rwsem_write_trylock+0x135/0x1c0 [ 633.017696][T14182] sysfs_create_groups+0x55/0x120 [ 633.022979][T14182] device_add_attrs+0xdb/0x830 [ 633.027877][T14182] ? get_device_parent+0x3e0/0x3e0 [ 633.033294][T14182] ? kernfs_put+0x442/0x480 [ 633.037921][T14182] device_add+0x677/0x1050 [ 633.042467][T14182] rfkill_register+0x16c/0x9b0 [ 633.047396][T14182] hci_register_dev+0x40e/0x8a0 [ 633.052313][T14182] hci_uart_tty_ioctl+0x819/0xa10 [ 633.057514][T14182] ? hci_uart_tty_write+0x10/0x10 [ 633.063182][T14182] tty_ioctl+0x878/0xba0 [ 633.067448][T14182] ? security_file_ioctl+0x7c/0xa0 [ 633.072676][T14182] ? tty_get_icount+0xa0/0xa0 [ 633.077460][T14182] __se_sys_ioctl+0xfa/0x170 [ 633.082238][T14182] do_syscall_64+0x4c/0xa0 [ 633.087826][T14182] ? clear_bhb_loop+0x60/0xb0 [ 633.093284][T14182] ? clear_bhb_loop+0x60/0xb0 [ 633.098182][T14182] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 633.104364][T14182] RIP: 0033:0x7fc0e019fb19 [ 633.109406][T14182] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 633.130818][T14182] RSP: 002b:00007fc0e0f99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 633.139371][T14182] RAX: ffffffffffffffda RBX: 00007fc0e0425fa0 RCX: 00007fc0e019fb19 [ 633.148064][T14182] RDX: 0000000400000009 RSI: 00000000400455c8 RDI: 0000000000000004 [ 633.156050][T14182] RBP: 00007fc0e0237b70 R08: 0000000000000000 R09: 0000000000000000 [ 633.164574][T14182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 633.172743][T14182] R13: 00007fc0e0426038 R14: 00007fc0e0425fa0 R15: 00007ffebcac7ec8 [ 633.180765][T14182] [ 633.337212][T14195] EXT4-fs error: 126 callbacks suppressed [ 633.337225][T14195] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 633.474062][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #2001: block 270: comm dhcpcd: unable to read itable block [ 633.587814][T14200] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2627: Detected aborted journal [ 633.605048][T14201] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 633.606689][T14202] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.1.2626: Detected aborted journal [ 633.648415][T14199] EXT4-fs error (device sda1): __ext4_find_entry:1687: inode #1265: comm syz-executor: reading directory lblock 0 [ 633.668189][T14200] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2627: Detected aborted journal [ 633.677871][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #2001: block 270: comm dhcpcd: unable to read itable block [ 633.697060][T14202] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.1.2626: Detected aborted journal [ 633.845327][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #2001: block 270: comm dhcpcd: unable to read itable block [ 634.640382][T14214] EXT4-fs: 57 callbacks suppressed [ 634.640395][T14214] EXT4-fs (sda1): Remounting filesystem read-only [ 634.704754][T14214] EXT4-fs (sda1): Remounting filesystem read-only [ 634.937213][ T4380] device hsr_slave_0 left promiscuous mode [ 634.949603][ T4380] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 634.957244][ T4380] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 634.968631][ T4380] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 634.976508][ T4380] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 635.009801][ T4380] device veth0_vlan left promiscuous mode [ 635.213191][ T4293] Bluetooth: hci1: command 0xfc11 tx timeout [ 635.220470][ T4294] Bluetooth: hci1: Entering manufacturer mode failed (-110) [ 635.336736][ T4380] bond1 (unregistering): Released all slaves [ 635.692668][ T4264] EXT4-fs (sda1): Remounting filesystem read-only [ 635.779849][T14226] EXT4-fs (sda1): Remounting filesystem read-only [ 635.791319][T14229] EXT4-fs (sda1): Remounting filesystem read-only [ 635.798414][T14227] EXT4-fs (sda1): Remounting filesystem read-only [ 635.802643][T14228] EXT4-fs (sda1): Remounting filesystem read-only [ 635.828598][T14228] EXT4-fs (sda1): Remounting filesystem read-only [ 635.828697][T14229] EXT4-fs (sda1): Remounting filesystem read-only [ 635.844011][T14227] EXT4-fs (sda1): Remounting filesystem read-only [ 635.888213][T14231] loop1: detected capacity change from 0 to 512 [ 636.063002][T14234] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2630'. [ 636.117768][T14236] FAULT_INJECTION: forcing a failure. [ 636.117768][T14236] name failslab, interval 1, probability 0, space 0, times 0 [ 636.130730][T14236] CPU: 1 PID: 14236 Comm: syz.1.2631 Not tainted syzkaller #0 [ 636.138338][T14236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 636.148697][T14236] Call Trace: [ 636.152603][T14236] [ 636.155608][T14236] dump_stack_lvl+0x188/0x24e [ 636.160585][T14236] ? show_regs_print_info+0x12/0x12 [ 636.166101][T14236] ? load_image+0x410/0x410 [ 636.170744][T14236] ? __might_sleep+0xd0/0xd0 [ 636.175357][T14236] ? __lock_acquire+0x7ea0/0x7ea0 [ 636.180580][T14236] should_fail_ex+0x390/0x4c0 [ 636.185370][T14236] should_failslab+0x5/0x20 [ 636.189921][T14236] slab_pre_alloc_hook+0x59/0x300 [ 636.194966][T14236] kmem_cache_alloc+0x56/0x2f0 [ 636.199842][T14236] ? getname_flags+0xb7/0x500 [ 636.204734][T14236] getname_flags+0xb7/0x500 [ 636.209342][T14236] __x64_sys_unlinkat+0xaa/0xe0 [ 636.214572][T14236] do_syscall_64+0x4c/0xa0 [ 636.219011][T14236] ? clear_bhb_loop+0x60/0xb0 [ 636.223702][T14236] ? clear_bhb_loop+0x60/0xb0 [ 636.228576][T14236] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 636.235283][T14236] RIP: 0033:0x7f31cff9fb19 [ 636.239746][T14236] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 636.261198][T14236] RSP: 002b:00007f31d0edb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 636.269638][T14236] RAX: ffffffffffffffda RBX: 00007f31d0226090 RCX: 00007f31cff9fb19 [ 636.278322][T14236] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 636.286663][T14236] RBP: 00007f31d0037b70 R08: 0000000000000000 R09: 0000000000000000 [ 636.294638][T14236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 636.302901][T14236] R13: 00007f31d0226128 R14: 00007f31d0226090 R15: 00007ffd12534378 [ 636.311197][T14236] [ 636.978708][ T4380] team0 (unregistering): Port device team_slave_1 removed [ 637.055863][ T4380] team0 (unregistering): Port device team_slave_0 removed [ 637.109283][ T4380] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 637.166312][ T4380] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 637.580009][ T4380] bond0 (unregistering): Released all slaves [ 638.381835][T10630] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 638.840820][T14274] EXT4-fs error: 58 callbacks suppressed [ 638.841465][T14274] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.1.2638: Detected aborted journal [ 638.917675][T14274] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.1.2638: Detected aborted journal [ 639.111924][T10630] usb 5-1: Using ep0 maxpacket: 8 [ 639.119960][T10630] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 639.127985][T10630] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 639.140107][T10630] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 639.153604][T10630] usb 5-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 639.165002][T10630] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 639.179976][T10630] usb 5-1: config 168 interface 0 has no altsetting 0 [ 639.190359][T10630] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 639.198815][T10630] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 639.211181][T10630] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 639.223162][T10630] usb 5-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 639.234639][T10630] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 639.249473][T10630] usb 5-1: config 168 interface 0 has no altsetting 0 [ 639.258869][T10630] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 639.267476][T10630] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 639.279676][ T4264] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz-executor: Detected aborted journal [ 639.280121][T10630] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 639.319582][T14288] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.0.2640: Detected aborted journal [ 639.330898][T10630] usb 5-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 639.356885][T14287] EXT4-fs error (device sda1): __ext4_find_entry:1687: inode #1265: comm syz-executor: reading directory lblock 0 [ 639.370540][T14289] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.9.2642: Detected aborted journal [ 639.383412][T10630] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 639.390109][T14291] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.1.2641: Detected aborted journal [ 639.401537][T14288] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.0.2640: Detected aborted journal [ 639.431646][T10630] usb 5-1: config 168 interface 0 has no altsetting 0 [ 639.440570][ T3643] EXT4-fs error (device sda1): __ext4_find_entry:1687: inode #259: comm udevd: reading directory lblock 0 [ 639.442375][T10630] usb 5-1: string descriptor 0 read error: -22 [ 639.453402][T14288] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm syz.0.2640: Detected aborted journal [ 639.458387][T10630] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 639.486252][T10630] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 639.499887][T10630] adutux 5-1:168.0: interrupt endpoints not found [ 639.657178][T14289] EXT4-fs: 36 callbacks suppressed [ 639.657195][T14289] EXT4-fs (sda1): Remounting filesystem read-only [ 639.657925][T14300] [ 639.671222][T14300] ====================================================== [ 639.678829][T14300] WARNING: possible circular locking dependency detected [ 639.685878][T14300] syzkaller #0 Not tainted [ 639.690305][T14300] ------------------------------------------------------ [ 639.698491][T14300] syz.9.2642/14300 is trying to acquire lock: [ 639.702699][T14272] EXT4-fs (sda1): Remounting filesystem read-only [ 639.704957][T14300] ffff888032e03350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_start_poll+0x8de/0xd10 [ 639.721676][T14272] EXT4-fs (sda1): Remounting filesystem read-only [ 639.723359][T14300] [ 639.723359][T14300] but task is already holding lock: [ 639.723368][T14300] ffff888032e06510 (&genl_data->genl_data_mutex){+.+.}-{3:3}, at: nfc_genl_start_poll+0x1c9/0x340 [ 639.749192][T14300] [ 639.749192][T14300] which lock already depends on the new lock. [ 639.749192][T14300] [ 639.760309][T14300] [ 639.760309][T14300] the existing dependency chain (in reverse order) is: [ 639.769614][T14300] [ 639.769614][T14300] -> #3 (&genl_data->genl_data_mutex){+.+.}-{3:3}: [ 639.778625][T14300] __mutex_lock+0x12d/0xb40 [ 639.783950][T14300] nfc_urelease_event_work+0x120/0x310 [ 639.790066][T14300] process_one_work+0x8ab/0x1160 [ 639.795583][T14300] worker_thread+0xaf5/0x12a0 [ 639.800865][T14300] kthread+0x29d/0x330 [ 639.805574][T14300] ret_from_fork+0x1f/0x30 [ 639.810988][T14300] [ 639.810988][T14300] -> #2 (nfc_devlist_mutex){+.+.}-{3:3}: [ 639.813643][T14272] EXT4-fs (sda1): Remounting filesystem read-only [ 639.818819][T14300] __mutex_lock+0x12d/0xb40 [ 639.818844][T14300] nfc_register_device+0x38/0x300 [ 639.818863][T14300] nci_register_device+0x89f/0x9f0 [ 639.826240][T10630] usb 5-1: USB disconnect, device number 3 [ 639.830338][T14300] virtual_ncidev_open+0x55/0xc0 [ 639.853684][T14300] misc_open+0x31f/0x390 [ 639.858600][T14300] chrdev_open+0x585/0x5f0 [ 639.863540][T14300] do_dentry_open+0x7dd/0x10b0 [ 639.868858][T14300] path_openat+0x2674/0x2f10 [ 639.873974][T14300] do_filp_open+0x1ee/0x420 [ 639.879046][T14300] do_sys_openat2+0x14b/0x4f0 [ 639.884262][T14300] __x64_sys_openat+0x135/0x160 [ 639.889666][T14300] do_syscall_64+0x4c/0xa0 [ 639.894608][T14300] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 639.901032][T14300] [ 639.901032][T14300] -> #1 (nci_mutex){+.+.}-{3:3}: [ 639.908146][T14300] __mutex_lock+0x12d/0xb40 [ 639.913363][T14300] virtual_nci_close+0x13/0x40 [ 639.918716][T14300] nci_dev_up+0x976/0xd90 [ 639.923583][T14300] nfc_dev_up+0x15d/0x310 [ 639.928435][T14300] nfc_genl_dev_up+0x85/0xd0 [ 639.933589][T14300] genl_family_rcv_msg_doit+0x22f/0x350 [ 639.939665][T14300] genl_rcv_msg+0x601/0x790 [ 639.944690][T14300] netlink_rcv_skb+0x1ef/0x440 [ 639.950009][T14300] genl_rcv+0x24/0x40 [ 639.954510][T14300] netlink_unicast+0x7ad/0x920 [ 639.959804][T14300] netlink_sendmsg+0x8ad/0xbd0 [ 639.965120][T14300] ____sys_sendmsg+0x5ed/0x9a0 [ 639.970683][T14300] ___sys_sendmsg+0x2a2/0x360 [ 639.975999][T14300] __se_sys_sendmsg+0x1c3/0x2b0 [ 639.981555][T14300] do_syscall_64+0x4c/0xa0 [ 639.986496][T14300] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 639.992926][T14300] [ 639.992926][T14300] -> #0 (&ndev->req_lock){+.+.}-{3:3}: [ 640.000659][T14300] __lock_acquire+0x3a03/0x7ea0 [ 640.006058][T14300] lock_acquire+0x1bc/0x4a0 [ 640.011444][T14300] __mutex_lock+0x12d/0xb40 [ 640.016592][T14300] nci_start_poll+0x8de/0xd10 [ 640.021824][T14300] nfc_start_poll+0x141/0x2c0 [ 640.027027][T14300] nfc_genl_start_poll+0x1d7/0x340 [ 640.032751][T14300] genl_family_rcv_msg_doit+0x22f/0x350 [ 640.038866][T14300] genl_rcv_msg+0x601/0x790 [ 640.043926][T14300] netlink_rcv_skb+0x1ef/0x440 [ 640.049241][T14300] genl_rcv+0x24/0x40 [ 640.053789][T14300] netlink_unicast+0x7ad/0x920 [ 640.059098][T14300] netlink_sendmsg+0x8ad/0xbd0 [ 640.065136][T14300] ____sys_sendmsg+0x5ed/0x9a0 [ 640.070571][T14300] ___sys_sendmsg+0x2a2/0x360 [ 640.075793][T14300] __se_sys_sendmsg+0x1c3/0x2b0 [ 640.081198][T14300] do_syscall_64+0x4c/0xa0 [ 640.086364][T14300] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 640.093108][T14300] [ 640.093108][T14300] other info that might help us debug this: [ 640.093108][T14300] [ 640.103384][T14300] Chain exists of: [ 640.103384][T14300] &ndev->req_lock --> nfc_devlist_mutex --> &genl_data->genl_data_mutex [ 640.103384][T14300] [ 640.117997][T14300] Possible unsafe locking scenario: [ 640.117997][T14300] [ 640.125748][T14300] CPU0 CPU1 [ 640.131345][T14300] ---- ---- [ 640.136739][T14300] lock(&genl_data->genl_data_mutex); [ 640.142734][T14300] lock(nfc_devlist_mutex); [ 640.144714][T14272] EXT4-fs (sda1): Remounting filesystem read-only [ 640.150536][T14300] lock(&genl_data->genl_data_mutex); [ 640.165345][T14300] lock(&ndev->req_lock); [ 640.166881][T14272] EXT4-fs (sda1): Remounting filesystem read-only [ 640.170551][T14300] [ 640.170551][T14300] *** DEADLOCK *** [ 640.170551][T14300] [ 640.170557][T14300] 4 locks held by syz.9.2642/14300: [ 640.170568][T14300] #0: ffffffff8edcc730 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 [ 640.198667][T14300] #1: ffffffff8edcc548 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x107/0x790 [ 640.207658][T14300] #2: ffff888032e06510 (&genl_data->genl_data_mutex){+.+.}-{3:3}, at: nfc_genl_start_poll+0x1c9/0x340 [ 640.219423][T14300] #3: ffff888032e06100 (&dev->mutex){....}-{3:3}, at: nfc_start_poll+0x4f/0x2c0 [ 640.229361][T14300] [ 640.229361][T14300] stack backtrace: [ 640.235357][T14300] CPU: 1 PID: 14300 Comm: syz.9.2642 Not tainted syzkaller #0 [ 640.243889][T14300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 640.255720][T14300] Call Trace: [ 640.259295][T14300] [ 640.262626][T14300] dump_stack_lvl+0x188/0x24e [ 640.268098][T14300] ? load_image+0x410/0x410 [ 640.272646][T14300] ? show_regs_print_info+0x12/0x12 [ 640.277894][T14300] ? print_circular_bug+0x12b/0x1a0 [ 640.283189][T14289] EXT4-fs (sda1): Remounting filesystem read-only [ 640.283197][T14300] check_noncircular+0x2f8/0x400 [ 640.294723][T14300] ? print_deadlock_bug+0x5d0/0x5d0 [ 640.299942][T14300] ? lockdep_lock+0xf1/0x1f0 [ 640.304554][T14300] ? _find_first_zero_bit+0xd2/0x100 [ 640.309908][T14300] __lock_acquire+0x3a03/0x7ea0 [ 640.314770][T14300] ? __lock_acquire+0x142d/0x7ea0 [ 640.319840][T14300] ? verify_lock_unused+0x140/0x140 [ 640.325077][T14300] ? mark_lock+0x94/0x320 [ 640.329411][T14300] ? __lock_acquire+0x142d/0x7ea0 [ 640.334777][T14300] ? look_up_lock_class+0x75/0x140 [ 640.340685][T14300] ? register_lock_class+0xc0/0x870 [ 640.345924][T14300] ? mark_lock+0x94/0x320 [ 640.350294][T14300] lock_acquire+0x1bc/0x4a0 [ 640.354798][T14300] ? nci_start_poll+0x8de/0xd10 [ 640.360167][T14300] ? __might_sleep+0xd0/0xd0 [ 640.364760][T14300] ? read_lock_is_recursive+0x10/0x10 [ 640.370160][T14300] __mutex_lock+0x12d/0xb40 [ 640.374870][T14300] ? nci_start_poll+0x8de/0xd10 [ 640.379830][T14300] ? verify_lock_unused+0x140/0x140 [ 640.385067][T14300] ? nci_start_poll+0x8de/0xd10 [ 640.390001][T14300] ? mutex_lock_nested+0x10/0x10 [ 640.395005][T14300] nci_start_poll+0x8de/0xd10 [ 640.399704][T14300] ? nci_dev_down+0x40/0x40 [ 640.404213][T14300] ? trace_raw_output_contention_end+0xd0/0xd0 [ 640.410359][T14300] ? __mutex_trylock_common+0x15c/0x260 [ 640.415902][T14300] ? rcu_is_watching+0x11/0xa0 [ 640.420672][T14300] ? trace_contention_end+0x5f/0x170 [ 640.426402][T14300] ? __mutex_lock+0x1ab/0xb40 [ 640.431102][T14300] ? __mutex_lock+0x1ab/0xb40 [ 640.435772][T14300] ? class_for_each_device+0x290/0x290 [ 640.441326][T14300] ? nfc_start_poll+0x4f/0x2c0 [ 640.446177][T14300] ? mutex_lock_nested+0x10/0x10 [ 640.451118][T14300] ? nfc_genl_start_poll+0x1c9/0x340 [ 640.456394][T14300] ? nfc_get_device+0x82/0xd0 [ 640.461055][T14300] ? nfc_release+0x2e0/0x2e0 [ 640.465695][T14300] nfc_start_poll+0x141/0x2c0 [ 640.470697][T14300] nfc_genl_start_poll+0x1d7/0x340 [ 640.475874][T14300] genl_family_rcv_msg_doit+0x22f/0x350 [ 640.481434][T14300] ? end_current_label_crit_section+0x170/0x170 [ 640.487695][T14300] ? genl_family_rcv_msg_dumpit+0x3c0/0x3c0 [ 640.493633][T14300] ? bpf_lsm_capable+0x5/0x10 [ 640.498305][T14300] ? security_capable+0x85/0xb0 [ 640.503147][T14300] genl_rcv_msg+0x601/0x790 [ 640.507650][T14300] ? genl_bind+0x360/0x360 [ 640.512170][T14300] ? nfc_genl_dev_down+0xd0/0xd0 [ 640.517415][T14300] netlink_rcv_skb+0x1ef/0x440 [ 640.522216][T14300] ? genl_bind+0x360/0x360 [ 640.526746][T14300] ? netlink_ack+0x1160/0x1160 [ 640.531674][T14300] ? down_read+0x1a8/0x2d0 [ 640.536283][T14300] genl_rcv+0x24/0x40 [ 640.540259][T14300] netlink_unicast+0x7ad/0x920 [ 640.545025][T14300] netlink_sendmsg+0x8ad/0xbd0 [ 640.549788][T14300] ? netlink_getsockopt+0x550/0x550 [ 640.555282][T14300] ? apparmor_socket_sendmsg+0x8a/0x330 [ 640.561167][T14300] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 640.566454][T14300] ? security_socket_sendmsg+0x7c/0xa0 [ 640.571910][T14300] ? netlink_getsockopt+0x550/0x550 [ 640.577148][T14300] ____sys_sendmsg+0x5ed/0x9a0 [ 640.581983][T14300] ? __sys_sendmsg_sock+0x30/0x30 [ 640.587024][T14300] ? __import_iovec+0x306/0x510 [ 640.591884][T14300] ? import_iovec+0x6f/0xa0 [ 640.596413][T14300] ___sys_sendmsg+0x2a2/0x360 [ 640.601455][T14300] ? __sys_sendmsg+0x2a0/0x2a0 [ 640.606267][T14300] __se_sys_sendmsg+0x1c3/0x2b0 [ 640.611125][T14300] ? __x64_sys_sendmsg+0x80/0x80 [ 640.616077][T14300] ? lockdep_hardirqs_on+0x94/0x140 [ 640.621295][T14300] do_syscall_64+0x4c/0xa0 [ 640.625739][T14300] ? clear_bhb_loop+0x60/0xb0 [ 640.630457][T14300] ? clear_bhb_loop+0x60/0xb0 [ 640.635148][T14300] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 640.641076][T14300] RIP: 0033:0x7f17f299fb19 [ 640.645499][T14300] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 640.665357][T14300] RSP: 002b:00007f17f38e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 640.674020][T14300] RAX: ffffffffffffffda RBX: 00007f17f2c26090 RCX: 00007f17f299fb19 [ 640.682095][T14300] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000005 [ 640.690298][T14300] RBP: 00007f17f2a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 640.700229][T14300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 640.708738][T14300] R13: 00007f17f2c26128 R14: 00007f17f2c26090 R15: 00007ffc2c0306a8 [ 640.716847][T14300] [ 640.723601][T14288] EXT4-fs (sda1): Remounting filesystem read-only [ 640.906519][T14311] EXT4-fs (sda1): Remounting filesystem read-only [ 640.933401][T14311] EXT4-fs (sda1): Remounting filesystem read-only [ 640.962731][T14300] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 641.112045][T14289] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 641.397569][T14289] bond0: (slave syz_tun): Releasing backup interface [ 641.476833][ T5922] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.542941][ T5922] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.624978][ T5922] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.674421][ T5922] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.787100][ T5922] tipc: Left network mode [ 642.504376][ T5922] device hsr_slave_0 left promiscuous mode [ 642.510619][ T5922] device hsr_slave_1 left promiscuous mode [ 642.517255][ T5922] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 642.524866][ T5922] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 642.532792][ T5922] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 642.540619][ T5922] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 642.549700][ T5922] device bridge_slave_1 left promiscuous mode [ 642.556030][ T5922] bridge0: port 2(bridge_slave_1) entered disabled state [ 642.564577][ T5922] device bridge_slave_0 left promiscuous mode [ 642.570849][ T5922] bridge0: port 1(bridge_slave_0) entered disabled state [ 642.581535][ T5922] device veth1_macvtap left promiscuous mode [ 642.588351][ T5922] device veth0_macvtap left promiscuous mode [ 642.594449][ T5922] device veth1_vlan left promiscuous mode [ 642.600245][ T5922] device veth0_vlan left promiscuous mode [ 642.721554][ T5922] team0 (unregistering): Port device team_slave_1 removed [ 642.733111][ T5922] team0 (unregistering): Port device team_slave_0 removed [ 642.764970][ T5922] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 642.798354][ T5922] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 642.849419][ T5922] bond0 (unregistering): Released all slaves [ 643.315783][ T5922] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.378941][ T5922] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.416003][ T5922] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.474780][ T5922] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.550574][ T5922] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.588243][ T5922] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.635051][ T5922] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.675070][ T5922] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.758934][ T5922] tipc: Left network mode [ 643.856355][ T3938] EXT4-fs error: 185 callbacks suppressed [ 643.856367][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #125: block 152: comm dhcpcd: unable to read itable block [ 643.882706][T14368] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 643.900122][T14369] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 643.932775][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #125: block 152: comm dhcpcd: unable to read itable block [ 643.949827][T14370] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 643.965340][T14371] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 643.995981][ T3938] EXT4-fs error (device sda1): __ext4_get_inode_loc_noinmem:4646: inode #2001: block 270: comm dhcpcd: unable to read itable block [ 644.016556][T14373] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 644.040509][T14374] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 644.057751][T14375] EXT4-fs error (device sda1): ext4_get_inode_loc:4661: inode #90: block 150: comm dhcpcd: unable to read itable block [ 644.927817][ T5922] device hsr_slave_0 left promiscuous mode [ 644.934873][ T5922] device hsr_slave_1 left promiscuous mode [ 644.941143][ T5922] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 644.950091][ T5922] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 644.958494][ T5922] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 644.966139][ T5922] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 644.975328][ T5922] device bridge_slave_1 left promiscuous mode [ 644.981643][ T5922] bridge0: port 2(bridge_slave_1) entered disabled state [ 644.989844][ T5922] device bridge_slave_0 left promiscuous mode [ 644.996213][ T5922] bridge0: port 1(bridge_slave_0) entered disabled state [ 645.006800][ T5922] device hsr_slave_0 left promiscuous mode [ 645.013260][ T5922] device hsr_slave_1 left promiscuous mode [ 645.019525][ T5922] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 645.027204][ T5922] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 645.035268][ T5922] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 645.042840][ T5922] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 645.050953][ T5922] device bridge_slave_1 left promiscuous mode [ 645.057261][ T5922] bridge0: port 2(bridge_slave_1) entered disabled state [ 645.066602][ T5922] device bridge_slave_0 left promiscuous mode [ 645.073316][ T5922] bridge0: port 1(bridge_slave_0) entered disabled state [ 645.087249][ T5922] device veth1_macvtap left promiscuous mode [ 645.093908][ T5922] device veth0_macvtap left promiscuous mode [ 645.100182][ T5922] device veth1_vlan left promiscuous mode [ 645.106997][ T5922] device veth0_vlan left promiscuous mode [ 645.113960][ T5922] device veth1_macvtap left promiscuous mode [ 645.120608][ T5922] device veth0_macvtap left promiscuous mode [ 645.126915][ T5922] device veth1_vlan left promiscuous mode [ 645.133542][ T5922] device veth0_vlan left promiscuous mode [ 645.307617][ T5922] team0 (unregistering): Port device team_slave_1 removed [ 645.319050][ T5922] team0 (unregistering): Port device team_slave_0 removed [ 645.354999][ T5922] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 645.407703][ T5922] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 645.454769][ T5922] bond0 (unregistering): Released all slaves [ 645.628730][ T5922] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 645.665450][ T5922] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 645.701796][ T5922] bond0 (unregistering): Released all slaves