last executing test programs: 10.979493044s ago: executing program 1 (id=772): socket$packet(0x11, 0x3, 0x300) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x700, 0x0, 0x0}, 0x0) close(0x3) r0 = socket(0x2, 0x80805, 0x0) shutdown(0xffffffffffffffff, 0x0) close(0x3) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2401}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) sendto$inet(r1, &(0x7f0000000180)="8995", 0x2, 0x4c041, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000500)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x14, 0x0, 0x1, 0x102, 0x0, 0x0, {0x3, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x20004040}, 0x4000801) 10.790694081s ago: executing program 0 (id=773): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresuid(0x0, 0xee01, 0x0) r3 = fanotify_init(0x200, 0x0) close(r3) 10.188083154s ago: executing program 3 (id=775): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) r3 = syz_clone(0x40011, 0x0, 0xfb, 0x0, 0x0, 0x0) r4 = gettid() kcmp(r4, r3, 0xb44c031f136537ae, 0xffffffffffffffff, 0xffffffffffffffff) 9.225242219s ago: executing program 2 (id=777): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf5c5d000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x14, 0x2, 0x6, 0x3}, 0x14}}, 0x0) 9.224967869s ago: executing program 0 (id=778): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r9, {0xc, 0xc}, {0x0, 0xfff1}, {0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 7.403254837s ago: executing program 2 (id=779): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) utimensat(0xffffffffffffff9c, &(0x7f00000003c0)='.\x00', 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x19, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) 5.670580571s ago: executing program 3 (id=780): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r6, @ANYBLOB="fe000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="500000001000110f00"/20, @ANYRES32=0x0, @ANYBLOB="040100000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB=' \x00\x00\x00 \x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r2], 0x3c}}, 0x0) 3.134040035s ago: executing program 3 (id=781): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x48, 0x0, 0x0, 0x21eae}}, 0x20}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0) close(r1) socket$packet(0x11, 0x2, 0x300) ioctl$SIOCSIFHWADDR(r1, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="060000000010"}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001000010000003a194618d96d6d2e8553", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x800) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)={0x2c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x99}]}, 0x2c}}, 0x0) 3.133264445s ago: executing program 0 (id=789): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0x1}, &(0x7f0000000000), 0x0}, 0x20) openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x10000}, 0x28) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, 0x0, 0x0}, 0x94) timer_create(0x0, 0x0, &(0x7f0000000300)) timer_create(0x2, &(0x7f0000000380)={0x0, 0xd, 0x1}, &(0x7f00000003c0)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='timers\x00') preadv(r1, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/104, 0x68}], 0x1, 0x44, 0x0) io_uring_enter(0xffffffffffffffff, 0x8ae, 0xfbb9, 0x1f, 0x0, 0x0) 3.132807355s ago: executing program 1 (id=782): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0xffffffff, 0x26361, 0x7, 0xfffffffd, 0xa}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8001}, 0x20000804) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {}, {0xd, 0xb}, {0xffe0, 0xd}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x9, 0xb, 0x4}}}}]}, 0x40}}, 0x4010004) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="640000004ec6"}) 3.132365185s ago: executing program 2 (id=783): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, 0x0, 0x0}, 0x94) open_tree(0xffffffffffffff9c, 0x0, 0x89901) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000040), 0x1b}) io_uring_enter(0xffffffffffffffff, 0x47f6, 0x0, 0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000000300)=""/102392, 0x18ff8) unlinkat(0xffffffffffffff9c, 0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x6000, 0x77b) mount(&(0x7f00000000c0)=@filename='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0)='cramfs\x00', 0x0, 0x0) 2.973661991s ago: executing program 0 (id=784): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) rseq(&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) alarm(0x81) alarm(0x8) 2.969419201s ago: executing program 2 (id=785): sched_setscheduler(0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x20, 0x10, 0x4, 0xfffff00c}, {0x30, 0x0, 0xfd, 0x5ae9}, {0x6, 0x0, 0x7, 0x2}]}, 0x10) sendmmsg$inet(r3, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) 2.877263114s ago: executing program 1 (id=786): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x20) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_KVMCLOCK_CTRL(0xffffffffffffffff, 0xaead) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_opts(r2, 0x0, 0x9, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0x3e9f5000) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x2e8}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00009ef000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) 2.757777368s ago: executing program 3 (id=787): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xd, 0xa, 0x4, 0x1, 0x0, r0}, 0x50) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r1}, 0x0, &(0x7f0000000880)}, 0x20) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@remote, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x18, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@empty, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 2.665354182s ago: executing program 1 (id=788): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x44}}, 0x0) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x400, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="cc000000", @ANYRES16=r4, @ANYBLOB="0100000000000000000017000000500006804c00040067636d286165732900000000000000000000000000000000000000000000000024"], 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x6c, r6, 0x1, 0x0, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @loopback}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, 0xffffffffffffffff) 970.529415ms ago: executing program 2 (id=790): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x29, 0xf3, 0x7, 0x9, 0x1, @local, @private0={0xfc, 0x0, '\x00', 0x1}, 0x40, 0x8000, 0x80000000, 0x401}}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001940)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0xfffffffd, 0x25dfdbfc, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe56, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{}, {}]}, [{}, {}, {}, {}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {0x0, 0x20000000, 0x0, 0xffffffff, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0xfffffffc, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {0x0, 0x9}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x10}, {0x80000000}, {0x8eb9, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x4, 0x0, 0x4, 0x0, 0x7ee}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x9}, {}, {}, {}, {}, {0x3}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {0x0, 0x9, 0xfffffffc, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x4, 0x2}, {}, {}, {}, {}, {}, {0x10000}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x7}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {0x2}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) 445.007514ms ago: executing program 0 (id=791): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) r2 = syz_io_uring_setup(0x110, &(0x7f00000003c0)={0x0, 0xfad6, 0x800, 0x1, 0x3}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r2, 0x133d, 0x3e000000, 0x8, 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000004500)={0x2020}, 0x2020) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x103041, 0x0) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) 162.645515ms ago: executing program 0 (id=792): socket$packet(0x11, 0x3, 0x300) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x700, 0x0, 0x0}, 0x0) close(0x3) r0 = socket(0x2, 0x80805, 0x0) shutdown(0xffffffffffffffff, 0x0) close(0x3) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2401}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) sendto$inet(r1, &(0x7f0000000180)="8995", 0x2, 0x4c041, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000500)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x14, 0x0, 0x1, 0x102, 0x0, 0x0, {0x3, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x20004040}, 0x4000801) 162.485384ms ago: executing program 1 (id=793): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x1b, {0x0, "f40f08"}}, @nested_vmlaunch={0x12f, 0x18}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @control_area=0xc, 0x0, 0x1000000}}, @nested_vmresume={0x130, 0x18}], 0xb3}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xe2e20001) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_kvm_exit$x86(r5, 0x5) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xe2e20002) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xffffffffffffffff) 162.342985ms ago: executing program 2 (id=794): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x1b, {0x0, "f40f08"}}, @nested_vmlaunch={0x12f, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control32=0x4002, 0x0, 0x80}}, @nested_vmresume={0x130, 0x18}], 0xb3}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xe2e20001) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_kvm_exit$x86(r5, 0x5) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xe2e20002) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xffffffffffffffff) 162.140685ms ago: executing program 3 (id=795): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r3, r2, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) sendmsg$inet(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0xfffe}], 0x1}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000007, 0x204031, 0xffffffffffffffff, 0x94c1c000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) 13.176081ms ago: executing program 3 (id=796): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x3, 0x1}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0xe}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1003d1, 0x3, 0x8, 0x6, 0x6}, 0x65}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0xc804}, 0x2) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="af75355d1696"}) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f0000000280)={&(0x7f0000000740)=@xdp={0x2c, 0x0, r6, 0x42}, 0x80, &(0x7f0000000cc0)=[{&(0x7f00000002c0)="27030200dc0f14000e00113c0ff000000000ff880000000200000003125ce882cbf490d908f1523f000000002d9c", 0x2e}], 0x1}, 0x8bb3a321efc09a) 0s ago: executing program 1 (id=797): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x48, 0x0, 0x0, 0x21eae}}, 0x20}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0) close(r1) socket$packet(0x11, 0x2, 0x300) ioctl$SIOCSIFHWADDR(r1, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="060000000010"}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001000010000003a194618d96d6d2e8553", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x800) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)={0x2c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x99}]}, 0x2c}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.7' (ED25519) to the list of known hosts. [ 68.623744][ T5755] cgroup: Unknown subsys name 'net' [ 68.762472][ T5755] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 70.467860][ T5755] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.775558][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.782259][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.049501][ T5778] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 72.053358][ T5780] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 72.057599][ T5778] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 72.065283][ T5780] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 72.078899][ T5778] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 72.080872][ T5780] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 72.087032][ T5778] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 72.101162][ T5778] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 72.109352][ T5778] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 72.117100][ T5780] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 72.125504][ T5778] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 72.133331][ T5778] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 72.142574][ T5778] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 72.144120][ T5779] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 72.150856][ T5778] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 72.158006][ T5780] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.185946][ T5779] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 72.207140][ T5779] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 72.225694][ T5779] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 72.232842][ T5780] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 72.240934][ T5780] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.259265][ T5781] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 72.267268][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 72.284599][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 72.570139][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 72.722417][ T5767] chnl_net:caif_netlink_parms(): no params data found [ 72.811889][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.820578][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.828797][ T5770] bridge_slave_0: entered allmulticast mode [ 72.836368][ T5770] bridge_slave_0: entered promiscuous mode [ 72.845499][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.853568][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.861152][ T5770] bridge_slave_1: entered allmulticast mode [ 72.868771][ T5770] bridge_slave_1: entered promiscuous mode [ 72.885502][ T5768] chnl_net:caif_netlink_parms(): no params data found [ 72.947694][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.963717][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.005901][ T5769] chnl_net:caif_netlink_parms(): no params data found [ 73.052147][ T5770] team0: Port device team_slave_0 added [ 73.063308][ T5767] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.070866][ T5767] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.078118][ T5767] bridge_slave_0: entered allmulticast mode [ 73.085554][ T5767] bridge_slave_0: entered promiscuous mode [ 73.097026][ T5770] team0: Port device team_slave_1 added [ 73.124635][ T5767] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.131872][ T5767] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.140023][ T5767] bridge_slave_1: entered allmulticast mode [ 73.147262][ T5767] bridge_slave_1: entered promiscuous mode [ 73.216577][ T5768] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.223823][ T5768] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.231362][ T5768] bridge_slave_0: entered allmulticast mode [ 73.239163][ T5768] bridge_slave_0: entered promiscuous mode [ 73.259983][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.267207][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.293757][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.317066][ T5768] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.324227][ T5768] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.332143][ T5768] bridge_slave_1: entered allmulticast mode [ 73.339435][ T5768] bridge_slave_1: entered promiscuous mode [ 73.348635][ T5767] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.361467][ T5767] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.371564][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.378820][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.405630][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.443352][ T5769] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.451657][ T5769] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.459090][ T5769] bridge_slave_0: entered allmulticast mode [ 73.467183][ T5769] bridge_slave_0: entered promiscuous mode [ 73.496413][ T5769] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.503784][ T5769] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.511715][ T5769] bridge_slave_1: entered allmulticast mode [ 73.518784][ T5769] bridge_slave_1: entered promiscuous mode [ 73.549176][ T5768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.586991][ T5767] team0: Port device team_slave_0 added [ 73.595628][ T5768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.621273][ T5770] hsr_slave_0: entered promiscuous mode [ 73.628468][ T5770] hsr_slave_1: entered promiscuous mode [ 73.644462][ T5767] team0: Port device team_slave_1 added [ 73.675263][ T5768] team0: Port device team_slave_0 added [ 73.683452][ T5768] team0: Port device team_slave_1 added [ 73.693629][ T5769] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.724395][ T5769] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.734348][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.741801][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.767946][ T5767] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.810372][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.817490][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.843871][ T5767] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.868145][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.877620][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.905138][ T5768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.931718][ T5769] team0: Port device team_slave_0 added [ 73.940982][ T5769] team0: Port device team_slave_1 added [ 73.957234][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.964218][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.993324][ T5768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.050426][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.060367][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 74.089446][ T5769] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.117253][ T5767] hsr_slave_0: entered promiscuous mode [ 74.124224][ T5767] hsr_slave_1: entered promiscuous mode [ 74.133523][ T5767] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 74.141587][ T5767] Cannot create hsr debugfs directory [ 74.156699][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.163771][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 74.165661][ T5773] Bluetooth: hci3: command tx timeout [ 74.194430][ T5769] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.266943][ T5768] hsr_slave_0: entered promiscuous mode [ 74.273464][ T5768] hsr_slave_1: entered promiscuous mode [ 74.280397][ T5768] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 74.288242][ T5768] Cannot create hsr debugfs directory [ 74.324761][ T5773] Bluetooth: hci2: command tx timeout [ 74.330811][ T51] Bluetooth: hci1: command tx timeout [ 74.330838][ T5781] Bluetooth: hci0: command tx timeout [ 74.354831][ T5769] hsr_slave_0: entered promiscuous mode [ 74.361441][ T5769] hsr_slave_1: entered promiscuous mode [ 74.368727][ T5769] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 74.376397][ T5769] Cannot create hsr debugfs directory [ 74.701799][ T5770] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 74.730379][ T5770] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 74.741084][ T5770] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 74.752085][ T5770] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 74.827520][ T5767] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 74.852665][ T5767] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 74.865069][ T5767] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 74.878004][ T5767] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 74.938106][ T5768] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 74.968999][ T5768] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 74.979405][ T5768] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 74.991298][ T5768] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 75.117719][ T5769] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 75.129636][ T5769] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 75.140621][ T5769] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 75.152922][ T5769] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 75.233251][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.258589][ T5767] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.311501][ T5767] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.341320][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.348870][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.367211][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.383029][ T5768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.412322][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.419467][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.434225][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.441422][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.469576][ T5768] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.483973][ T2975] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.491241][ T2975] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.522604][ T2975] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.529756][ T2975] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.539387][ T2975] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.546666][ T2975] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.606347][ T5769] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.641886][ T5769] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.697760][ T2934] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.704998][ T2934] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.756462][ T1076] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.763913][ T1076] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.180246][ T5767] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.245762][ T51] Bluetooth: hci3: command tx timeout [ 76.261315][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.386161][ T5767] veth0_vlan: entered promiscuous mode [ 76.403287][ T5768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.405123][ T51] Bluetooth: hci1: command tx timeout [ 76.414595][ T5773] Bluetooth: hci2: command tx timeout [ 76.417481][ T51] Bluetooth: hci0: command tx timeout [ 76.439690][ T5770] veth0_vlan: entered promiscuous mode [ 76.457194][ T5769] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.471531][ T5770] veth1_vlan: entered promiscuous mode [ 76.490946][ T5767] veth1_vlan: entered promiscuous mode [ 76.580878][ T5769] veth0_vlan: entered promiscuous mode [ 76.592454][ T5770] veth0_macvtap: entered promiscuous mode [ 76.606647][ T5770] veth1_macvtap: entered promiscuous mode [ 76.613487][ T5768] veth0_vlan: entered promiscuous mode [ 76.646535][ T5768] veth1_vlan: entered promiscuous mode [ 76.660236][ T5767] veth0_macvtap: entered promiscuous mode [ 76.672213][ T5767] veth1_macvtap: entered promiscuous mode [ 76.681391][ T5769] veth1_vlan: entered promiscuous mode [ 76.734897][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.742856][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.755640][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.767345][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.779603][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.816046][ T5770] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.826976][ T5770] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.835968][ T5770] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.845774][ T5770] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.861092][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.875266][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.888320][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.898643][ T5768] veth0_macvtap: entered promiscuous mode [ 76.927921][ T5768] veth1_macvtap: entered promiscuous mode [ 76.937331][ T5769] veth0_macvtap: entered promiscuous mode [ 76.957202][ T5767] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.969437][ T5767] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.978735][ T5767] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.987609][ T5767] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.033922][ T5769] veth1_macvtap: entered promiscuous mode [ 77.044046][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.055123][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.066482][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.077499][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.089608][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.148984][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.159859][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.170722][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.184435][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.197898][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.208934][ T5768] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.218340][ T5768] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.227538][ T5768] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.236560][ T5768] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.262055][ T2934] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.273692][ T2934] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.303929][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.316064][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.326113][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.336663][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.346872][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.357578][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.369932][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.400493][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.411203][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.421266][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.432198][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.442773][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.453962][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.466394][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.500301][ T5769] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.509365][ T5769] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.518380][ T5769] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.528449][ T5769] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.540103][ T2998] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.549468][ T2998] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.650442][ T2998] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.670346][ T2998] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.694119][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.711950][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.794398][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.846743][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.872694][ T5830] x_tables: duplicate entry at hook 3 [ 77.937854][ T5830] netlink: 'syz.3.4': attribute type 16 has an invalid length. [ 77.950223][ T5830] netlink: 'syz.3.4': attribute type 17 has an invalid length. [ 78.023333][ T5830] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 78.053482][ T1076] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.065351][ T1076] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.080849][ T2998] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.135277][ T2998] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.261370][ T2934] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.304098][ T2934] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.329874][ T51] Bluetooth: hci3: command tx timeout [ 78.485737][ T51] Bluetooth: hci0: command tx timeout [ 78.488271][ T5781] Bluetooth: hci2: command tx timeout [ 78.492061][ T51] Bluetooth: hci1: command tx timeout [ 79.525271][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 80.405023][ T51] Bluetooth: hci3: command tx timeout [ 80.567035][ T51] Bluetooth: hci1: command tx timeout [ 80.567057][ T5781] Bluetooth: hci2: command tx timeout [ 80.567098][ T5781] Bluetooth: hci0: command tx timeout [ 81.223632][ T5856] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 82.628743][ T5867] netlink: 'syz.1.11': attribute type 2 has an invalid length. [ 83.088811][ T5869] netlink: 'syz.1.11': attribute type 2 has an invalid length. [ 83.877486][ T5869] syz.1.11 uses obsolete (PF_INET,SOCK_PACKET) [ 85.706238][ T5884] netlink: 'syz.0.15': attribute type 1 has an invalid length. [ 85.734748][ T5884] syz.0.15[5884]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 86.358617][ T5884] loop0: detected capacity change from 0 to 512 [ 86.585249][ T5884] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 86.612717][ T5897] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19'. [ 86.615391][ T5899] loop2: detected capacity change from 0 to 256 [ 86.647427][ T5899] exFAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 86.658845][ T5899] exFAT-fs (loop2): Medium has reported failures. Some data may be lost. [ 86.660080][ T5884] EXT4-fs (loop0): 1 truncate cleaned up [ 86.699726][ T5899] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 86.700734][ T5884] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 87.028400][ T5901] process 'syz.2.20' launched './file0' with NULL argv: empty string added [ 87.053072][ T5884] ext4: Unknown parameter 'YڄyFmZ1(O[ [ 87.053072][ T5884] ^+E]0rQ#{̎cp6;:PrflIG>?υ-H"&F)!I|.z' [ 87.128954][ T786] cfg80211: failed to load regulatory.db [ 87.239615][ T5899] exFAT-fs (loop2): error, invalid access to FAT (entry 0xffffffff) [ 87.268629][ T5899] exFAT-fs (loop2): Filesystem has been set read-only [ 87.314030][ T5899] exFAT-fs (loop2): error, invalid access to FAT (entry 0xffffffff) [ 87.499761][ T5899] syz.2.20 (5899) used greatest stack depth: 20264 bytes left [ 87.504967][ T786] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 87.570038][ T5906] kvm: pic: non byte read [ 87.586801][ T5906] kvm: pic: non byte read [ 87.732578][ T786] usb 1-1: unable to get BOS descriptor or descriptor too short [ 87.767368][ T786] usb 1-1: not running at top speed; connect to a high speed hub [ 87.789248][ T786] usb 1-1: config 1 has an invalid descriptor of length 3, skipping remainder of the config [ 87.829307][ T786] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 87.867627][ T786] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 87.879646][ T786] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.013026][ T786] usb 1-1: Product: syz [ 88.018064][ T786] usb 1-1: Manufacturer: syz [ 88.022715][ T786] usb 1-1: SerialNumber: syz [ 88.952879][ T5896] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 227 vs 220 free clusters [ 89.006020][ T786] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 89.030494][ T786] usb 1-1: unit 5 not found! [ 89.056995][ T5896] EXT4-fs (loop0): Remounting filesystem read-only [ 89.086115][ T5769] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.106969][ T786] usb 1-1: USB disconnect, device number 2 [ 90.731678][ T5922] bond_slave_1: entered promiscuous mode [ 91.031907][ T5922] bond_slave_1: left promiscuous mode [ 92.259579][ T5937] loop1: detected capacity change from 0 to 2048 [ 92.445991][ T5945] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 92.621350][ T5937] debugfs: Directory 'netdev:nicvf0' with parent 'phy5' already present! [ 92.674713][ T5826] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 92.893681][ T5947] netlink: 'syz.1.32': attribute type 1 has an invalid length. [ 92.927329][ T5826] usb 4-1: unable to get BOS descriptor or descriptor too short [ 92.962895][ T5826] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 92.973371][ T5826] usb 4-1: can't read configurations, error -71 [ 93.235164][ T5950] ======================================================= [ 93.235164][ T5950] WARNING: The mand mount option has been deprecated and [ 93.235164][ T5950] and is ignored by this kernel. Remove the mand [ 93.235164][ T5950] option from the mount to silence this warning. [ 93.235164][ T5950] ======================================================= [ 94.035722][ T5781] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 94.046008][ T5781] CPU: 1 PID: 5781 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 94.053611][ T5781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 94.063729][ T5781] Workqueue: hci1 hci_rx_work [ 94.068482][ T5781] Call Trace: [ 94.071802][ T5781] [ 94.074961][ T5781] dump_stack_lvl+0x18c/0x250 [ 94.079708][ T5781] ? show_regs_print_info+0x20/0x20 [ 94.084955][ T5781] ? load_image+0x400/0x400 [ 94.089492][ T5781] sysfs_create_dir_ns+0x26e/0x2a0 [ 94.094650][ T5781] ? sysfs_warn_dup+0xa0/0xa0 [ 94.099358][ T5781] ? do_raw_spin_unlock+0x121/0x230 [ 94.104675][ T5781] kobject_add_internal+0x61c/0xcc0 [ 94.110078][ T5781] kobject_add+0x164/0x240 [ 94.114527][ T5781] ? __rwlock_init+0x150/0x150 [ 94.119316][ T5781] ? kobject_init+0x1e0/0x1e0 [ 94.124165][ T5781] ? _raw_spin_unlock+0x28/0x40 [ 94.129119][ T5781] ? get_device_parent+0x366/0x390 [ 94.134242][ T5781] device_add+0x408/0xc20 [ 94.138614][ T5781] hci_conn_add_sysfs+0xd5/0x1e0 [ 94.143553][ T5781] le_conn_complete_evt+0xf5d/0x1540 [ 94.148920][ T5781] ? hci_event_packet+0x4cb/0x1270 [ 94.154122][ T5781] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 94.160360][ T5781] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 94.166012][ T5781] ? skb_pull_data+0xfb/0x200 [ 94.170731][ T5781] hci_le_conn_complete_evt+0x187/0x440 [ 94.176298][ T5781] ? hci_remote_host_features_evt+0x150/0x150 [ 94.182367][ T5781] hci_event_packet+0x7ba/0x1270 [ 94.187399][ T5781] ? bis_list+0x290/0x290 [ 94.191726][ T5781] ? lockdep_hardirqs_on+0x98/0x150 [ 94.197013][ T5781] ? hci_send_to_monitor+0xd7/0x4f0 [ 94.202208][ T5781] hci_rx_work+0x43a/0xd60 [ 94.206668][ T5781] ? process_scheduled_works+0x96f/0x15d0 [ 94.212470][ T5781] process_scheduled_works+0xa5d/0x15d0 [ 94.218049][ T5781] ? worker_attach_to_pool+0x380/0x380 [ 94.223524][ T5781] ? assign_work+0x3d2/0x5d0 [ 94.228137][ T5781] worker_thread+0xa55/0xfc0 [ 94.232842][ T5781] kthread+0x2fa/0x390 [ 94.236920][ T5781] ? pr_cont_work+0x560/0x560 [ 94.241608][ T5781] ? kthread_blkcg+0xd0/0xd0 [ 94.246316][ T5781] ret_from_fork+0x48/0x80 [ 94.250760][ T5781] ? kthread_blkcg+0xd0/0xd0 [ 94.255442][ T5781] ret_from_fork_asm+0x11/0x20 [ 94.260232][ T5781] [ 94.294715][ T5781] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 94.309049][ T5781] Bluetooth: hci1: failed to register connection device [ 94.655494][ T5966] netlink: 12 bytes leftover after parsing attributes in process `syz.3.40'. [ 95.008256][ T5970] syzkaller0: entered promiscuous mode [ 95.014104][ T5970] syzkaller0: entered allmulticast mode [ 95.627056][ T5973] syzkaller0: entered promiscuous mode [ 95.632686][ T5973] syzkaller0: entered allmulticast mode [ 96.351624][ T3065] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 96.698539][ T3065] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 96.947020][ T3065] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 96.958032][ T3065] usb 3-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 96.968409][ T3065] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.990279][ T3065] usb 3-1: config 0 descriptor?? [ 98.669502][ T3065] hid-steam 0003:28DE:1142.0001: unknown main item tag 0x0 [ 98.680241][ T3065] hid-steam 0003:28DE:1142.0001: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.2-1/input0 [ 98.774879][ T3065] hid-steam 0003:28DE:1142.0001: Steam wireless receiver connected [ 98.784388][ T3065] hid-steam 0003:28DE:1142.0001: No HID_FEATURE_REPORT submitted - nothing to read [ 98.918208][ T3065] hid-steam 0003:28DE:1142.0002: unknown main item tag 0x0 [ 98.979506][ T3065] hid-steam 0003:28DE:1142.0002: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.2-1/input0 [ 99.039547][ T6005] syz.1.49 (6005) used greatest stack depth: 20208 bytes left [ 99.048328][ T3065] usb 3-1: USB disconnect, device number 2 [ 99.086441][ T3065] hid-steam 0003:28DE:1142.0001: Steam wireless receiver disconnected [ 100.645362][ T5773] Bluetooth: hci1: command 0x0406 tx timeout [ 100.717087][ T6010] fido_id[6010]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 101.072019][ T6020] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 102.201395][ T6026] netlink: 132 bytes leftover after parsing attributes in process `syz.2.54'. [ 104.130299][ T6036] netlink: 24 bytes leftover after parsing attributes in process `syz.2.58'. [ 104.204898][ T6036] netlink: 4 bytes leftover after parsing attributes in process `syz.2.58'. [ 104.225164][ T6036] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 104.496227][ T6045] bad cache= option: no%e [ 104.496227][ T6045] [ 104.503033][ T6045] CIFS: VFS: bad cache= option: no%e [ 105.267410][ T6036] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 105.552960][ T6048] loop3: detected capacity change from 0 to 4096 [ 105.867673][ T6049] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 107.310794][ T6055] netlink: 'syz.1.62': attribute type 9 has an invalid length. [ 107.391658][ T6057] syzkaller0: entered promiscuous mode [ 107.419032][ T6057] syzkaller0: entered allmulticast mode [ 107.902639][ T6060] netlink: 'syz.3.63': attribute type 10 has an invalid length. [ 107.910484][ T6060] netlink: 40 bytes leftover after parsing attributes in process `syz.3.63'. [ 107.966902][ T6060] team0: Port device geneve0 added [ 110.102755][ T6087] netlink: 12 bytes leftover after parsing attributes in process `syz.3.72'. [ 110.477790][ T6092] loop2: detected capacity change from 0 to 1024 [ 110.521995][ T6092] EXT4-fs: Ignoring removed orlov option [ 110.867026][ T6092] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 112.187312][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 112.278620][ T6110] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 113.116899][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 113.311261][ T6123] loop2: detected capacity change from 0 to 2048 [ 113.333664][ T6123] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.346976][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 113.380275][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.392405][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 113.436005][ T9] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 113.447736][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.461261][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.465022][ T9] usb 1-1: Product: syz [ 113.484739][ T9] usb 1-1: Manufacturer: syz [ 113.510969][ T9] usb 1-1: SerialNumber: syz [ 115.228234][ T9] usb 1-1: 0:2 : does not exist [ 115.267191][ T9] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 115.392464][ T9] usb 1-1: USB disconnect, device number 3 [ 115.494389][ T6143] Illegal XDP return value 4291158016 on prog (id 13) dev syz_tun, expect packet loss! [ 115.547545][ T5760] udevd[5760]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 115.833944][ T6149] UBIFS error (pid: 6149): cannot open "./file0", error -22 [ 116.638531][ T6154] netlink: 'syz.2.90': attribute type 1 has an invalid length. [ 116.829154][ T6154] macvlan2: entered promiscuous mode [ 116.893119][ T6154] macvlan2: entered allmulticast mode [ 119.292013][ T6184] netlink: 24 bytes leftover after parsing attributes in process `syz.1.97'. [ 124.978529][ T6234] loop3: detected capacity change from 0 to 8 [ 125.279546][ T6237] SQUASHFS error: lzo decompression failed, data probably corrupt [ 125.288503][ T6237] SQUASHFS error: Failed to read block 0x0: -5 [ 125.295510][ T6237] SQUASHFS error: Failed to read block 0xff: -5 [ 125.303241][ T6237] SQUASHFS error: lzo decompression failed, data probably corrupt [ 125.311832][ T6237] SQUASHFS error: Failed to read block 0x0: -5 [ 125.328660][ T6237] SQUASHFS error: lzo decompression failed, data probably corrupt [ 125.336807][ T6237] SQUASHFS error: Failed to read block 0x0: -5 [ 125.338694][ T28] audit: type=1800 audit(1774677061.235:2): pid=6237 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.109" name="file2" dev="loop3" ino=3 res=0 errno=0 [ 125.368389][ T6237] SQUASHFS error: Failed to read block 0x6a4: -5 [ 125.375086][ T6237] SQUASHFS error: Unable to read metadata cache entry [6a2] [ 125.382411][ T6237] SQUASHFS error: read_indexes: reading block [6a2:0] [ 125.389363][ T6237] SQUASHFS error: Failed to read block 0x0: -5 [ 125.395803][ T6237] SQUASHFS error: Unable to read metadata cache entry [6a2] [ 125.404037][ T6237] SQUASHFS error: read_indexes: reading block [6a2:0] [ 125.410998][ T6237] SQUASHFS error: Failed to read block 0x0: -5 [ 125.463437][ T28] audit: type=1800 audit(1774677061.255:3): pid=6237 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.109" name="file2" dev="loop3" ino=3 res=0 errno=0 [ 126.101263][ T6247] loop2: detected capacity change from 0 to 128 [ 126.185558][ T6247] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 126.207049][ T6247] ext4 filesystem being mounted at /25/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 127.155399][ T5768] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 129.037905][ T6265] xt_NFQUEUE: number of queues (62232) out of range (got 67565) [ 132.175608][ T6287] openvswitch: netlink: Message has 4 unknown bytes. [ 132.730539][ T6292] binder: transaction release 5 bad handle 3, ret = -22 [ 132.753179][ T6293] syzkaller0: entered promiscuous mode [ 132.758968][ T6293] syzkaller0: entered allmulticast mode [ 133.266706][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.337084][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.705847][ T6304] syz_tun: entered allmulticast mode [ 134.590132][ T5808] IPVS: starting estimator thread 0... [ 134.755793][ T6316] IPVS: using max 15 ests per chain, 36000 per kthread [ 136.394838][ T3065] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 136.595891][ T3065] usb 4-1: Using ep0 maxpacket: 8 [ 136.603817][ T3065] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 136.612953][ T3065] usb 4-1: config 0 has no interface number 0 [ 136.647424][ T3065] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 136.685744][ T3065] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.755433][ T3065] usb 4-1: Product: syz [ 136.759676][ T3065] usb 4-1: Manufacturer: syz [ 136.764405][ T3065] usb 4-1: SerialNumber: syz [ 136.767180][ T28] audit: type=1804 audit(1774677072.675:4): pid=6332 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.139" name="file0" dev="ramfs" ino=9591 res=1 errno=0 [ 136.796443][ T3065] usb 4-1: config 0 descriptor?? [ 136.935845][ T6336] loop1: detected capacity change from 0 to 512 [ 136.950536][ T6336] EXT4-fs: Ignoring removed i_version option [ 137.480315][ T6336] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2853: Unable to expand inode 17. Delete some EAs or run e2fsck. [ 137.494845][ T6336] EXT4-fs (loop1): 1 truncate cleaned up [ 137.501873][ T6336] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 137.608477][ T3065] usb 4-1: Found UVC 0.04 device syz (046d:08c3) [ 137.620495][ T3065] uvcvideo 4-1:0.31: Entity type for entity Output 6 was not initialized! [ 137.876052][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 138.676657][ T6344] syzkaller0: entered promiscuous mode [ 138.710337][ T6344] syzkaller0: entered allmulticast mode [ 139.394259][ T6358] loop1: detected capacity change from 0 to 128 [ 139.506656][ T6358] FAT-fs (loop1): bogus number of FAT sectors [ 139.514274][ T6358] FAT-fs (loop1): Can't find a valid FAT filesystem [ 139.660607][ T6358] netlink: 20 bytes leftover after parsing attributes in process `syz.1.146'. [ 139.874365][ T6358] netlink: 16 bytes leftover after parsing attributes in process `syz.1.146'. [ 140.118822][ T9] usb 4-1: USB disconnect, device number 4 [ 140.361880][ T6364] loop0: detected capacity change from 0 to 512 [ 140.690713][ T6369] libceph: resolve '96.' (ret=-3): failed [ 140.850957][ T6364] Quota error (device loop0): v2_read_file_info: Free block number 1 out of range (1, 6). [ 141.006456][ T6364] EXT4-fs warning (device loop0): ext4_enable_quotas:7184: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 141.049790][ T6364] EXT4-fs (loop0): mount failed [ 142.559856][ T5808] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 142.691421][ T6403] netlink: 'syz.0.159': attribute type 1 has an invalid length. [ 142.764681][ T5808] usb 3-1: Using ep0 maxpacket: 32 [ 142.772999][ T5808] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 142.780653][ T6403] bond1: (slave gretap1): making interface the new active one [ 142.796861][ T5808] usb 3-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 142.816140][ T5808] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.824461][ T5808] usb 3-1: Product: syz [ 142.829922][ T5808] usb 3-1: Manufacturer: syz [ 142.835042][ T5808] usb 3-1: SerialNumber: syz [ 142.843441][ T5808] usb 3-1: config 0 descriptor?? [ 142.851674][ T6383] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 142.863723][ T5808] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 142.872980][ T6403] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 142.923097][ T6405] vlan2: entered allmulticast mode [ 142.928431][ T6405] bond1: entered allmulticast mode [ 142.933743][ T6405] gretap1: entered allmulticast mode [ 142.941799][ T6405] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 144.031873][ T5757] usb 3-1: USB disconnect, device number 3 [ 144.263784][ T6418] netlink: 'syz.0.163': attribute type 1 has an invalid length. [ 144.406717][ T6422] 8021q: adding VLAN 0 to HW filter on device bond3 [ 144.415612][ T6422] bond2: (slave bond3): making interface the new active one [ 144.423695][ T6422] bond2: (slave bond3): Enslaving as an active interface with an up link [ 144.528626][ T6418] bond2: (slave gretap2): Enslaving as a backup interface with an up link [ 149.764678][ T3065] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 150.054651][ T3065] usb 1-1: Using ep0 maxpacket: 8 [ 150.598369][ T3065] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 150.608974][ T3065] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 150.618662][ T3065] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 150.628072][ T3065] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.767707][ T3065] usb 1-1: config 0 descriptor?? [ 151.204753][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 152.738187][ T9] usb 1-1: USB disconnect, device number 4 [ 152.930468][ T6488] loop0: detected capacity change from 0 to 128 [ 154.277877][ T6490] sched: RT throttling activated [ 155.481679][ T5760] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 157.789284][ T6515] loop0: detected capacity change from 0 to 128 [ 157.842247][ T6515] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem [ 158.386859][ T6515] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 158.460058][ T6515] ext2 filesystem being mounted at /40/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 158.694287][ T6525] netlink: 4 bytes leftover after parsing attributes in process `syz.2.192'. [ 158.776946][ T6525] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 158.813921][ T5769] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 158.842825][ T6525] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 158.916259][ T6525] bond0 (unregistering): Released all slaves [ 162.724787][ T3065] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 162.938944][ T3065] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 162.955045][ T3065] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.975659][ T6565] overlayfs: failed to clone upperpath [ 162.983231][ T3065] usb 3-1: Product: syz [ 162.993353][ T3065] usb 3-1: Manufacturer: syz [ 163.003483][ T3065] usb 3-1: SerialNumber: syz [ 163.017086][ T3065] usb 3-1: config 0 descriptor?? [ 163.267854][ T3065] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 164.205945][ T6571] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.215111][ T6571] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.315894][ T6571] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.323376][ T6571] bridge0: port 2(bridge_slave_1) entered forwarding state [ 164.331882][ T6571] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.339146][ T6571] bridge0: port 1(bridge_slave_0) entered forwarding state [ 164.386909][ T6571] team0: Port device bridge0 added [ 164.405414][ T6577] damon-dbgfs: DAMON debugfs interface is deprecated, so users should move to DAMON_SYSFS. If you cannot, please report your usecase to damon@lists.linux.dev and linux-mm@kvack.org. [ 164.433131][ T6573] team0: Failed to send port change of device bridge0 via netlink (err -105) [ 164.490441][ T6573] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.561489][ T6573] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.598743][ T6573] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 164.640234][ T6573] team0: Failed to send port change of device team_slave_1 via netlink (err -105) [ 164.864801][ T3065] dvb_usb_rtl28xxu: probe of 3-1:0.0 failed with error -71 [ 164.892812][ T3065] usb 3-1: USB disconnect, device number 4 [ 165.180804][ T6588] netlink: 'syz.0.212': attribute type 21 has an invalid length. [ 166.564911][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c0!!! [ 166.974541][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 174.654559][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 176.704747][ T5827] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 177.214569][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 177.816813][ T6640] netlink: 12 bytes leftover after parsing attributes in process `syz.0.214'. [ 177.891355][ T5827] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 177.902794][ T5827] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.915841][ T5827] usb 4-1: Product: syz [ 177.920081][ T5827] usb 4-1: Manufacturer: syz [ 177.927166][ T5827] usb 4-1: SerialNumber: syz [ 177.945439][ T5827] usb 4-1: config 0 descriptor?? [ 177.996750][ T6640] netlink: 63 bytes leftover after parsing attributes in process `syz.0.214'. [ 178.186402][ T5827] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 178.454348][ T6651] netlink: zone id is out of range [ 178.459853][ T6651] netlink: zone id is out of range [ 178.466087][ T6651] netlink: zone id is out of range [ 178.471295][ T6651] netlink: zone id is out of range [ 178.477341][ T6651] netlink: zone id is out of range [ 178.483334][ T6651] netlink: zone id is out of range [ 178.496714][ T6651] netlink: zone id is out of range [ 178.502019][ T6651] netlink: zone id is out of range [ 178.541612][ T6651] netlink: zone id is out of range [ 178.669228][ T6651] netlink: zone id is out of range [ 179.403875][ T6659] loop2: detected capacity change from 0 to 512 [ 179.487449][ T6659] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.230: invalid indirect mapped block 10 (level 1) [ 179.522104][ T6659] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.230: invalid indirect mapped block 8 (level 1) [ 179.562158][ T6659] EXT4-fs (loop2): 1 truncate cleaned up [ 179.616304][ T6659] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 179.726612][ T6659] EXT4-fs error (device loop2): ext4_lookup:1858: inode #12: comm syz.2.230: inode has both inline data and extents flags [ 179.761574][ T5827] dvb_usb_rtl28xxu: probe of 4-1:0.0 failed with error -71 [ 179.804830][ T5827] usb 4-1: USB disconnect, device number 5 [ 181.032184][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 181.152049][ T6676] netlink: 'syz.1.234': attribute type 21 has an invalid length. [ 182.599045][ T6697] loop0: detected capacity change from 0 to 764 [ 185.063549][ T6719] netlink: 'syz.1.246': attribute type 5 has an invalid length. [ 185.244758][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 185.436796][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 185.461524][ T9] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 185.482283][ T9] usb 3-1: New USB device found, idVendor=0c45, idProduct=8001, bcdDevice=90.0a [ 185.501663][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.524392][ T9] usb 3-1: config 0 descriptor?? [ 185.755604][ T9] usb 3-1: USB disconnect, device number 5 [ 190.704785][ T5771] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 190.903269][ T5771] usb 1-1: Using ep0 maxpacket: 32 [ 190.910398][ T5771] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 190.921340][ T5771] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 191.004535][ T5771] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 191.057208][ T5771] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 191.072486][ T5771] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 191.087467][ T5771] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 191.134703][ T5771] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 191.184578][ T5771] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.212482][ T5771] usb 1-1: config 0 descriptor?? [ 191.424951][ T5808] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 191.479310][ T5771] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 191.648763][ T5808] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 191.660715][ T5808] usb 3-1: config 0 has no interfaces? [ 191.693673][ T5808] usb 3-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=26.50 [ 191.704647][ T5808] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.712666][ T5808] usb 3-1: Product: syz [ 191.720578][ T5808] usb 3-1: Manufacturer: syz [ 191.725556][ T5808] usb 3-1: SerialNumber: syz [ 191.745066][ T5808] usb 3-1: config 0 descriptor?? [ 192.052450][ T6766] loop2: detected capacity change from 0 to 512 [ 192.150529][ T6766] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 192.346331][ T6766] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 192.432052][ T6766] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c119, mo2=0002] [ 192.456962][ T9] usb 1-1: USB disconnect, device number 5 [ 192.514818][ T6766] System zones: 1-12 [ 192.545679][ T9] usblp0: removed [ 192.552942][ T6766] EXT4-fs (loop2): 1 truncate cleaned up [ 192.564936][ T6776] netlink: 24 bytes leftover after parsing attributes in process `syz.1.262'. [ 192.598700][ T6766] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 192.719968][ T6784] netlink: 28 bytes leftover after parsing attributes in process `syz.1.262'. [ 192.839734][ T6784] veth3: entered promiscuous mode [ 192.869647][ T6784] veth3: entered allmulticast mode [ 192.892142][ T9] usb 3-1: USB disconnect, device number 6 [ 193.890488][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 194.770891][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.777717][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.654672][ T5808] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 196.275955][ T5808] usb 3-1: Using ep0 maxpacket: 32 [ 196.309055][ T5808] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 196.324539][ T5808] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 196.342088][ T5808] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 196.353413][ T5808] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 196.507825][ T5808] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 196.518052][ T5808] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 196.531171][ T5808] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 196.540318][ T5808] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.582702][ T5808] usb 3-1: config 0 descriptor?? [ 196.899342][ T5779] Bluetooth: hci2: command 0x0406 tx timeout [ 196.905666][ T5779] Bluetooth: hci1: command 0x0406 tx timeout [ 196.911983][ T5779] Bluetooth: hci3: command 0x0406 tx timeout [ 196.919343][ T5083] Bluetooth: hci0: command 0x0406 tx timeout [ 197.462710][ T5808] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 7 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 198.341700][ T3065] usb 3-1: USB disconnect, device number 7 [ 199.213082][ T3065] usblp0: removed [ 199.437868][ T6858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 199.599021][ T6868] syz_tun: entered allmulticast mode [ 199.649845][ T6868] veth1_to_team: entered allmulticast mode [ 199.668684][ T6867] syz_tun: left allmulticast mode [ 199.883725][ T6874] syzkaller0: entered promiscuous mode [ 199.890278][ T6874] syzkaller0: entered allmulticast mode [ 200.927469][ T6887] netlink: 'syz.0.297': attribute type 1 has an invalid length. [ 201.509519][ T6893] loop3: detected capacity change from 0 to 1024 [ 201.845597][ T6891] hfsplus: found bad thread record in catalog [ 201.889970][ T6887] bond5: entered promiscuous mode [ 201.935165][ T6887] 8021q: adding VLAN 0 to HW filter on device bond5 [ 201.977056][ T6897] bond5: (slave bridge1): making interface the new active one [ 202.013759][ T6897] bridge1: entered promiscuous mode [ 202.020394][ T6897] bond5: (slave bridge1): Enslaving as an active interface with an up link [ 202.057931][ T2934] hfsplus: b-tree write err: -5, ino 25 [ 202.085745][ T2934] hfsplus: b-tree write err: -5, ino 4 [ 202.095125][ T2934] hfsplus: b-tree write err: -5, ino 2 [ 203.684619][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 203.874623][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 203.894750][ T9] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 203.904551][ T9] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 203.913283][ T9] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 203.924287][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 203.935892][ T9] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 203.989250][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 204.136098][ T9] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 204.298593][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.343937][ T9] usb 4-1: config 0 descriptor?? [ 204.622270][ T6918] syz_tun: entered allmulticast mode [ 204.628015][ T9] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 6 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 204.807655][ T6917] syz_tun: left allmulticast mode [ 204.861014][ T6920] netlink: 'syz.2.303': attribute type 1 has an invalid length. [ 206.126753][ T6920] bond0: entered promiscuous mode [ 206.132011][ T6920] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.389431][ T6926] bond0: (slave bridge1): making interface the new active one [ 207.133205][ T6926] bridge1: entered promiscuous mode [ 207.150441][ T6926] bond0: (slave bridge1): Enslaving as an active interface with an up link [ 208.025895][ T5826] usb 4-1: USB disconnect, device number 6 [ 208.048953][ T5826] usblp0: removed [ 208.081632][ T6937] bridge0: port 3(erspan0) entered blocking state [ 208.122994][ T6937] bridge0: port 3(erspan0) entered disabled state [ 208.320834][ T6937] erspan0: entered allmulticast mode [ 209.035336][ T6937] erspan0: entered promiscuous mode [ 209.680382][ T28] audit: type=1326 audit(1774677145.565:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 209.784054][ T28] audit: type=1326 audit(1774677145.565:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 209.806160][ C0] vkms_vblank_simulate: vblank timer overrun [ 209.845982][ T28] audit: type=1326 audit(1774677145.575:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 209.876683][ T28] audit: type=1326 audit(1774677145.575:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 209.900439][ T28] audit: type=1326 audit(1774677145.575:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 209.922521][ C0] vkms_vblank_simulate: vblank timer overrun [ 209.964120][ T28] audit: type=1326 audit(1774677145.575:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 209.987523][ T28] audit: type=1326 audit(1774677145.575:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 210.020966][ T28] audit: type=1326 audit(1774677145.575:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 210.127747][ T28] audit: type=1326 audit(1774677145.575:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 210.198427][ T28] audit: type=1326 audit(1774677145.575:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6954 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fcefd19c799 code=0x7ffc0000 [ 214.405183][ T6998] netlink: 'syz.0.326': attribute type 11 has an invalid length. [ 219.007709][ T7012] loop2: detected capacity change from 0 to 131072 [ 219.146169][ T7012] F2FS-fs (loop2): Test dummy encryption mode enabled [ 219.158919][ T7012] F2FS-fs (loop2): invalid crc value [ 219.180535][ T7012] F2FS-fs (loop2): Found nat_bits in checkpoint [ 219.246774][ T7012] F2FS-fs (loop2): access invalid blkaddr:0 [ 219.252756][ T7012] CPU: 0 PID: 7012 Comm: syz.2.330 Not tainted syzkaller #0 [ 219.260072][ T7012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 219.270388][ T7012] Call Trace: [ 219.273666][ T7012] [ 219.276598][ T7012] dump_stack_lvl+0x18c/0x250 [ 219.281285][ T7012] ? show_regs_print_info+0x20/0x20 [ 219.286491][ T7012] ? __up_read+0x2b6/0x6b0 [ 219.290995][ T7012] f2fs_is_valid_blkaddr+0xef8/0x1580 [ 219.296445][ T7012] sanity_check_extent_cache+0xfc/0x1f0 [ 219.302038][ T7012] f2fs_iget+0x33c5/0x47e0 [ 219.306477][ T7012] f2fs_fill_super+0x48b3/0x6be0 [ 219.311433][ T7012] ? kill_f2fs_super+0x3d0/0x3d0 [ 219.316370][ T7012] ? down_write+0x16e/0x200 [ 219.320871][ T7012] ? down_read_killable+0x340/0x340 [ 219.326255][ T7012] ? setup_bdev_super+0x56b/0x660 [ 219.331288][ T7012] mount_bdev+0x221/0x2d0 [ 219.335633][ T7012] ? kill_f2fs_super+0x3d0/0x3d0 [ 219.340602][ T7012] ? get_tree_bdev+0x520/0x520 [ 219.345386][ T7012] ? vfs_parse_fs_param+0x420/0x420 [ 219.350633][ T7012] legacy_get_tree+0xea/0x180 [ 219.355317][ T7012] ? trace_raw_output_f2fs__rw_end+0x110/0x110 [ 219.361479][ T7012] vfs_get_tree+0x8c/0x280 [ 219.365989][ T7012] do_new_mount+0x24b/0xa40 [ 219.370492][ T7012] __se_sys_mount+0x2e7/0x3d0 [ 219.375208][ T7012] ? __x64_sys_mount+0xc0/0xc0 [ 219.380157][ T7012] ? lockdep_hardirqs_on+0x98/0x150 [ 219.385376][ T7012] ? __x64_sys_mount+0x20/0xc0 [ 219.390153][ T7012] do_syscall_64+0x55/0xa0 [ 219.394591][ T7012] ? clear_bhb_loop+0x40/0x90 [ 219.399306][ T7012] ? clear_bhb_loop+0x40/0x90 [ 219.404001][ T7012] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 219.409989][ T7012] RIP: 0033:0x7fcefd19da0a [ 219.414405][ T7012] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 219.434134][ T7012] RSP: 002b:00007fcefe133e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 219.442570][ T7012] RAX: ffffffffffffffda RBX: 00007fcefe133ee0 RCX: 00007fcefd19da0a [ 219.450589][ T7012] RDX: 0000200000000100 RSI: 0000200000000180 RDI: 00007fcefe133ea0 [ 219.458649][ T7012] RBP: 0000200000000100 R08: 00007fcefe133ee0 R09: 0000000000000010 [ 219.466632][ T7012] R10: 0000000000000010 R11: 0000000000000246 R12: 0000200000000180 [ 219.474622][ T7012] R13: 00007fcefe133ea0 R14: 00000000000105e8 R15: 0000200000000280 [ 219.482621][ T7012] [ 219.486836][ T7012] F2FS-fs (loop2): sanity_check_extent_cache: inode (ino=3) extent info [0, 0, 4128768] is incorrect, run fsck to fix [ 219.509479][ T7012] F2FS-fs (loop2): Failed to read root inode [ 221.441927][ T7034] netlink: 'syz.1.334': attribute type 10 has an invalid length. [ 221.468672][ T7034] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 221.523080][ T7027] fuse: Unknown parameter 'grou00000000000000000000' [ 221.943032][ T7043] loop2: detected capacity change from 0 to 512 [ 222.244364][ T7043] EXT4-fs error (device loop2): ext4_iget_extra_inode:4732: inode #15: comm syz.2.337: corrupted in-inode xattr: invalid ea_ino [ 222.471465][ T7043] EXT4-fs error (device loop2): ext4_orphan_get:1403: comm syz.2.337: couldn't read orphan inode 15 (err -117) [ 222.727568][ T7043] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 223.150906][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.755794][ T7066] loop2: detected capacity change from 0 to 256 [ 224.929324][ T7066] exFAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 225.196772][ T7066] exFAT-fs (loop2): Medium has reported failures. Some data may be lost. [ 225.444731][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 225.477336][ T7066] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 228.923746][ T7097] loop0: detected capacity change from 0 to 128 [ 228.969104][ T7097] FAT-fs (loop0): Unrecognized mount option "00000000000000000000" or missing value [ 231.886902][ T7117] netlink: 24 bytes leftover after parsing attributes in process `syz.1.363'. [ 232.459804][ T7126] loop0: detected capacity change from 0 to 128 [ 232.491832][ T7126] FAT-fs (loop0): Unrecognized mount option "18446744073709551615" or missing value [ 233.877606][ T7138] netlink: 'syz.1.361': attribute type 4 has an invalid length. [ 234.009174][ T7140] netlink: 24 bytes leftover after parsing attributes in process `syz.2.362'. [ 235.338636][ T7156] netlink: 12 bytes leftover after parsing attributes in process `syz.3.366'. [ 237.693097][ T5781] Bluetooth: Wrong link type (-57) [ 237.733250][ T7184] netlink: 24 bytes leftover after parsing attributes in process `syz.1.374'. [ 238.796345][ T7190] loop0: detected capacity change from 0 to 2048 [ 238.819017][ T7190] UDF-fs: error (device loop0): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 238.830428][ T7190] UDF-fs: error (device loop0): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 238.844893][ T7190] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 160: 0x0b != 0xd4 [ 238.872698][ T7190] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 239.716794][ T7200] netlink: 'syz.2.382': attribute type 10 has an invalid length. [ 240.113036][ T7207] syz.2.384: vmalloc error: size 18446744073709551614, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 240.145917][ T7207] CPU: 1 PID: 7207 Comm: syz.2.384 Not tainted syzkaller #0 [ 240.153294][ T7207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 240.163403][ T7207] Call Trace: [ 240.166710][ T7207] [ 240.169653][ T7207] dump_stack_lvl+0x18c/0x250 [ 240.174367][ T7207] ? show_regs_print_info+0x20/0x20 [ 240.179673][ T7207] ? load_image+0x400/0x400 [ 240.184198][ T7207] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 240.190724][ T7207] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 240.197244][ T7207] warn_alloc+0x246/0x340 [ 240.201624][ T7207] ? zone_watermark_ok_safe+0x230/0x230 [ 240.207259][ T7207] ? __mutex_trylock_common+0x159/0x260 [ 240.212819][ T7207] __vmalloc_node_range+0x126/0x1330 [ 240.218123][ T7207] ? tomoyo_path_number_perm+0x217/0x620 [ 240.223777][ T7207] ? rcu_is_watching+0x15/0xb0 [ 240.228558][ T7207] ? trace_contention_end+0x39/0xe0 [ 240.233861][ T7207] ? __mutex_lock+0x315/0xcc0 [ 240.238649][ T7207] ? tomoyo_path_number_perm+0x5b4/0x620 [ 240.244312][ T7207] ? dvb_dvr_do_ioctl+0x79/0x220 [ 240.249287][ T7207] ? tomoyo_path_number_perm+0x217/0x620 [ 240.255134][ T7207] ? free_vm_area+0x50/0x50 [ 240.259663][ T7207] ? dvb_dvr_do_ioctl+0x12e/0x220 [ 240.264701][ T7207] vmalloc+0x79/0x90 [ 240.268615][ T7207] ? dvb_dvr_do_ioctl+0x12e/0x220 [ 240.273739][ T7207] dvb_dvr_do_ioctl+0x12e/0x220 [ 240.278608][ T7207] dvb_usercopy+0x195/0x2b0 [ 240.283124][ T7207] ? dvb_dvr_release+0x3e0/0x3e0 [ 240.288079][ T7207] ? dvb_generic_ioctl+0xb0/0xb0 [ 240.293069][ T7207] ? dvb_dvr_poll+0x230/0x230 [ 240.297777][ T7207] dvb_dvr_ioctl+0x29/0x30 [ 240.302232][ T7207] __se_sys_ioctl+0xfd/0x170 [ 240.306862][ T7207] do_syscall_64+0x55/0xa0 [ 240.311315][ T7207] ? clear_bhb_loop+0x40/0x90 [ 240.316021][ T7207] ? clear_bhb_loop+0x40/0x90 [ 240.320721][ T7207] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 240.326630][ T7207] RIP: 0033:0x7fcefd19c799 [ 240.331150][ T7207] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.351053][ T7207] RSP: 002b:00007fcefe113028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 240.359484][ T7207] RAX: ffffffffffffffda RBX: 00007fcefd416090 RCX: 00007fcefd19c799 [ 240.367495][ T7207] RDX: fffffffffffffffe RSI: 0000000000006f2d RDI: 0000000000000004 [ 240.375514][ T7207] RBP: 00007fcefd232c99 R08: 0000000000000000 R09: 0000000000000000 [ 240.383508][ T7207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 240.391669][ T7207] R13: 00007fcefd416128 R14: 00007fcefd416090 R15: 00007ffeab97d548 [ 240.399671][ T7207] [ 240.417103][ T7207] Mem-Info: [ 240.420441][ T7207] active_anon:5883 inactive_anon:0 isolated_anon:0 [ 240.420441][ T7207] active_file:15761 inactive_file:40345 isolated_file:0 [ 240.420441][ T7207] unevictable:768 dirty:177 writeback:0 [ 240.420441][ T7207] slab_reclaimable:10242 slab_unreclaimable:92182 [ 240.420441][ T7207] mapped:24462 shmem:1364 pagetables:611 [ 240.420441][ T7207] sec_pagetables:0 bounce:0 [ 240.420441][ T7207] kernel_misc_reclaimable:0 [ 240.420441][ T7207] free:1346622 free_pcp:7317 free_cma:0 [ 240.465735][ C0] vkms_vblank_simulate: vblank timer overrun [ 240.465868][ T7210] binder: BINDER_SET_CONTEXT_MGR already set [ 240.465966][ T7210] binder: 7209:7210 ioctl 4018620d 2000000000c0 returned -16 [ 240.470340][ T7210] binder: BINDER_SET_CONTEXT_MGR already set [ 240.504836][ T7207] Node 0 active_anon:23532kB inactive_anon:0kB active_file:63044kB inactive_file:161180kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:97848kB dirty:708kB writeback:0kB shmem:3920kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10956kB pagetables:2444kB sec_pagetables:0kB all_unreclaimable? no [ 240.574398][ T7210] binder: 7209:7210 ioctl 4018620d 200000000040 returned -16 [ 240.594774][ T7207] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 240.645169][ T7207] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 240.672665][ C0] vkms_vblank_simulate: vblank timer overrun [ 240.774718][ T7207] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 240.780601][ T7207] Node 0 DMA32 free:1474988kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:25296kB inactive_anon:0kB active_file:63044kB inactive_file:160356kB unevictable:1536kB writepending:708kB present:3129332kB managed:2586956kB mlocked:0kB bounce:0kB free_pcp:11972kB local_pcp:928kB free_cma:0kB [ 240.912156][ T7207] lowmem_reserve[]: 0 0 0 0 0 [ 240.924585][ T7207] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 240.962372][ T7207] lowmem_reserve[]: 0 0 0 0 0 [ 240.967712][ T7207] Node 1 Normal free:3895452kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:16576kB local_pcp:6976kB free_cma:0kB [ 240.998409][ T7207] lowmem_reserve[]: 0 0 0 0 0 [ 241.003226][ T7207] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 241.026108][ T7207] Node 0 DMA32: 285*4kB (UME) 999*8kB (UME) 983*16kB (UME) 695*32kB (UME) 411*64kB (UME) 80*128kB (UME) 33*256kB (UME) 21*512kB (UM) 15*1024kB (UME) 6*2048kB (UME) 328*4096kB (UM) = 1473980kB [ 241.052452][ T7207] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 241.064928][ T7207] Node 1 Normal: 269*4kB (UE) 59*8kB (UE) 35*16kB (UE) 89*32kB (UE) 21*64kB (UME) 6*128kB (UME) 1*256kB (U) 2*512kB (ME) 0*1024kB 2*2048kB (UE) 948*4096kB (M) = 3895452kB [ 242.267445][ T7225] x_tables: ip6_tables: sctp match: only valid for protocol 132 [ 243.204653][ T7207] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 243.214283][ T7207] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 243.262927][ T7207] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 243.306719][ T7207] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 243.317321][ T7232] netlink: 'syz.1.390': attribute type 4 has an invalid length. [ 243.326468][ T7207] 75433 total pagecache pages [ 243.331274][ T7207] 0 pages in swap cache [ 243.337095][ T7207] Free swap = 124448kB [ 243.342804][ T7207] Total swap = 124996kB [ 243.350984][ T7207] 2097051 pages RAM [ 243.355583][ T7207] 0 pages HighMem/MovableOnly [ 243.360465][ T7207] 416926 pages reserved [ 243.365874][ T7207] 0 pages cma reserved [ 243.569869][ T7236] net_ratelimit: 23 callbacks suppressed [ 243.569888][ T7236] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 243.638587][ T7236] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 243.825656][ T7240] loop0: detected capacity change from 0 to 16 [ 243.893973][ T7240] erofs: (device loop0): mounted with root inode @ nid 36. [ 244.891130][ T7238] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.899123][ T7238] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.872939][ T7238] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 246.274165][ T7238] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.283731][ T7238] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.293021][ T7238] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.302347][ T7238] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.441938][ T7256] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 246.458979][ T7256] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 246.471265][ T7256] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 247.253604][ T7285] ufs: You didn't specify the type of your ufs filesystem [ 247.253604][ T7285] [ 247.253604][ T7285] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 247.253604][ T7285] [ 247.253604][ T7285] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 247.285814][ T7285] ufs: ufstype=old is supported read-only [ 247.295451][ T7285] ufs: ufs_fill_super(): bad magic number [ 248.071301][ T7289] atomic_op ffff888077616998 conn xmit_atomic 0000000000000000 [ 251.773050][ T7281] syz.3.404 (7281) used greatest stack depth: 20200 bytes left [ 252.233979][ T7328] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 252.420922][ T7332] netlink: 'syz.2.417': attribute type 1 has an invalid length. [ 252.451250][ T7332] 8021q: adding VLAN 0 to HW filter on device bond1 [ 252.505970][ T7332] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.514803][ T7332] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.523535][ T7332] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.610114][ T7332] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.722421][ T7332] bond1: (slave geneve2): making interface the new active one [ 252.867837][ T7332] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 254.504338][ T7339] vlan2: entered promiscuous mode [ 254.509929][ T7339] vlan2: entered allmulticast mode [ 254.517064][ T7339] hsr_slave_1: entered allmulticast mode [ 254.536002][ T7332] syz.2.417 (7332) used greatest stack depth: 20168 bytes left [ 256.090362][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.099091][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.770347][ T7381] binder: BINDER_SET_CONTEXT_MGR already set [ 258.780714][ T7381] binder: 7380:7381 ioctl 4018620d 200000000100 returned -16 [ 258.786809][ T7384] gtp0: entered promiscuous mode [ 258.793594][ T7384] gtp0: entered allmulticast mode [ 258.797586][ T7381] binder: BINDER_SET_CONTEXT_MGR already set [ 258.811063][ T7381] binder: 7380:7381 ioctl 4018620d 200000004a80 returned -16 [ 263.569334][ T7413] netlink: 'syz.3.438': attribute type 1 has an invalid length. [ 264.347949][ T7413] 8021q: adding VLAN 0 to HW filter on device bond1 [ 264.485671][ T7418] bond1: (slave veth3): Enslaving as an active interface with a down link [ 264.538460][ T7419] bond1: (slave dummy0): making interface the new active one [ 264.563039][ T7419] dummy0: entered promiscuous mode [ 264.583576][ T7419] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 264.642954][ T7413] netlink: 14 bytes leftover after parsing attributes in process `syz.3.438'. [ 264.765038][ T7413] bond1: (slave dummy0): Releasing active interface [ 264.782635][ T7413] dummy0 (unregistering): left promiscuous mode [ 265.471218][ T5781] Bluetooth: hci2: command 0x0406 tx timeout [ 269.615267][ T7452] netlink: 'syz.0.457': attribute type 1 has an invalid length. [ 269.684137][ T7451] syzkaller0: entered promiscuous mode [ 269.719553][ T7451] syzkaller0: entered allmulticast mode [ 269.771607][ T7452] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 269.820212][ T7452] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 269.864622][ T7452] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 269.884683][ T7452] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 269.906438][ T7452] bond6: (slave geneve2): making interface the new active one [ 269.935880][ T7452] bond6: (slave geneve2): Enslaving as an active interface with an up link [ 269.954718][ T7457] netlink: 28 bytes leftover after parsing attributes in process `syz.0.457'. [ 269.975231][ T7457] 8021q: adding VLAN 0 to HW filter on device bond6 [ 270.138520][ T7452] syz.0.457 (7452) used greatest stack depth: 19920 bytes left [ 270.312313][ T7462] vlan2: entered promiscuous mode [ 270.318347][ T7462] vlan2: entered allmulticast mode [ 270.323629][ T7462] hsr_slave_1: entered allmulticast mode [ 272.100352][ T7479] loop2: detected capacity change from 0 to 512 [ 272.125660][ T7479] EXT4-fs: Ignoring removed i_version option [ 272.149304][ T7481] fuse: Bad value for 'fd' [ 272.212124][ T7479] EXT4-fs (loop2): 1 truncate cleaned up [ 272.332593][ T7479] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 272.821679][ T7490] Zero length message leads to an empty skb [ 272.905448][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.270808][ T7517] netlink: 'syz.3.465': attribute type 1 has an invalid length. [ 275.547657][ T7522] bond2: (slave bridge2): Enslaving as a backup interface with an up link [ 275.685243][ T7521] bond2: (slave bridge3): Enslaving as a backup interface with a down link [ 275.777251][ T7524] netlink: 4096 bytes leftover after parsing attributes in process `syz.2.466'. [ 275.787083][ T7524] openvswitch: netlink: ct_state flags 00030000 unsupported [ 276.713981][ T7530] syzkaller0: entered promiscuous mode [ 276.720147][ T7530] syzkaller0: entered allmulticast mode [ 279.578836][ T7562] loop3: detected capacity change from 0 to 512 [ 279.947639][ T7562] EXT4-fs: Ignoring removed i_version option [ 280.135339][ T7562] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 280.245855][ T7562] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 280.312784][ T7562] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ee02c, mo2=0002] [ 280.364954][ T7562] System zones: 1-12 [ 280.386113][ T7562] EXT4-fs (loop3): orphan cleanup on readonly fs [ 280.418900][ T7562] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.477: invalid indirect mapped block 2 (level 2) [ 280.605732][ T7562] EXT4-fs (loop3): Remounting filesystem read-only [ 280.614036][ T7562] EXT4-fs (loop3): 1 truncate cleaned up [ 280.628166][ T7562] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 281.962039][ T5770] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 284.134485][ T28] kauditd_printk_skb: 82 callbacks suppressed [ 284.134501][ T28] audit: type=1326 audit(1774677220.045:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 284.166136][ T28] audit: type=1326 audit(1774677220.045:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 285.697118][ T28] audit: type=1326 audit(1774677220.075:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=305 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 285.741322][ T28] audit: type=1326 audit(1774677220.085:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 285.784131][ T28] audit: type=1326 audit(1774677220.085:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 286.266436][ T7611] netlink: 201392 bytes leftover after parsing attributes in process `syz.2.490'. [ 286.559752][ T28] audit: type=1326 audit(1774677220.085:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 286.901396][ T28] audit: type=1326 audit(1774677220.085:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 287.073144][ T28] audit: type=1326 audit(1774677220.085:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 287.115203][ T28] audit: type=1326 audit(1774677220.085:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 287.168888][ T28] audit: type=1326 audit(1774677220.085:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7596 comm="syz.0.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 292.945471][ T7656] comedi comedi0: Minor 3 could not be opened [ 294.234116][ T7674] netlink: 'syz.1.506': attribute type 1 has an invalid length. [ 294.355005][ T7678] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 294.392192][ T7678] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 294.507136][ T7678] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 294.640452][ T7678] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 294.866689][ T7678] bond2: (slave geneve2): making interface the new active one [ 294.996462][ T7678] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 295.234799][ T7674] netlink: 28 bytes leftover after parsing attributes in process `syz.1.506'. [ 295.270862][ T7674] 8021q: adding VLAN 0 to HW filter on device bond2 [ 300.854093][ T7718] netlink: 'syz.2.518': attribute type 1 has an invalid length. [ 301.863531][ T7721] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 301.897896][ T7721] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 301.949424][ T7721] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 301.972730][ T7721] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 302.009265][ T7721] bond2: (slave geneve3): making interface the new active one [ 302.032152][ T7721] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 302.049283][ T7725] netlink: 28 bytes leftover after parsing attributes in process `syz.2.518'. [ 302.098462][ T7725] 8021q: adding VLAN 0 to HW filter on device bond2 [ 305.959846][ T7759] loop2: detected capacity change from 0 to 2048 [ 306.069754][ T7759] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 306.108415][ T7762] netlink: 'syz.1.528': attribute type 1 has an invalid length. [ 306.177509][ T7762] 8021q: adding VLAN 0 to HW filter on device bond3 [ 306.395814][ T7762] vlan0: entered promiscuous mode [ 307.182626][ T7762] bond3: entered promiscuous mode [ 307.224996][ T7762] vlan0: entered allmulticast mode [ 307.230182][ T7762] bond3: entered allmulticast mode [ 307.338649][ T7766] bond3: (slave bridge1): making interface the new active one [ 307.363665][ T7766] bridge1: entered promiscuous mode [ 307.379960][ T7766] bridge1: entered allmulticast mode [ 307.402336][ T7766] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 309.220340][ T7804] netlink: 16 bytes leftover after parsing attributes in process `syz.2.538'. [ 309.235038][ T7804] netlink: 16 bytes leftover after parsing attributes in process `syz.2.538'. [ 310.540872][ T7816] overlayfs: failed to resolve './file0': -40 [ 312.959575][ T7853] netlink: 16 bytes leftover after parsing attributes in process `syz.1.551'. [ 313.012288][ T7853] netlink: 16 bytes leftover after parsing attributes in process `syz.1.551'. [ 313.804943][ T28] kauditd_printk_skb: 4 callbacks suppressed [ 313.804959][ T28] audit: type=1326 audit(1774677247.801:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 314.158510][ T28] audit: type=1326 audit(1774677247.857:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=318 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 314.705759][ T28] audit: type=1326 audit(1774677247.857:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 314.863342][ T28] audit: type=1326 audit(1774677247.857:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 315.251666][ T28] audit: type=1326 audit(1774677247.857:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 315.469982][ T28] audit: type=1326 audit(1774677247.857:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 315.761370][ T28] audit: type=1326 audit(1774677247.857:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 315.787248][ T28] audit: type=1326 audit(1774677247.857:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 316.558923][ T28] audit: type=1326 audit(1774677247.857:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 316.582094][ T28] audit: type=1326 audit(1774677247.857:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.1.553" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312c59c799 code=0x7ffc0000 [ 316.932544][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 318.540262][ T51] Bluetooth: hci2: unexpected event for opcode 0x0c1c [ 318.583051][ T7908] warning: `syz.3.569' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 318.647959][ T7908] bridge_slave_0: left allmulticast mode [ 318.663828][ T7908] bridge_slave_0: left promiscuous mode [ 318.695228][ T7908] bridge0: port 1(bridge_slave_0) entered disabled state [ 318.746936][ T7908] bridge_slave_1: left allmulticast mode [ 318.771185][ T7908] bridge_slave_1: left promiscuous mode [ 318.784286][ T7908] bridge0: port 2(bridge_slave_1) entered disabled state [ 318.821093][ T7908] bond0: (slave bond_slave_0): Releasing backup interface [ 318.851056][ T7908] bond0: (slave bond_slave_1): Releasing backup interface [ 318.941559][ T7908] team0: Port device team_slave_0 removed [ 318.972960][ T7908] team0: Port device team_slave_1 removed [ 318.985894][ T7908] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 318.993602][ T7908] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 319.007149][ T7908] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 319.137127][ T7908] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 319.937314][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 319.943810][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 320.428492][ T7908] team0: Port device geneve0 removed [ 320.440974][ T7908] bond1: (slave veth3): Releasing active interface [ 320.454876][ T7908] bond2: (slave bridge2): Releasing backup interface [ 320.467664][ T7908] bond2: (slave bridge2): the permanent HWaddr of slave - 62:a8:3b:48:d8:f1 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 320.535090][ T7908] bond2: (slave bridge3): Releasing backup interface [ 320.595929][ T7912] netlink: 'syz.3.569': attribute type 10 has an invalid length. [ 320.627672][ T7912] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 321.006224][ T7925] netlink: 'syz.2.573': attribute type 1 has an invalid length. [ 321.078572][ T7925] 8021q: adding VLAN 0 to HW filter on device bond3 [ 321.139482][ T7927] bond3: (slave veth5): Enslaving as an active interface with a down link [ 321.264074][ T7925] bond3: (slave dummy0): making interface the new active one [ 321.273858][ T7925] dummy0: entered promiscuous mode [ 321.279351][ T7925] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 322.055495][ T7925] netlink: 14 bytes leftover after parsing attributes in process `syz.2.573'. [ 322.122037][ T7925] bond3: (slave dummy0): Releasing active interface [ 322.129096][ T7925] dummy0 (unregistering): left promiscuous mode [ 322.998612][ T51] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 323.007929][ T51] Bluetooth: hci2: Injecting HCI hardware error event [ 323.018893][ T51] Bluetooth: hci2: hardware error 0x00 [ 323.426220][ T7944] netlink: 12 bytes leftover after parsing attributes in process `syz.3.579'. [ 323.431838][ T7948] netlink: 8 bytes leftover after parsing attributes in process `syz.2.581'. [ 323.595141][ T7950] bond3: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 323.627459][ T7950] bond3: (slave ip_vti0): Error -95 calling set_mac_address [ 323.659541][ T7951] bond3 (unregistering): Released all slaves [ 324.925786][ T7957] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.010997][ T7966] netlink: 64 bytes leftover after parsing attributes in process `syz.0.583'. [ 325.179883][ T7957] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.231598][ T51] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 325.238449][ T7271] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 325.408141][ T7957] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.501857][ T7271] usb 4-1: config 0 has no interfaces? [ 326.166289][ T7271] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 326.175831][ T7271] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 326.201479][ T7957] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.247101][ T7271] usb 4-1: Product: syz [ 326.251435][ T7271] usb 4-1: Manufacturer: syz [ 326.309120][ T7271] usb 4-1: SerialNumber: syz [ 326.409791][ T7271] usb 4-1: config 0 descriptor?? [ 327.109726][ T7271] usb 4-1: USB disconnect, device number 7 [ 328.102544][ T7957] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.114764][ T7996] fuse: Bad value for 'fd' [ 328.186058][ T7957] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.230300][ T7957] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.270370][ T7957] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.342181][ T8021] loop3: detected capacity change from 0 to 512 [ 330.459074][ T8021] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 330.590526][ T8021] EXT4-fs error (device loop3): ext4_orphan_get:1424: comm syz.3.600: bad orphan inode 131083 [ 330.631366][ T8021] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 330.743545][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 331.774059][ T5770] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 333.382778][ T8053] mmap: syz.2.609 (8053) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 333.597950][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 333.782198][ T8052] netlink: 12 bytes leftover after parsing attributes in process `syz.3.611'. [ 336.705774][ T8063] bond3: (slave syz_tun): Enslaving as an active interface with an up link [ 337.376416][ T5781] Bluetooth: hci3: command 0x0406 tx timeout [ 339.186011][ T8091] netlink: 'syz.0.628': attribute type 10 has an invalid length. [ 340.686296][ T8091] team0: Device vxcan1 is of different type [ 340.866689][ T8106] capability: warning: `syz.1.623' uses 32-bit capabilities (legacy support in use) [ 342.835018][ T5773] Bluetooth: hci0: command 0x0406 tx timeout [ 343.565495][ T8139] loop2: detected capacity change from 0 to 128 [ 343.588896][ T8139] FAT-fs (loop2): Unrecognized mount option "Hm1x'haA9!vpn/בmRSiK RD5}H [ 343.588896][ T8139]  < [ 343.588896][ T8139] xr%9I`gry [ 343.588896][ T8139] " or missing value [ 345.436638][ T8164] loop2: detected capacity change from 0 to 128 [ 345.555982][ T8164] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 345.590055][ T8164] ext4 filesystem being mounted at /147/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 347.414747][ T5768] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 356.209853][ T8265] xt_cluster: node mask cannot exceed total number of nodes [ 358.443582][ T8278] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 358.481075][ T8280] syzkaller0: entered promiscuous mode [ 358.487676][ T8280] syzkaller0: entered allmulticast mode [ 358.725590][ T8278] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.742292][ T8278] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.751333][ T8278] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.767649][ T8278] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.864505][ T8278] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 358.873860][ T8278] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 358.894424][ T8278] netdevsim netdevsim2 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 358.904964][ T8278] netdevsim netdevsim2 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 359.597745][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 360.366786][ T8296] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -30507, delta: 1 [ 360.420228][ T8296] ref_ctr increment failed for inode: 0x37d offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88807c220000 [ 360.489553][ T8301] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -30507, delta: -1 [ 360.542272][ T8301] ref_ctr decrement failed for inode: 0x37d offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88807c220000 [ 362.260707][ T8319] loop3: detected capacity change from 0 to 164 [ 362.382004][ T8322] 8021q: VLANs not supported on ip6gre0 [ 362.656523][ T8326] netlink: 8 bytes leftover after parsing attributes in process `syz.3.687'. [ 365.601232][ T28] kauditd_printk_skb: 13 callbacks suppressed [ 365.601275][ T28] audit: type=1326 audit(1774677296.254:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8339 comm="syz.3.692" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe28659c799 code=0x7ffc0000 [ 366.022243][ T28] audit: type=1326 audit(1774677296.254:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8339 comm="syz.3.692" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe28659c799 code=0x7ffc0000 [ 367.255054][ T8355] erspan0: left allmulticast mode [ 367.260200][ T8355] erspan0: left promiscuous mode [ 367.295838][ T8355] bridge0: port 3(erspan0) entered disabled state [ 367.617481][ T8355] team0: Port device bridge0 removed [ 367.684577][ T8355] bridge_slave_0: left allmulticast mode [ 367.701105][ T8355] bridge_slave_0: left promiscuous mode [ 367.716430][ T8355] bridge0: port 1(bridge_slave_0) entered disabled state [ 367.751243][ T8355] bridge_slave_1: left allmulticast mode [ 367.757206][ T8355] bridge_slave_1: left promiscuous mode [ 367.770515][ T8355] bridge0: port 2(bridge_slave_1) entered disabled state [ 367.795059][ T8355] bond0: (slave bond_slave_0): Releasing backup interface [ 367.837215][ T8355] bond0: (slave bond_slave_1): Releasing backup interface [ 367.903807][ T8355] team0: Port device team_slave_0 removed [ 367.961632][ T8355] team0: Port device team_slave_1 removed [ 367.998775][ T8355] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 368.027682][ T8355] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 368.055742][ T8355] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 368.086657][ T8355] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 368.148851][ T8355] bond1: (slave gretap1): Releasing active interface [ 368.186926][ T8355] gretap1: left allmulticast mode [ 368.379843][ T8355] bond2: (slave bond3): Releasing backup interface [ 368.387306][ T8355] bond2: (slave bond3): the permanent HWaddr of slave - 5a:a6:ab:65:4d:5a - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 368.546276][ T8355] bond2: (slave gretap2): making interface the new active one [ 368.565702][ T8355] bond2: (slave gretap2): Releasing backup interface [ 368.584379][ T8355] bond5: (slave bridge1): Releasing backup interface [ 368.591421][ T8355] bridge1: left promiscuous mode [ 368.627308][ T8355] bond6: (slave geneve2): Releasing active interface [ 368.642997][ T8355] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 368.931521][ T8355] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 369.375126][ T8355] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 369.414487][ T8355] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 369.472144][ T8358] netlink: 'syz.0.697': attribute type 10 has an invalid length. [ 369.546001][ T8377] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 369.553826][ T8377] IPv6: NLM_F_CREATE should be set when creating new route [ 369.561333][ T8377] IPv6: NLM_F_CREATE should be set when creating new route [ 369.568778][ T8377] IPv6: NLM_F_CREATE should be set when creating new route [ 372.626022][ T8411] netlink: 24 bytes leftover after parsing attributes in process `syz.1.717'. [ 381.293071][ T8473] loop2: detected capacity change from 0 to 2048 [ 381.345052][ T8473] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 383.350662][ T8433] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 383.364525][ T8433] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 383.373845][ T8433] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 383.382792][ T8433] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 383.543327][ T8433] bond5: left promiscuous mode [ 383.603308][ T8433] vlan2: left promiscuous mode [ 383.608322][ T8433] vlan2: left allmulticast mode [ 383.613497][ T8433] hsr_slave_1: left allmulticast mode [ 383.620955][ T8433] gtp0: left promiscuous mode [ 383.625747][ T8433] gtp0: left allmulticast mode [ 385.531466][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 385.538236][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 385.597748][ T8511] tipc: Enabling of bearer rejected, failed to enable media [ 385.677543][ T8516] netlink: 'syz.3.732': attribute type 10 has an invalid length. [ 385.853089][ T8521] netlink: 176 bytes leftover after parsing attributes in process `syz.3.732'. [ 388.996172][ T8548] netlink: 132 bytes leftover after parsing attributes in process `syz.1.741'. [ 390.421771][ T8568] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 391.191291][ T8587] bridge_slave_0: left allmulticast mode [ 391.338563][ T8587] bridge_slave_0: left promiscuous mode [ 391.361973][ T8587] bridge0: port 1(bridge_slave_0) entered disabled state [ 391.426874][ T8587] bridge_slave_1: left allmulticast mode [ 391.432845][ T8587] bridge_slave_1: left promiscuous mode [ 391.511551][ T8587] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.572741][ T8587] bond0: (slave bond_slave_0): Releasing backup interface [ 391.639769][ T8587] bond0: (slave bond_slave_1): Releasing backup interface [ 391.812379][ T8587] team0: Port device team_slave_0 removed [ 391.873892][ T8587] team0: Port device team_slave_1 removed [ 391.889272][ T8587] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 391.905996][ T8587] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 391.928339][ T8587] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 391.935846][ T8587] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 392.054834][ T8587] bond0: (slave wlan1): Releasing backup interface [ 392.089901][ T8587] bond2: (slave geneve2): Releasing active interface [ 392.110416][ T8587] netdevsim netdevsim1 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 392.129044][ T8587] netdevsim netdevsim1 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 392.138183][ T8587] netdevsim netdevsim1 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 392.161103][ T8587] netdevsim netdevsim1 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 392.185819][ T8587] bond3: (slave bridge1): Releasing active interface [ 392.192784][ T8587] bridge1: left promiscuous mode [ 392.198881][ T8587] bridge1: left allmulticast mode [ 392.213556][ T8589] netlink: 'syz.1.752': attribute type 10 has an invalid length. [ 392.231138][ T8589] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 394.043130][ T28] audit: type=1107 audit(1774677322.857:136): pid=8610 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 394.387697][ T8618] loop2: detected capacity change from 0 to 512 [ 394.421911][ T8618] FAT-fs (loop2): bogus number of FAT sectors [ 394.437573][ T8618] FAT-fs (loop2): Can't find a valid FAT filesystem [ 395.219136][ T8602] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.227850][ T8602] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.238190][ T8602] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.247188][ T8602] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.336643][ T28] audit: type=1800 audit(1774677324.064:137): pid=8611 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.758" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 395.390781][ T8611] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 395.449388][ T8611] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 395.475205][ T8611] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 395.741587][ T8627] bridge_slave_0: left allmulticast mode [ 395.771112][ T8627] bridge_slave_0: left promiscuous mode [ 395.785685][ T8627] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.795381][ T8627] bridge_slave_1: left allmulticast mode [ 395.801296][ T8627] bridge_slave_1: left promiscuous mode [ 395.807344][ T8627] bridge0: port 2(bridge_slave_1) entered disabled state [ 395.822214][ T8627] team0: Port device team_slave_0 removed [ 395.833128][ T8627] team0: Port device team_slave_1 removed [ 395.840338][ T8627] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 395.844764][ T5781] Bluetooth: hci0: unexpected event for opcode 0x080d [ 395.858243][ T8627] bond0: (slave bridge1): Releasing backup interface [ 395.867565][ T8627] bridge1: left promiscuous mode [ 395.879130][ T8627] bond1: (slave geneve2): Releasing active interface [ 396.178284][ T8627] bond2: (slave geneve3): Releasing active interface [ 396.883069][ T8627] bond3: (slave veth5): Releasing active interface [ 396.900379][ T8628] netlink: 'syz.2.765': attribute type 10 has an invalid length. [ 397.490981][ T8643] loop3: detected capacity change from 0 to 32768 [ 397.515282][ T8643] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 397.524280][ T8643] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 397.555633][ T8643] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 397.571156][ T786] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 397.578488][ T786] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 397.634848][ T786] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 52ms [ 397.652168][ T786] gfs2: fsid=syz:syz.0: jid=0: Done [ 397.665642][ T8643] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 397.888778][ T8643] gfs2: fsid=syz:syz.0: found 1 quota changes [ 399.545138][ T5770] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 399.545138][ T5770] inode = 11 2339 [ 399.545138][ T5770] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 472 [ 399.566541][ T5770] gfs2: fsid=syz:syz.0: G: s:EX n:2/923 f:qobnN t:EX d:EX/0 a:0 v:0 r:3 m:20 p:1 [ 399.576050][ T5770] gfs2: fsid=syz:syz.0: H: s:EX f:H e:0 p:5770 [syz-executor] gfs2_quota_sync+0x411/0x5a0 [ 399.621973][ T5770] gfs2: fsid=syz:syz.0: I: n:11/2339 t:0 f:0x00 d:0x00000000 s:0 p:0 [ 399.647966][ T5770] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 399.702845][ T5770] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 399.757523][ T5770] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 399.787186][ T5770] gfs2: fsid=syz:syz.0: File system withdrawn [ 399.793336][ T5770] CPU: 0 PID: 5770 Comm: syz-executor Not tainted syzkaller #0 [ 399.801022][ T5770] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 399.811233][ T5770] Call Trace: [ 399.814547][ T5770] [ 399.817525][ T5770] dump_stack_lvl+0x18c/0x250 [ 399.822262][ T5770] ? kobject_uevent_env+0x363/0x8b0 [ 399.827596][ T5770] ? show_regs_print_info+0x20/0x20 [ 399.833020][ T5770] ? load_image+0x400/0x400 [ 399.837571][ T5770] ? kobject_uevent_env+0x363/0x8b0 [ 399.842831][ T5770] gfs2_withdraw+0xb24/0x13d0 [ 399.847713][ T5770] ? gfs2_lm+0x240/0x240 [ 399.852039][ T5770] ? gfs2_consist_inode_i+0xf5/0x110 [ 399.857381][ T5770] gfs2_inode_refresh+0xb89/0x1000 [ 399.862632][ T5770] ? gfs2_inode_metasync+0xf0/0xf0 [ 399.867792][ T5770] ? gfs2_glock_nq+0xd4f/0x1420 [ 399.872962][ T5770] gfs2_instantiate+0x162/0x220 [ 399.877903][ T5770] gfs2_glock_wait+0x1d4/0x2a0 [ 399.882858][ T5770] do_sync+0x4c6/0xe50 [ 399.886947][ T5770] ? gfs2_quota_sync+0x411/0x5a0 [ 399.891996][ T5770] ? bh_get+0x760/0x760 [ 399.896275][ T5770] ? __lock_acquire+0x7d40/0x7d40 [ 399.901745][ T5770] ? do_raw_spin_lock+0x11f/0x2c0 [ 399.906826][ T5770] ? gfs2_quota_sync+0x411/0x5a0 [ 399.911797][ T5770] ? do_raw_spin_unlock+0x121/0x230 [ 399.917113][ T5770] gfs2_quota_sync+0x411/0x5a0 [ 399.921907][ T5770] gfs2_sync_fs+0x4c/0xb0 [ 399.926301][ T5770] sync_filesystem+0xea/0x220 [ 399.931034][ T5770] generic_shutdown_super+0x6f/0x2b0 [ 399.936444][ T5770] kill_block_super+0x44/0x90 [ 399.941324][ T5770] deactivate_locked_super+0x97/0x100 [ 399.946723][ T5770] cleanup_mnt+0x43b/0x4d0 [ 399.951194][ T5770] task_work_run+0x1d4/0x260 [ 399.955826][ T5770] ? task_work_cancel+0x220/0x220 [ 399.961063][ T5770] ? exit_to_user_mode_loop+0x3b/0x110 [ 399.966814][ T5770] exit_to_user_mode_loop+0xe6/0x110 [ 399.972135][ T5770] exit_to_user_mode_prepare+0xee/0x180 [ 399.977884][ T5770] syscall_exit_to_user_mode+0x1a/0x50 [ 399.983449][ T5770] do_syscall_64+0x61/0xa0 [ 399.987967][ T5770] ? clear_bhb_loop+0x40/0x90 [ 399.992707][ T5770] ? clear_bhb_loop+0x40/0x90 [ 399.997406][ T5770] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 400.003419][ T5770] RIP: 0033:0x7fe28659d9d7 [ 400.007940][ T5770] Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 400.028043][ T5770] RSP: 002b:00007ffd25108c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 400.036941][ T5770] RAX: 0000000000000000 RBX: 00007fe286632050 RCX: 00007fe28659d9d7 [ 400.044936][ T5770] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd25108d10 [ 400.053109][ T5770] RBP: 00007ffd25108d10 R08: 00007ffd25109d10 R09: 00000000ffffffff [ 400.061365][ T5770] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd25109da0 [ 400.069530][ T5770] R13: 00007fe286632050 R14: 000000000005f79e R15: 00007ffd25109de0 [ 400.077628][ T5770] [ 401.658892][ T5773] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 401.669711][ T5773] Bluetooth: hci0: Injecting HCI hardware error event [ 401.683095][ T5781] Bluetooth: hci0: hardware error 0x00 [ 403.931769][ T5781] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 405.636361][ T8665] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 405.645912][ T8665] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 405.654910][ T8665] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 405.666677][ T8665] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 405.774533][ T8676] netlink: 76 bytes leftover after parsing attributes in process `syz.0.778'. [ 405.790110][ T8689] netlink: 12 bytes leftover after parsing attributes in process `syz.3.780'. [ 405.802860][ T8689] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 405.847578][ T8691] veth7: entered promiscuous mode [ 405.868988][ T8693] netlink: 28 bytes leftover after parsing attributes in process `syz.3.780'. [ 405.971494][ T8702] tipc: Started in network mode [ 405.987495][ T8702] tipc: Node identity 080211, cluster identity 4711 [ 405.996242][ T8702] tipc: Enabled bearer , priority 0 [ 406.023635][ T8706] MTD: Attempt to mount non-MTD device "./file0" [ 406.031748][ T8706] ./file0: Can't open blockdev [ 406.043502][ T8705] bond3: (slave syz_tun): Releasing backup interface [ 406.078527][ T8705] bond0: (slave wlan1): Releasing backup interface [ 406.119797][ T8708] netlink: 'syz.3.781': attribute type 10 has an invalid length. [ 406.138747][ T8708] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 408.032521][ T28] audit: type=1326 audit(1774677335.055:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 408.056436][ T7270] tipc: Node number set to 134353152 [ 408.096818][ T8721] tipc: Enabling of bearer rejected, failed to enable media [ 408.113047][ T28] audit: type=1326 audit(1774677335.064:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 408.145193][ T8721] netlink: 104 bytes leftover after parsing attributes in process `syz.1.788'. [ 408.162786][ T28] audit: type=1326 audit(1774677335.064:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 408.186128][ T8721] tipc: Enabling of bearer rejected, failed to enable media [ 408.470293][ T8725] netlink: 2 bytes leftover after parsing attributes in process `syz.2.790'. [ 408.562028][ T28] audit: type=1326 audit(1774677335.064:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 408.623817][ T8723] netlink: 64 bytes leftover after parsing attributes in process `syz.3.787'. [ 408.633483][ T28] audit: type=1326 audit(1774677335.064:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 408.633530][ T28] audit: type=1326 audit(1774677335.064:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=37 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 408.705715][ T28] audit: type=1326 audit(1774677335.064:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 408.739507][ T28] audit: type=1326 audit(1774677335.074:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 408.775088][ T28] audit: type=1326 audit(1774677335.074:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=37 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 408.799985][ T28] audit: type=1326 audit(1774677335.074:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8714 comm="syz.0.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0459c799 code=0x7ffc0000 [ 409.091697][ T8741] syzkaller0: entered promiscuous mode [ 409.110440][ T8743] ------------[ cut here ]------------ [ 409.117081][ T8743] WARNING: CPU: 0 PID: 8743 at net/mac80211/chan.c:2022 ieee80211_link_release_channel+0x154/0x180 [ 409.128115][ T8743] Modules linked in: [ 409.132053][ T8743] CPU: 0 PID: 8743 Comm: syz.1.797 Not tainted syzkaller #0 [ 409.139827][ T8743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 409.150205][ T8743] RIP: 0010:ieee80211_link_release_channel+0x154/0x180 [ 409.157454][ T8743] Code: 7c 2d 00 00 74 08 48 89 df e8 68 7e d6 f7 bf 60 1e 00 00 48 03 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 71 bc 85 00 e8 3c 42 7e f7 <0f> 0b eb c5 48 c7 c1 6c 37 8b 8e 80 e1 07 80 c1 03 38 c1 0f 8c 51 [ 409.177679][ T8743] RSP: 0018:ffffc90019ee7978 EFLAGS: 00010283 [ 409.184456][ T8743] RAX: ffffffff8a08dde4 RBX: ffff88805dee1598 RCX: 0000000000080000 [ 409.192911][ T8743] RDX: ffffc9000c969000 RSI: 00000000000167cc RDI: 00000000000167cd [ 409.200963][ T8743] RBP: 0000000000000000 R08: ffffffff8e8b02af R09: 1ffffffff1d16055 [ 409.209418][ T8743] R10: dffffc0000000000 R11: fffffbfff1d16056 R12: ffff88805dee2c08 [ 409.217715][ T8743] R13: 1ffff1100bbdc2b3 R14: ffff88805dee23c0 R15: dffffc0000000000 [ 409.226188][ T8743] FS: 00007f312d4076c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 409.235515][ T8743] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 409.242146][ T8743] CR2: 00007f7a045e9e80 CR3: 000000002ea22000 CR4: 00000000003506f0 [ 409.250324][ T8743] Call Trace: [ 409.253650][ T8743] [ 409.256737][ T8743] ieee80211_if_change_type+0x211/0xa70 [ 409.262341][ T8743] ? do_raw_spin_unlock+0x121/0x230 [ 409.267803][ T8743] ? cfg80211_mgmt_registrations_update_wk+0xa0/0xa0 [ 409.274536][ T8743] ? cfg80211_mlme_purge_registrations+0x1d4/0x210 [ 409.281366][ T8743] ieee80211_change_iface+0x5c/0x4c0 [ 409.286785][ T8743] cfg80211_change_iface+0x812/0xf30 [ 409.292393][ T8743] cfg80211_wext_siwmode+0x1e8/0x2c0 [ 409.297851][ T8743] ? cfg80211_wext_giwname+0x30/0x30 [ 409.303576][ T8743] ? cfg80211_wext_giwname+0x30/0x30 [ 409.309145][ T8743] ioctl_standard_call+0xd8/0x2b0 [ 409.314233][ T8743] ? cfg80211_wext_giwname+0x30/0x30 [ 409.319666][ T8743] wext_ioctl_dispatch+0x1cb/0x600 [ 409.324847][ T8743] ? wext_ioctl_dispatch+0x600/0x600 [ 409.330269][ T8743] ? iw_handler_get_private+0x1f0/0x1f0 [ 409.336033][ T8743] ? wext_handle_ioctl+0x1d0/0x1d0 [ 409.341435][ T8743] ? __might_fault+0xaa/0x120 [ 409.346206][ T8743] ? __might_fault+0xc6/0x120 [ 409.350959][ T8743] ? __might_fault+0xaa/0x120 [ 409.355890][ T8743] wext_handle_ioctl+0x117/0x1d0 [ 409.360988][ T8743] ? call_commit_handler+0xf0/0xf0 [ 409.366307][ T8743] sock_ioctl+0x15d/0x7e0 [ 409.370710][ T8743] ? sock_poll+0x3e0/0x3e0 [ 409.375910][ T8743] ? bpf_lsm_file_ioctl+0x9/0x10 [ 409.381309][ T8743] ? security_file_ioctl+0x80/0xa0 [ 409.386746][ T8743] ? sock_poll+0x3e0/0x3e0 [ 409.391228][ T8743] __se_sys_ioctl+0xfd/0x170 [ 409.396089][ T8743] do_syscall_64+0x55/0xa0 [ 409.400582][ T8743] ? clear_bhb_loop+0x40/0x90 [ 409.405420][ T8743] ? clear_bhb_loop+0x40/0x90 [ 409.410147][ T8743] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 409.416334][ T8743] RIP: 0033:0x7f312c59c799 [ 409.420782][ T8743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 409.440772][ T8743] RSP: 002b:00007f312d407028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 409.449469][ T8743] RAX: ffffffffffffffda RBX: 00007f312c815fa0 RCX: 00007f312c59c799 [ 409.457617][ T8743] RDX: 0000200000000000 RSI: 0000000000008b06 RDI: 0000000000000004 [ 409.467161][ T8743] RBP: 00007f312c632c99 R08: 0000000000000000 R09: 0000000000000000 [ 409.475273][ T8743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 409.483451][ T8743] R13: 00007f312c816038 R14: 00007f312c815fa0 R15: 00007ffc5526a908 [ 409.491642][ T8743] [ 409.494896][ T8743] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 409.502419][ T8743] CPU: 0 PID: 8743 Comm: syz.1.797 Not tainted syzkaller #0 [ 409.509999][ T8743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 409.520794][ T8743] Call Trace: [ 409.524315][ T8743] [ 409.527278][ T8743] dump_stack_lvl+0x18c/0x250 [ 409.532331][ T8743] ? show_regs_print_info+0x20/0x20 [ 409.537574][ T8743] ? load_image+0x400/0x400 [ 409.542177][ T8743] panic+0x2dc/0x730 [ 409.546099][ T8743] ? bpf_jit_dump+0xd0/0xd0 [ 409.550617][ T8743] __warn+0x2e0/0x470 [ 409.554654][ T8743] ? ieee80211_link_release_channel+0x154/0x180 [ 409.560944][ T8743] ? ieee80211_link_release_channel+0x154/0x180 [ 409.567203][ T8743] report_bug+0x2be/0x4f0 [ 409.571641][ T8743] ? ieee80211_link_release_channel+0x154/0x180 [ 409.578162][ T8743] ? ieee80211_link_release_channel+0x154/0x180 [ 409.584619][ T8743] ? ieee80211_link_release_channel+0x156/0x180 [ 409.590970][ T8743] handle_bug+0xcf/0x120 [ 409.595231][ T8743] exc_invalid_op+0x1a/0x50 [ 409.599916][ T8743] asm_exc_invalid_op+0x1a/0x20 [ 409.604871][ T8743] RIP: 0010:ieee80211_link_release_channel+0x154/0x180 [ 409.611826][ T8743] Code: 7c 2d 00 00 74 08 48 89 df e8 68 7e d6 f7 bf 60 1e 00 00 48 03 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 71 bc 85 00 e8 3c 42 7e f7 <0f> 0b eb c5 48 c7 c1 6c 37 8b 8e 80 e1 07 80 c1 03 38 c1 0f 8c 51 [ 409.631908][ T8743] RSP: 0018:ffffc90019ee7978 EFLAGS: 00010283 [ 409.638802][ T8743] RAX: ffffffff8a08dde4 RBX: ffff88805dee1598 RCX: 0000000000080000 [ 409.646885][ T8743] RDX: ffffc9000c969000 RSI: 00000000000167cc RDI: 00000000000167cd [ 409.654883][ T8743] RBP: 0000000000000000 R08: ffffffff8e8b02af R09: 1ffffffff1d16055 [ 409.662864][ T8743] R10: dffffc0000000000 R11: fffffbfff1d16056 R12: ffff88805dee2c08 [ 409.671023][ T8743] R13: 1ffff1100bbdc2b3 R14: ffff88805dee23c0 R15: dffffc0000000000 [ 409.679309][ T8743] ? ieee80211_link_release_channel+0x154/0x180 [ 409.685692][ T8743] ? ieee80211_link_release_channel+0x154/0x180 [ 409.692043][ T8743] ieee80211_if_change_type+0x211/0xa70 [ 409.697777][ T8743] ? do_raw_spin_unlock+0x121/0x230 [ 409.703163][ T8743] ? cfg80211_mgmt_registrations_update_wk+0xa0/0xa0 [ 409.710026][ T8743] ? cfg80211_mlme_purge_registrations+0x1d4/0x210 [ 409.716990][ T8743] ieee80211_change_iface+0x5c/0x4c0 [ 409.722388][ T8743] cfg80211_change_iface+0x812/0xf30 [ 409.727751][ T8743] cfg80211_wext_siwmode+0x1e8/0x2c0 [ 409.733062][ T8743] ? cfg80211_wext_giwname+0x30/0x30 [ 409.738364][ T8743] ? cfg80211_wext_giwname+0x30/0x30 [ 409.743718][ T8743] ioctl_standard_call+0xd8/0x2b0 [ 409.749015][ T8743] ? cfg80211_wext_giwname+0x30/0x30 [ 409.754425][ T8743] wext_ioctl_dispatch+0x1cb/0x600 [ 409.759583][ T8743] ? wext_ioctl_dispatch+0x600/0x600 [ 409.764897][ T8743] ? iw_handler_get_private+0x1f0/0x1f0 [ 409.770466][ T8743] ? wext_handle_ioctl+0x1d0/0x1d0 [ 409.775706][ T8743] ? __might_fault+0xaa/0x120 [ 409.780569][ T8743] ? __might_fault+0xc6/0x120 [ 409.785251][ T8743] ? __might_fault+0xaa/0x120 [ 409.790026][ T8743] wext_handle_ioctl+0x117/0x1d0 [ 409.794995][ T8743] ? call_commit_handler+0xf0/0xf0 [ 409.800791][ T8743] sock_ioctl+0x15d/0x7e0 [ 409.805150][ T8743] ? sock_poll+0x3e0/0x3e0 [ 409.809596][ T8743] ? bpf_lsm_file_ioctl+0x9/0x10 [ 409.814553][ T8743] ? security_file_ioctl+0x80/0xa0 [ 409.820074][ T8743] ? sock_poll+0x3e0/0x3e0 [ 409.824814][ T8743] __se_sys_ioctl+0xfd/0x170 [ 409.829478][ T8743] do_syscall_64+0x55/0xa0 [ 409.833940][ T8743] ? clear_bhb_loop+0x40/0x90 [ 409.838681][ T8743] ? clear_bhb_loop+0x40/0x90 [ 409.843383][ T8743] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 409.849384][ T8743] RIP: 0033:0x7f312c59c799 [ 409.853813][ T8743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 409.873524][ T8743] RSP: 002b:00007f312d407028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 409.882213][ T8743] RAX: ffffffffffffffda RBX: 00007f312c815fa0 RCX: 00007f312c59c799 [ 409.890197][ T8743] RDX: 0000200000000000 RSI: 0000000000008b06 RDI: 0000000000000004 [ 409.898264][ T8743] RBP: 00007f312c632c99 R08: 0000000000000000 R09: 0000000000000000 [ 409.906326][ T8743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 409.914314][ T8743] R13: 00007f312c816038 R14: 00007f312c815fa0 R15: 00007ffc5526a908 [ 409.922349][ T8743] [ 409.925777][ T8743] Kernel Offset: disabled [ 409.930238][ T8743] Rebooting in 86400 seconds..