last executing test programs: 1m17.596798298s ago: executing program 2 (id=85): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, 0x0, 0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x3) r3 = eventfd(0x71f1) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0xf006, 0x8000000, 0x0, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x7c, 0x3000, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000003c0)={0xb03, 0x3000, 0x0, r2, 0x4}) 1m17.374948488s ago: executing program 2 (id=87): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) ftruncate(r0, 0xff) 1m17.141029309s ago: executing program 2 (id=89): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000700)='mountinfo\x00') r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x8000, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x826, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) 1m16.835431693s ago: executing program 2 (id=90): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000000, 0x31, 0xffffffffffffffff, 0x0) close(0x3) 1m16.791201125s ago: executing program 2 (id=91): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 1m16.580088305s ago: executing program 2 (id=93): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f00000001c0)=0xe, 0x4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) 1m1.384372399s ago: executing program 32 (id=93): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f00000001c0)=0xe, 0x4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) 27.127545526s ago: executing program 1 (id=396): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x41000, 0x8, 0x9, 0x3, 0xe4, 0x40, 0x2d, 0x0, 0x30, 0x19}, {0x41000, 0x3000, 0xe, 0xfc, 0x40, 0x5, 0x7d, 0x9, 0x58, 0x3, 0x3}, {0xdddd1000, 0xe000, 0xb, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x1, 0xab, 0x5, 0x81}, {0xdddd0000, 0xffff1000, 0x3, 0x5d, 0x4, 0x43, 0x9, 0xfa, 0x80, 0x81, 0xe, 0x4}, {0xdddd0000, 0x9000, 0xe, 0x1, 0x3, 0x7, 0xab, 0x7f, 0x47, 0x83, 0xf7, 0x82}, {0x1000, 0x80a0000, 0x8, 0xa0, 0xb5, 0x8, 0x1, 0xd, 0x88, 0xf, 0x1, 0xfd}, {0x54000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x7e, 0xff, 0x70}, {0xd000, 0xb000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x16, 0x2, 0x3, 0x7, 0x9}, {0xb000, 0x2d}, {0x10000, 0x3ff}, 0x80000031, 0x0, 0x6000, 0x42024, 0xb, 0x9501, 0x3000, [0x6840000000000002, 0x3, 0x91, 0xff]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000001b00)=[@textreal={0x8, 0x0}], 0x1, 0xe, 0x0, 0x0) 26.803675452s ago: executing program 1 (id=398): io_destroy(0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3017d000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) arch_prctl$ARCH_REQ_XCOMP_PERM(0x1023, 0xd) 25.515476132s ago: executing program 1 (id=405): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x440, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000001100)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) preadv(r0, &(0x7f0000001040)=[{&(0x7f0000000040)=""/4096, 0x1000}], 0x1, 0x6, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x100000a, 0x4082172, 0xffffffffffffffff, 0x0) 25.34149208s ago: executing program 1 (id=407): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000440)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') 25.115142671s ago: executing program 1 (id=410): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af9219a1e18c488e827c1bbec", 0x89}], 0x1}, 0x0) 24.575534336s ago: executing program 1 (id=414): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000000)="ea", 0x1) write(r1, &(0x7f00000002c0)="04", 0x1) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000040)='w', 0x1}], 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) 24.194577354s ago: executing program 33 (id=414): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000000)="ea", 0x1) write(r1, &(0x7f00000002c0)="04", 0x1) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000040)='w', 0x1}], 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) 3.332720233s ago: executing program 5 (id=545): r0 = inotify_init() r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140)) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r2, 0x0, 0x2, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000400)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "15bdb7", 0x14, 0x6, 0x0, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {[], {{0x4e24, 0x4e22, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x2, 0x6, 0x0, 0x2}}}}}}}, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) 2.867278335s ago: executing program 5 (id=551): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x10, 0x0, &(0x7f0000000300)=[@request_death={0x400c630e, 0x3}], 0x0, 0x0, 0x0}) 2.661827055s ago: executing program 5 (id=552): socket$packet(0x11, 0xa, 0x300) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a6c000000060a0b040000000000000000020000004000048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000150900010073797a30000000000900020073797a320000000014000000110001"], 0x94}, 0x1, 0x0, 0x0, 0x40801}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000080), &(0x7f0000000100)=0x4) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 2.471483374s ago: executing program 5 (id=554): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000001c0)={'#! ', './file1'}, 0xb) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ppoll(0x0, 0x0, 0x0, &(0x7f0000000180)={[0xffffffffffffff68]}, 0x8) setresuid(0x0, 0xee01, 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 2.415452527s ago: executing program 3 (id=555): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = fanotify_init(0x20, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = dup(r2) fanotify_mark(r1, 0x201, 0x20, r3, 0x0) r4 = fanotify_init(0x20, 0x0) r5 = fcntl$dupfd(r3, 0x0, r3) fanotify_mark(r4, 0x441, 0x1002, r5, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.251536604s ago: executing program 3 (id=557): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) openat$fault_inject(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/failslab/space\x00', 0x1, 0x0) socket(0x2, 0x3, 0x6) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 1.936905339s ago: executing program 4 (id=558): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/afs/cells\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='add testcell 127.0.0.1\n\x00', 0x17) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt\x00', 0x1ff) mount(&(0x7f0000000600)=@filename='%testcell:vol\x00', &(0x7f0000000500)='./mnt\x00', &(0x7f0000000700)='afs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/afs/testcell/volumes\x00', 0x0, 0x0) read(r1, &(0x7f0000000900)=""/4096, 0x1000) 1.936575979s ago: executing program 3 (id=559): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)={0x68, r1, 0x5, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x50}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}]}]}, 0x68}}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000a00)={0x8c, r1, 0x5, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x50}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x50}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}]}]}, 0x8c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @dest_unreach={0x1, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, '\x00', 0x8, 0x6, 0xff, @local, @remote, [], '\x00P\x00P\x00\x00\x00\x00'}}}}}}}, 0x0) 1.782150016s ago: executing program 4 (id=561): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000001bc0)=ANY=[@ANYBLOB="1500000065ffff097b00000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) openat$pidfd(0xffffffffffffff9c, 0x0, 0x18000, 0x0) truncate(&(0x7f0000001c00)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x42d9) 1.768538087s ago: executing program 3 (id=562): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x4080000) openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file4\x00', &(0x7f0000000380)={0x8a001, 0x0, 0x12}, 0x18) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file4\x00', 0x0, 0x0) 1.683347691s ago: executing program 0 (id=563): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440), 0x10) listen(r0, 0xfffffffe) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) writev(r1, &(0x7f0000000240)=[{&(0x7f0000000580)="b60c5cdb42ced9ad862e687a9e21ee2a6ffc2dfbb4f6e67ff9a4a64db2750cb9806f34f1a5765925076a7815f15d70104afa7803b60abdd9f31d2eb87cc31334cc6537e03c76194ecfba64111a9758f20a14a4c8e468e93c55f2ef3c8fdd0746672d2eaba284c87fa4efc58cdfaa", 0x6e}], 0x1) r2 = accept4$unix(r0, 0x0, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) recvmmsg(r2, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000017c0)=""/110, 0x6e}], 0x1}}], 0x1, 0x2, 0x0) 1.615793724s ago: executing program 0 (id=564): bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x240448c8) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x2000c044) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000100000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x10000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}], {0x14}}, 0x50}, 0x1, 0x0, 0x0, 0x4c841}, 0x802) 1.538220568s ago: executing program 4 (id=565): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="040e1b04130c"], 0x7) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) read$msr(0xffffffffffffffff, &(0x7f0000032680)=""/102392, 0x18ff8) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000340)=ANY=[], 0x27) write(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) 1.443461272s ago: executing program 5 (id=566): socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000900)={0x2, 0x5, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x61e5cc96}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x6bb, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20082f5}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000040)="39000000130003474cbb65e1c3e4ffff06000d0001000000", 0x18}], 0x1) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1.389021904s ago: executing program 4 (id=567): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x10) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x119f, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x1, 0x1}}, 0x40) 1.364520166s ago: executing program 0 (id=568): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x788}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) ppoll(&(0x7f0000000000)=[{r3, 0x2000}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f00000000c0)={[0x800, 0xfffffffffffffffd, 0x81, 0x4, 0x8, 0x0, 0x7, 0x12, 0x400, 0x2, 0xfffffffffffffffc, 0x7, 0x6, 0x6, 0x100000000001], 0x8000000, 0x4fb40}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.211902853s ago: executing program 3 (id=569): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) 1.156969166s ago: executing program 0 (id=570): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000040), 0x900, 0x0) ioctl$SNDCTL_DSP_STEREO(r0, 0xc0045003, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f00000004c0)='\n', 0x1) 1.143696936s ago: executing program 4 (id=571): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x1, 0xc000, 0x6, 0x3, 0x5, 0x8, 0x3, 0x6, 0x8, 0x6, 0xc5, 0x5, 0x5}, {0x64, 0x0, 0x5, 0x27, 0x7, 0x0, 0x4, 0xf7, 0x3, 0x4, 0x6, 0xed, 0x20c}, {0x0, 0x7, 0x38, 0x83, 0x84, 0x5, 0x3, 0x7f, 0xc, 0x2, 0x4, 0x9, 0x6}], 0xe0000003}) syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x2, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x8, 0x61, 0x200002000004, 0x1, 0xff, 0x0, 0x0, 0xf, 0x5, 0x6, 0x3, 0x9, 0x6, 0xf73c], 0x80a0000, 0x40}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 134.212134ms ago: executing program 0 (id=572): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x8001, @empty, 0xffffff5d}, 0x1c) listen(r0, 0x50) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e23, 0x5, @empty, 0x4}, 0x1c) listen(r1, 0x50) listen(r1, 0x0) 132.826154ms ago: executing program 3 (id=573): mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e75"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@aname={'aname', 0x3d, 'trans=fd,'}}], [], 0x6b}}) syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x20a1, &(0x7f0000000200)={[{@bsdgroups}, {@nodelalloc}, {@nogrpid}, {@noblock_validity}, {@dax_inode}, {@prjquota}]}, 0x1, 0x654, &(0x7f0000000ec0)="$eJzs3c9rHNcdAPDvrFa/3a5sSlv3UIuWYkNryZLtYkrB1qUnY9wft55USzau15axVBo5hkjgXAIhlxwCOeUQ579IDLnmkGsOuQQCIWBC8CEOTrxhZmfl/aGVVpZWK0ufD6w0s2/3vTdC331v3r43E8CBNZ7+KEQcjYjbSUSpLq0YeeJ49XWPv713JX0kUan885sk7r2WrNTnleS/R/M3/1iK5NNCxJG+1nIXl+/emC2X5+/k+5NLN29PLi7fPXn95uy1+Wvzt6b/PH3u7Jmz56ZObev48qJ/SH9cvP/f/5feuPTv9999mkx98PmlJC7Es/wF6XE1v3dwWyWnf7PxqFQ9aUgoRJzbZt57xXel2v9JZjD9h0iKvawRW1GIiPMR0R8Rv4pS9MXzYC3F63/vaeWArqokkbVR4xXg4EmibdL1ofxDotVQV+sE7IZaP6B2bt9wHpysndI3KXS/YwJ03aOZ6lhdNfb7I6IW/8Xq2GAMZWMDI4+T+nGe7INheyNzVWkZn3x86X76iDbjcEB3rKzWRrmb2/8ki82xqJ4DjDwuNMT/TN4LKOTfE/yjOeMOB8/Hm/bFP+yeldWI+HXe/g9Ex/FfyGO3Fv//eZ40tJXyxT8AAAAAAADsnIczEfGnxvl/h/K02vyfgXXm/4xGxIUdKH/z7//Wvk5sMxcReFGPZiL+uu7837U5vmN9+d7PsvkA/cnV6+X5UxHx84g4Ef2D6f5UU771M4RPvnnknXbl18//Sx9p+bW5gHlOXxeb5hLNzS7Nbve4gYhHqxG/yeb/HsufaZz/k7a/yTrtfxrftzss48gfHlxul7Z5/APdUnkv4vi67f/z7nay8fU5JrP+wGStV9Dqt6++9WG78sU/9E7a/o9sHP+DSf31eha3lv9ARJxeLlbapW8Y/9mp//r9/4HkX321/FOvzC4t3ZmKGEgutj4/3VquwQQOolo81OIljf8Tv1///L+l/18Xh8MRsdJhmb98NvpFuzTtP/ROGv9zG7f/pcb2f+sb0w/GPmpX/uWOxv/OZG36ifwZ439Qr/V6HJ0GaE+qCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvuUJEHIqkMLG2XShMTESMRsQvYqRQXlhc+uPVhf/dmkvTsvv/F2p3+i1V95Pa/f/H6vanm/ZPR8ThiHi7bzjbn7iyUJ7r9cEDAAAAAAAAAAAAAAAAAADAHjGarfmvDDav/0991dfr2gFdV8x/byHei92qC7C7XjyYK4M7WhFg12nM4WBa3VL893e1LsDua4z/+hh/8rSSaXrD3363K/UCuk//Hw6uF4x/Xw/CPtAu/g3uw37X4ZjeULfrAfSC838AAAAAANhXDh97+FkSESt/Gc4eqYE8bbinNQO6rdDrCgA9Yw4vHFzFhV7XAOgVC/qBZG3r++bF/pn2s/+T7lQIAAAAAAAAAAAAAGhx/Gj79f/WBsD+tvH6f3P7YT/bYP3/esHvcgGwj7S/9Ye2H/Y75/jAZq299f8AAAAAAAAAAAAAsAcM3b0xWy7P31lcfvk2zu+NamxtY2V2e/lUBvfCUTRuPOtOzv0RsTcOcAc20mArl+crlYjNX1y7BEcP69zJh8eXA139bAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADI/BQAA//9HHyBd") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) 87.107516ms ago: executing program 5 (id=574): r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000840)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3b8, 0x0, 0x98, 0x130, 0x1c8, 0x288, 0x0, 0x98, 0x130, 0x288, 0x320, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@inet=@length={{0x28}, {0x0, 0xffff}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x1, 0xffffffff}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x450) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0xe2e4e67761683fba}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x10000000) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd0}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x54, r3, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x7530, @local}}, {0x14, 0x2, @in={0x2, 0x7530, @remote}}}}]}]}, 0x54}}, 0x0) 69.591077ms ago: executing program 4 (id=575): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x20e8a1, 0x1c881, 0x8, 0xd1}) r1 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x5ecf, 0xc000, 0x7, 0x20002f6}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5c8c, 0x0, @empty, @mcast1, 0x80, 0x0, 0x0, 0x20000000}}) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x2d, 0x0, 0x1f, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x4) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) rt_sigqueueinfo(0x0, 0x38, &(0x7f0000000240)={0x20, 0x523}) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 0s ago: executing program 0 (id=576): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1, 0x4, 0x8, 0xc, 0x40, 0xffffffffffffffff, 0xffffffff}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200000100000085000000a0"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.69' (ED25519) to the list of known hosts. [ 73.306801][ T5760] cgroup: Unknown subsys name 'net' [ 73.442514][ T5760] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.776208][ T5760] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.225869][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.227366][ T5777] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.234896][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.249719][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.257412][ T5777] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.257706][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.273203][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.276955][ T5777] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.280989][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.295527][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.299229][ T5784] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.310966][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.310980][ T5784] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.311859][ T5784] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.318668][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.326693][ T5784] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.332677][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.339694][ T5784] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.346955][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.368387][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.378222][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.378982][ T5784] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.394566][ T51] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 76.405522][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.807206][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 76.827324][ T5782] chnl_net:caif_netlink_parms(): no params data found [ 76.911667][ T5778] chnl_net:caif_netlink_parms(): no params data found [ 76.958648][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 77.027977][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.036145][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.043652][ T5782] bridge_slave_0: entered allmulticast mode [ 77.050672][ T5782] bridge_slave_0: entered promiscuous mode [ 77.090716][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.098156][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.105320][ T5782] bridge_slave_1: entered allmulticast mode [ 77.112752][ T5782] bridge_slave_1: entered promiscuous mode [ 77.120125][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.128128][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.135255][ T5772] bridge_slave_0: entered allmulticast mode [ 77.143782][ T5772] bridge_slave_0: entered promiscuous mode [ 77.198017][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.205246][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.214917][ T5772] bridge_slave_1: entered allmulticast mode [ 77.221757][ T5772] bridge_slave_1: entered promiscuous mode [ 77.228657][ T5778] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.235743][ T5778] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.243015][ T5778] bridge_slave_0: entered allmulticast mode [ 77.249753][ T5778] bridge_slave_0: entered promiscuous mode [ 77.258541][ T5778] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.265711][ T5778] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.272989][ T5778] bridge_slave_1: entered allmulticast mode [ 77.279743][ T5778] bridge_slave_1: entered promiscuous mode [ 77.297039][ T5782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.344965][ T5782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.378356][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.385530][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.393508][ T5774] bridge_slave_0: entered allmulticast mode [ 77.400286][ T5774] bridge_slave_0: entered promiscuous mode [ 77.408615][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.415699][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.422961][ T5774] bridge_slave_1: entered allmulticast mode [ 77.429807][ T5774] bridge_slave_1: entered promiscuous mode [ 77.438954][ T5778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.461575][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.472611][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.493784][ T5778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.512969][ T5782] team0: Port device team_slave_0 added [ 77.550151][ T5782] team0: Port device team_slave_1 added [ 77.577785][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.589648][ T5778] team0: Port device team_slave_0 added [ 77.608761][ T5772] team0: Port device team_slave_0 added [ 77.615489][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.622777][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.649176][ T5782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.663007][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.685316][ T5778] team0: Port device team_slave_1 added [ 77.704235][ T5772] team0: Port device team_slave_1 added [ 77.722381][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.729555][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.755504][ T5782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.808445][ T5774] team0: Port device team_slave_0 added [ 77.814902][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.822068][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.848202][ T5778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.860835][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.867853][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.893867][ T5778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.905671][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.912762][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.946399][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.973048][ T5774] team0: Port device team_slave_1 added [ 77.988566][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.995560][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.022151][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.052425][ T5782] hsr_slave_0: entered promiscuous mode [ 78.059190][ T5782] hsr_slave_1: entered promiscuous mode [ 78.084123][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.091340][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.117370][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.142530][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.150173][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.176439][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.228052][ T5772] hsr_slave_0: entered promiscuous mode [ 78.234501][ T5772] hsr_slave_1: entered promiscuous mode [ 78.241127][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.249016][ T5772] Cannot create hsr debugfs directory [ 78.298259][ T5778] hsr_slave_0: entered promiscuous mode [ 78.304397][ T5778] hsr_slave_1: entered promiscuous mode [ 78.310879][ T5778] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.318522][ T5778] Cannot create hsr debugfs directory [ 78.369690][ T5774] hsr_slave_0: entered promiscuous mode [ 78.375934][ T5774] hsr_slave_1: entered promiscuous mode [ 78.382304][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.390025][ T5774] Cannot create hsr debugfs directory [ 78.406958][ T5784] Bluetooth: hci0: command tx timeout [ 78.412662][ T5784] Bluetooth: hci2: command tx timeout [ 78.486309][ T51] Bluetooth: hci1: command tx timeout [ 78.491940][ T5784] Bluetooth: hci3: command tx timeout [ 78.746886][ T5782] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.759894][ T5782] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.771512][ T5782] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.781935][ T5782] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.861253][ T5772] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.883199][ T5772] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.901289][ T5772] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.912315][ T5772] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.962569][ T5778] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.989199][ T5778] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.001047][ T5778] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.011349][ T5778] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.074047][ T5774] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 79.085639][ T5774] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 79.108532][ T5774] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 79.118942][ T5774] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.161279][ T5782] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.217940][ T5782] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.254063][ T3453] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.261452][ T3453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.271873][ T3453] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.278992][ T3453] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.317200][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.394893][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.412860][ T5778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.453168][ T3475] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.460430][ T3475] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.474824][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.482015][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.514131][ T5778] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.542209][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.569460][ T3488] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.576692][ T3488] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.589816][ T3488] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.597010][ T3488] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.643491][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.730158][ T3475] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.737365][ T3475] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.799049][ T3453] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.806236][ T3453] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.858819][ T5782] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.017374][ T5782] veth0_vlan: entered promiscuous mode [ 80.041451][ T5782] veth1_vlan: entered promiscuous mode [ 80.133972][ T5782] veth0_macvtap: entered promiscuous mode [ 80.162024][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.189583][ T5782] veth1_macvtap: entered promiscuous mode [ 80.245074][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.303592][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.334041][ T5782] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.343853][ T5782] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.353227][ T5782] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.362204][ T5782] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.385537][ T5778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.395788][ T5772] veth0_vlan: entered promiscuous mode [ 80.434881][ T5772] veth1_vlan: entered promiscuous mode [ 80.465131][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.487028][ T51] Bluetooth: hci0: command tx timeout [ 80.496872][ T5784] Bluetooth: hci2: command tx timeout [ 80.527078][ T5778] veth0_vlan: entered promiscuous mode [ 80.566633][ T5784] Bluetooth: hci3: command tx timeout [ 80.572066][ T51] Bluetooth: hci1: command tx timeout [ 80.584409][ T5778] veth1_vlan: entered promiscuous mode [ 80.614931][ T3453] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.639198][ T3453] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.669714][ T5774] veth0_vlan: entered promiscuous mode [ 80.711732][ T5772] veth0_macvtap: entered promiscuous mode [ 80.712315][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.725000][ T5772] veth1_macvtap: entered promiscuous mode [ 80.732260][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.742378][ T5774] veth1_vlan: entered promiscuous mode [ 80.769351][ T5778] veth0_macvtap: entered promiscuous mode [ 80.781567][ T5778] veth1_macvtap: entered promiscuous mode [ 80.824100][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.837023][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.849981][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.874693][ T5774] veth0_macvtap: entered promiscuous mode [ 80.908939][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.926594][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.950411][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.964123][ T5772] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.974417][ T5772] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.983652][ T5772] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.994186][ T5772] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.019875][ T5774] veth1_macvtap: entered promiscuous mode [ 81.040834][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.067008][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.078813][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.089609][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.102311][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.133607][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.146743][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.164879][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.175574][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.188809][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.222757][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.234489][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.244551][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.255203][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.265067][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.275756][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.289139][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.299170][ T5778] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.308539][ T5778] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.320083][ T5778] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.331533][ T5778] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.352167][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.363121][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.374268][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.386065][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.395903][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.407589][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.418942][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.447800][ T5774] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.457543][ T5774] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.476155][ T5774] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.484967][ T5774] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.582032][ T3453] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.600615][ T3453] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.697708][ T3475] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.705579][ T3475] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.803051][ T3475] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.834066][ T3475] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.910094][ T1000] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.944739][ T1000] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.020572][ T3453] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.055899][ T3453] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.138287][ T3475] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.156076][ T3475] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.569704][ T51] Bluetooth: hci2: command tx timeout [ 82.575235][ T51] Bluetooth: hci0: command tx timeout [ 82.646149][ T51] Bluetooth: hci1: command tx timeout [ 82.651682][ T5784] Bluetooth: hci3: command tx timeout [ 82.724461][ T5865] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 82.796284][ T5865] syz.3.4[5865]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 82.824406][ T5865] loop3: detected capacity change from 0 to 512 [ 82.891066][ T5865] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 82.934864][ T5865] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 82.951770][ T5872] FAULT_INJECTION: forcing a failure. [ 82.951770][ T5872] name failslab, interval 1, probability 0, space 0, times 1 [ 82.981286][ T5865] EXT4-fs error (device loop3): ext4_init_orphan_info:623: comm syz.3.4: orphan file block 0: bad magic [ 83.026335][ T5872] CPU: 1 PID: 5872 Comm: syz.0.12 Not tainted syzkaller #0 [ 83.033600][ T5872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.043696][ T5872] Call Trace: [ 83.046994][ T5872] [ 83.049954][ T5872] dump_stack_lvl+0x18c/0x250 [ 83.054682][ T5872] ? show_regs_print_info+0x20/0x20 [ 83.059915][ T5872] ? load_image+0x420/0x420 [ 83.064452][ T5872] ? __might_sleep+0xe0/0xe0 [ 83.064765][ T5865] EXT4-fs (loop3): Remounting filesystem read-only [ 83.069054][ T5872] ? __lock_acquire+0x7d80/0x7d80 [ 83.069085][ T5872] should_fail_ex+0x394/0x4c0 [ 83.069115][ T5872] should_failslab+0x9/0x20 [ 83.089836][ T5872] slab_pre_alloc_hook+0x59/0x300 [ 83.094901][ T5872] ? blk_alloc_queue_stats+0x4c/0xf0 [ 83.100221][ T5872] __kmem_cache_alloc_node+0x53/0x250 [ 83.105640][ T5872] ? blk_alloc_queue_stats+0x4c/0xf0 [ 83.110958][ T5872] kmalloc_trace+0x2a/0xe0 [ 83.115403][ T5872] blk_alloc_queue_stats+0x4c/0xf0 [ 83.120547][ T5872] blk_alloc_queue+0xab/0x4c0 [ 83.125258][ T5872] __blk_mq_alloc_disk+0x47/0x190 [ 83.127055][ T5865] EXT4-fs (loop3): mount failed [ 83.130285][ T5872] ? loop_add+0x2f7/0x990 [ 83.139484][ T5872] loop_add+0x322/0x990 [ 83.143686][ T5872] loop_control_ioctl+0x128/0x590 [ 83.148743][ T5872] ? loop_set_hw_queue_depth+0x110/0x110 [ 83.154411][ T5872] ? bpf_lsm_file_ioctl+0x9/0x10 [ 83.159382][ T5872] ? security_file_ioctl+0x80/0xa0 [ 83.164520][ T5872] ? loop_set_hw_queue_depth+0x110/0x110 [ 83.170177][ T5872] __se_sys_ioctl+0xfd/0x170 [ 83.174806][ T5872] do_syscall_64+0x55/0xb0 [ 83.179259][ T5872] ? clear_bhb_loop+0x40/0x90 [ 83.183976][ T5872] ? clear_bhb_loop+0x40/0x90 [ 83.188683][ T5872] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 83.194605][ T5872] RIP: 0033:0x7f5c6b19e159 [ 83.199053][ T5872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.218685][ T5872] RSP: 002b:00007f5c6c0dc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 83.227146][ T5872] RAX: ffffffffffffffda RBX: 00007f5c6b425fa0 RCX: 00007f5c6b19e159 [ 83.227627][ T5877] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15'. [ 83.235124][ T5872] RDX: 00000000ffffffe4 RSI: 0000000000004c80 RDI: 0000000000000004 [ 83.235141][ T5872] RBP: 00007f5c6b23506b R08: 0000000000000000 R09: 0000000000000000 [ 83.235152][ T5872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.235163][ T5872] R13: 00007f5c6b426038 R14: 00007f5c6b425fa0 R15: 00007ffdf58354f8 [ 83.235190][ T5872] [ 83.353254][ T5877] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15'. [ 83.712620][ T5890] loop2: detected capacity change from 0 to 1024 [ 83.757689][ T5890] EXT4-fs (loop2): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 83.816776][ T5890] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 83.999897][ T5782] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.013727][ T5903] loop0: detected capacity change from 0 to 256 [ 84.027232][ T5903] exfat: Deprecated parameter 'utf8' [ 84.032847][ T5903] exfat: Deprecated parameter 'namecase' [ 84.038904][ T5903] exfat: Deprecated parameter 'utf8' [ 84.090136][ T5903] exFAT-fs (loop0): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 84.213745][ T28] audit: type=1800 audit(1789613200.742:2): pid=5903 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.24" name="file1" dev="loop0" ino=1048594 res=0 errno=0 [ 84.647083][ T51] Bluetooth: hci0: command tx timeout [ 84.652583][ T5784] Bluetooth: hci2: command tx timeout [ 84.686691][ T5908] loop2: detected capacity change from 0 to 32768 [ 84.726654][ T5784] Bluetooth: hci3: command tx timeout [ 84.732171][ T51] Bluetooth: hci1: command tx timeout [ 84.762199][ T5908] XFS (loop2): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 84.879929][ T5908] XFS (loop2): Ending clean mount [ 84.995591][ T28] audit: type=1800 audit(1789613201.522:3): pid=5908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.26" name="file1" dev="loop2" ino=6150 res=0 errno=0 [ 85.045462][ T5908] XFS (loop2): WARNING: Reset corrupted AGFL on AG 0. 1 blocks leaked. Please unmount and run xfs_repair. [ 85.245613][ T5929] XFS (loop2): User initiated shutdown received. [ 85.287881][ T23] IPVS: starting estimator thread 0... [ 85.302529][ T5929] XFS (loop2): Log I/O Error (0x6) detected at xfs_fs_goingdown+0x71/0x150 (fs/xfs/xfs_fsops.c:501). Shutting down filesystem. [ 85.349477][ T5929] XFS (loop2): Please unmount the filesystem and rectify the problem(s) [ 85.417854][ T5932] IPVS: using max 22 ests per chain, 52800 per kthread [ 85.479084][ T5908] syz.2.26 (5908) used greatest stack depth: 20008 bytes left [ 85.502754][ T5936] loop0: detected capacity change from 0 to 8 [ 85.566506][ T5937] ======================================================= [ 85.566506][ T5937] WARNING: The mand mount option has been deprecated and [ 85.566506][ T5937] and is ignored by this kernel. Remove the mand [ 85.566506][ T5937] option from the mount to silence this warning. [ 85.566506][ T5937] ======================================================= [ 85.611744][ T5936] process 'syz.0.33' launched './file0' with NULL argv: empty string added [ 85.622315][ T5782] XFS (loop2): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 86.285359][ T5955] loop1: detected capacity change from 0 to 1024 [ 86.332542][ T5955] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 86.410433][ T5958] loop2: detected capacity change from 0 to 128 [ 86.424265][ T5955] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 86.475460][ T5958] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 86.732109][ T5955] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 44 with max blocks 4 with error 28 [ 86.751383][ T5955] EXT4-fs (loop1): This should not happen!! Data will be lost [ 86.751383][ T5955] [ 86.762934][ T5955] EXT4-fs (loop1): Total free blocks count 0 [ 86.781694][ T5955] EXT4-fs (loop1): Free/Dirty block details [ 86.813059][ T5955] EXT4-fs (loop1): free_blocks=0 [ 86.828703][ T5955] EXT4-fs (loop1): dirty_blocks=0 [ 86.837371][ T5955] EXT4-fs (loop1): Block reservation details [ 86.848917][ T5955] EXT4-fs (loop1): i_reserved_data_blocks=0 [ 86.964732][ T5774] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 86.982897][ T787] cfg80211: failed to load regulatory.db [ 87.125716][ T5968] loop1: detected capacity change from 0 to 128 [ 87.199263][ T5968] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 87.273408][ T5968] ext4 filesystem being mounted at /7/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 87.399187][ T5968] EXT4-fs (loop1): shut down requested (2) [ 87.475382][ T5774] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 87.663624][ T5976] FAULT_INJECTION: forcing a failure. [ 87.663624][ T5976] name failslab, interval 1, probability 0, space 0, times 0 [ 87.696583][ T5976] CPU: 0 PID: 5976 Comm: syz.2.47 Not tainted syzkaller #0 [ 87.703858][ T5976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.713971][ T5976] Call Trace: [ 87.717279][ T5976] [ 87.720233][ T5976] dump_stack_lvl+0x18c/0x250 [ 87.724953][ T5976] ? show_regs_print_info+0x20/0x20 [ 87.730198][ T5976] ? load_image+0x420/0x420 [ 87.734736][ T5976] ? __might_sleep+0xe0/0xe0 [ 87.739354][ T5976] ? __lock_acquire+0x7d80/0x7d80 [ 87.744410][ T5976] ? unwind_get_return_address+0x91/0xc0 [ 87.750065][ T5976] ? stack_trace_save+0x100/0x100 [ 87.755124][ T5976] should_fail_ex+0x394/0x4c0 [ 87.759838][ T5976] should_failslab+0x9/0x20 [ 87.764379][ T5976] slab_pre_alloc_hook+0x59/0x300 [ 87.766439][ T5981] netlink: 24 bytes leftover after parsing attributes in process `syz.0.48'. [ 87.769421][ T5976] ? stack_trace_save+0xaa/0x100 [ 87.783147][ T5976] ? tomoyo_init_log+0x196/0x1f50 [ 87.788211][ T5976] __kmem_cache_alloc_node+0x53/0x250 [ 87.793628][ T5976] ? tomoyo_init_log+0x196/0x1f50 [ 87.798684][ T5976] kmalloc_trace+0x2a/0xe0 [ 87.803124][ T5976] tomoyo_init_log+0x196/0x1f50 [ 87.807978][ T5976] ? __kmem_cache_free+0xba/0x1f0 [ 87.813005][ T5976] ? tomoyo_realpath_from_path+0x587/0x5c0 [ 87.818807][ T5976] ? tomoyo_path_number_perm+0x248/0x5e0 [ 87.824441][ T5976] ? __se_sys_ioctl+0x48/0x170 [ 87.829209][ T5976] ? do_syscall_64+0x55/0xb0 [ 87.833803][ T5976] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.839875][ T5976] ? format_decode+0x19b/0x1400 [ 87.844730][ T5976] ? print_ipv6_addr+0x100/0x100 [ 87.849677][ T5976] ? tomoyo_profile+0x11/0x50 [ 87.854364][ T5976] ? tomoyo_domain_quota_is_ok+0x422/0x570 [ 87.860173][ T5976] tomoyo_supervisor+0x363/0x1100 [ 87.865205][ T5976] ? tomoyo_profile+0x50/0x50 [ 87.869887][ T5976] ? snprintf+0xe9/0x140 [ 87.874130][ T5976] ? vscnprintf+0x80/0x80 [ 87.878456][ T5976] ? tomoyo_check_acl+0x37c/0x3f0 [ 87.883484][ T5976] tomoyo_path_number_perm+0x460/0x5e0 [ 87.888943][ T5976] ? tomoyo_path_number_perm+0x217/0x5e0 [ 87.894574][ T5976] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 87.900058][ T5976] ? __fget_files+0x28/0x460 [ 87.904657][ T5976] security_file_ioctl+0x70/0xa0 [ 87.909601][ T5976] __se_sys_ioctl+0x48/0x170 [ 87.914196][ T5976] do_syscall_64+0x55/0xb0 [ 87.918615][ T5976] ? clear_bhb_loop+0x40/0x90 [ 87.923294][ T5976] ? clear_bhb_loop+0x40/0x90 [ 87.927968][ T5976] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.933863][ T5976] RIP: 0033:0x7fdca0f9e159 [ 87.938290][ T5976] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.957904][ T5976] RSP: 002b:00007fdca1d96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 87.966320][ T5976] RAX: ffffffffffffffda RBX: 00007fdca1225fa0 RCX: 00007fdca0f9e159 [ 87.974297][ T5976] RDX: 0000000000000000 RSI: 0000000080046108 RDI: 0000000000000004 [ 87.982262][ T5976] RBP: 00007fdca103506b R08: 0000000000000000 R09: 0000000000000000 [ 87.990227][ T5976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.998193][ T5976] R13: 00007fdca1226038 R14: 00007fdca1225fa0 R15: 00007fff4078cea8 [ 88.006180][ T5976] [ 88.395918][ T5993] loop3: detected capacity change from 0 to 16 [ 88.436152][ T5993] erofs: (device loop3): mounted with root inode @ nid 36. [ 88.436258][ T5995] syz.2.55 uses obsolete (PF_INET,SOCK_PACKET) [ 88.666372][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 88.876554][ T9] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 88.893771][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.910710][ T9] usb 2-1: Product: syz [ 88.914923][ T9] usb 2-1: Manufacturer: syz [ 88.929889][ T9] usb 2-1: SerialNumber: syz [ 89.074856][ T6009] loop0: detected capacity change from 0 to 256 [ 89.161536][ T6009] exFAT-fs (loop0): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 89.513078][ T6018] xt_recent: hitcount (32769) is larger than allowed maximum (255) [ 89.538313][ T9] rtl8150 2-1:1.0: couldn't reset the device [ 89.551540][ T9] rtl8150: probe of 2-1:1.0 failed with error -5 [ 89.568705][ T9] usb 2-1: USB disconnect, device number 2 [ 89.656350][ T5762] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 89.867987][ T5762] usb 1-1: config 14 has an invalid interface number: 217 but max is 0 [ 89.896045][ T5762] usb 1-1: config 14 contains an unexpected descriptor of type 0x1, skipping [ 89.904872][ T5762] usb 1-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 89.917941][ T5762] usb 1-1: config 14 has 2 interfaces, different from the descriptor's value: 1 [ 89.946111][ T5762] usb 1-1: config 14 has no interface number 1 [ 89.952365][ T5762] usb 1-1: config 14 interface 217 has no altsetting 0 [ 89.978464][ T5762] usb 1-1: New USB device found, idVendor=0421, idProduct=0070, bcdDevice=46.26 [ 89.996666][ T5762] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.004705][ T5762] usb 1-1: Product: syz [ 90.017350][ T5762] usb 1-1: Manufacturer: syz [ 90.022742][ T5762] usb 1-1: SerialNumber: syz [ 90.294697][ T5762] rndis_wlan 1-1:14.217: skipping garbage [ 90.312584][ T5762] usb 1-1: bad CDC descriptors [ 90.322501][ T6026] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 90.362907][ T5762] rndis_host 1-1:14.217: skipping garbage [ 90.380387][ T5762] usb 1-1: bad CDC descriptors [ 90.385705][ T5762] cdc_acm 1-1:14.217: skipping garbage [ 90.433297][ T5762] usb 1-1: USB disconnect, device number 2 [ 91.100142][ T6039] netlink: 'syz.2.73': attribute type 11 has an invalid length. [ 91.246113][ T5856] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 91.267929][ T6044] loop0: detected capacity change from 0 to 16 [ 91.442842][ T6044] syzkaller0: entered promiscuous mode [ 91.449867][ T5856] usb 4-1: Using ep0 maxpacket: 32 [ 91.481798][ T5856] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 91.495407][ T6044] syzkaller0: entered allmulticast mode [ 91.502624][ T5856] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 91.552950][ T5856] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 91.638110][ T5856] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 91.666111][ T5856] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.701787][ T5856] usb 4-1: config 0 descriptor?? [ 92.206840][ T5856] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0001/input/input5 [ 92.432768][ T5856] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0001/input/input6 [ 92.556693][ T5856] kye 0003:0458:5011.0001: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0458:5011] on usb-dummy_hcd.3-1/input0 [ 93.290491][ T6082] jffs2: notice: (6082) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 93.311385][ C1] kye 0003:0458:5011.0001: usb_submit_urb(ctrl) failed: -1 [ 93.824207][ T6086] loop1: detected capacity change from 0 to 32768 [ 93.853838][ T6086] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.88 (6086) [ 93.927005][ T6086] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 93.947414][ T6086] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 93.966146][ T6086] BTRFS info (device loop1): force clearing of disk cache [ 93.974667][ T6086] BTRFS info (device loop1): force zlib compression, level 3 [ 93.994211][ T6086] BTRFS info (device loop1): enabling auto defrag [ 94.002569][ T6086] BTRFS info (device loop1): max_inline at 0 [ 94.014900][ T6086] BTRFS info (device loop1): using free space tree [ 94.128166][ T6086] BTRFS info (device loop1): enabling ssd optimizations [ 94.135167][ T6086] BTRFS info (device loop1): auto enabling async discard [ 94.151779][ T6086] BTRFS info (device loop1): rebuilding free space tree [ 94.165297][ T5762] usb 4-1: USB disconnect, device number 2 [ 94.419400][ T5774] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 94.948949][ T6124] overlay: ./file0/file1 is not a directory [ 96.476735][ T6139] loop3: detected capacity change from 0 to 32768 [ 96.499520][ T6139] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.101 (6139) [ 96.554528][ T6139] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 96.590226][ T6139] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 96.616606][ T6139] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_LZO (0x8) [ 96.637851][ T6139] BTRFS info (device loop3): use lzo compression, level 0 [ 96.667198][ T6139] BTRFS info (device loop3): turning on flush-on-commit [ 96.684470][ T6139] BTRFS info (device loop3): using free space tree [ 96.833493][ T6139] BTRFS info (device loop3): enabling ssd optimizations [ 97.512987][ T5778] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 98.696158][ T6177] loop3: detected capacity change from 0 to 40427 [ 98.712614][ T6177] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 98.724287][ T6177] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 98.753311][ T6177] F2FS-fs (loop3): Found nat_bits in checkpoint [ 98.826586][ T6177] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 98.836450][ T6177] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 99.372562][ T6189] loop3: detected capacity change from 0 to 32768 [ 99.419017][ T6189] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 99.471646][ T6189] XFS (loop3): Ending clean mount [ 99.504499][ T28] audit: type=1800 audit(1789613216.032:4): pid=6189 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.112" name="file1" dev="loop3" ino=6150 res=0 errno=0 [ 99.541355][ T6189] XFS (loop3): WARNING: Reset corrupted AGFL on AG 0. 1 blocks leaked. Please unmount and run xfs_repair. [ 99.671913][ T6202] XFS (loop3): User initiated shutdown received. [ 99.679537][ T6202] XFS (loop3): Log I/O Error (0x6) detected at xfs_fs_goingdown+0x71/0x150 (fs/xfs/xfs_fsops.c:501). Shutting down filesystem. [ 99.693232][ T6202] XFS (loop3): Please unmount the filesystem and rectify the problem(s) [ 99.786966][ T6206] Bluetooth: MGMT ver 1.22 [ 99.793741][ T5778] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 100.008043][ T6210] capability: warning: `syz.3.115' uses deprecated v2 capabilities in a way that may be insecure [ 100.132809][ T3453] Bluetooth: hci4: Frame reassembly failed (-84) [ 100.457331][ T8] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 100.579774][ T6217] loop1: detected capacity change from 0 to 8192 [ 100.596609][ T6217] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 100.664022][ T8] usb 4-1: config 4 has an invalid interface number: 44 but max is 0 [ 100.676810][ T8] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 100.706189][ T8] usb 4-1: config 4 has no interface number 0 [ 100.719573][ T8] usb 4-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 100.739301][ T8] usb 4-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 100.753814][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.771742][ T8] usb 4-1: Product: syz [ 100.776426][ T8] usb 4-1: Manufacturer: syz [ 100.781095][ T8] usb 4-1: SerialNumber: syz [ 101.202737][ T8] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 101.224981][ T8] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 101.238039][ T8] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 101.249460][ T8] usb 4-1: media controller created [ 101.260230][ T8] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 101.322422][ T8] DVB: Unable to find symbol dib7000p_attach() [ 101.328947][ T8] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 101.417226][ T8] rc_core: IR keymap rc-dib0700-rc5 not found [ 101.428380][ T8] Registered IR keymap rc-empty [ 101.462393][ T8] dvb-usb: could not initialize remote control. [ 101.471104][ T8] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 101.691330][ T8] usb 4-1: USB disconnect, device number 3 [ 101.740871][ T8] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 102.166176][ T5784] Bluetooth: hci4: command 0x1003 tx timeout [ 102.166237][ T51] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 102.254246][ T6234] loop0: detected capacity change from 0 to 1024 [ 102.695061][ T6249] loop3: detected capacity change from 0 to 512 [ 102.703893][ T6249] EXT4-fs: Ignoring removed nobh option [ 102.715411][ T6249] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 102.731629][ T6249] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (35405!=33349) [ 102.745810][ T6249] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a00ec029, mo2=0002] [ 102.763998][ T6249] System zones: 1-12 [ 102.786923][ T6249] EXT4-fs (loop3): orphan cleanup on readonly fs [ 102.798675][ T6249] EXT4-fs (loop3): 1 truncate cleaned up [ 102.805846][ T6249] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 102.891204][ T6254] loop1: detected capacity change from 0 to 128 [ 102.946887][ T6254] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 102.963706][ T6254] ext4 filesystem being mounted at /28/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 102.999625][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 103.119612][ T5774] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 103.636188][ T5762] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 103.790783][ T6284] netlink: 12 bytes leftover after parsing attributes in process `syz.0.140'. [ 103.814404][ T6284] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 103.823615][ T6284] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 103.832532][ T6284] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 103.841295][ T6284] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 103.855538][ T5762] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.881722][ T6284] netlink: 12 bytes leftover after parsing attributes in process `syz.0.140'. [ 103.884206][ T5762] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 103.903269][ T5762] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 103.913791][ T5762] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.915188][ T6284] Zero length message leads to an empty skb [ 103.951054][ T5762] usb 2-1: config 0 descriptor?? [ 104.121803][ T6288] jffs2: notice: (6288) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 104.363762][ T5762] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 104.374385][ T5762] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 104.384821][ T5762] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 104.393925][ T5762] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 104.408225][ T5762] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 104.415768][ T5762] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 104.438982][ T5762] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 104.497399][ T5762] cp2112 0003:10C4:EA90.0002: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 104.569076][ T6294] loop0: detected capacity change from 0 to 2048 [ 104.616377][ T5762] cp2112 0003:10C4:EA90.0002: Part Number: 0x00 Device Version: 0x00 [ 104.638117][ T6294] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 105.215482][ T6272] cp2112 0003:10C4:EA90.0002: Error starting transaction: -38 [ 105.218255][ T6297] fuse: root generation should be zero [ 105.231042][ T5762] cp2112 0003:10C4:EA90.0002: error reading lock byte: -71 [ 105.248312][ T5762] usb 2-1: USB disconnect, device number 3 [ 105.504477][ T6307] loop3: detected capacity change from 0 to 2048 [ 105.578492][ T6307] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 105.614119][ T6307] fscrypt (loop3, inode 12): Error -61 getting encryption context [ 105.674801][ T6307] EXT4-fs error (device loop3): xattr_find_entry:337: inode #12: comm syz.3.147: corrupted xattr entries [ 105.696827][ T6307] fscrypt (loop3, inode 12): Error -117 getting encryption context [ 105.730688][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.191559][ T28] audit: type=1326 audit(1789613223.722:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6339 comm="syz.3.158" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f06a959e159 code=0x0 [ 107.404685][ T6349] "syz.1.161" (6349) uses obsolete ecb(arc4) skcipher [ 108.280620][ T6375] netlink: 'syz.3.173': attribute type 1 has an invalid length. [ 108.378868][ T6375] 8021q: adding VLAN 0 to HW filter on device bond1 [ 108.389965][ T6383] veth1_vlan: entered allmulticast mode [ 108.412007][ T6383] bridge0: port 3(syz_tun) entered blocking state [ 108.419976][ T6383] bridge0: port 3(syz_tun) entered disabled state [ 108.427356][ T6383] syz_tun: entered allmulticast mode [ 108.433698][ T6383] syz_tun: entered promiscuous mode [ 108.440336][ T6383] bridge0: port 3(syz_tun) entered blocking state [ 108.447193][ T6383] bridge0: port 3(syz_tun) entered forwarding state [ 108.464476][ T3453] bridge0: port 3(syz_tun) entered disabled state [ 108.488540][ T3453] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 108.500605][ T6379] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 108.511163][ T6375] netlink: 'syz.3.173': attribute type 10 has an invalid length. [ 108.527352][ T6375] netlink: 40 bytes leftover after parsing attributes in process `syz.3.173'. [ 108.541348][ T6375] dummy0: entered promiscuous mode [ 108.549907][ T6375] bond1: (slave dummy0): Removing an active aggregator [ 108.562385][ T6375] bond1: (slave dummy0): Releasing backup interface [ 108.642064][ T6385] overlayfs: failed to clone upperpath [ 109.033625][ T6401] loop3: detected capacity change from 0 to 1024 [ 109.860820][ T6400] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.869091][ T6400] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.967137][ T5784] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 109.977034][ T5784] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 110.002606][ T5784] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 110.015812][ T5784] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 110.026221][ T5784] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 110.043988][ T5784] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 110.477261][ T6400] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 110.536849][ T6400] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 111.055179][ T6417] loop1: detected capacity change from 0 to 32768 [ 111.107333][ T6417] loop1: p1 p3 < > [ 111.114976][ T6400] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.124398][ T6400] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.139494][ T6400] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.151496][ T6400] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.448996][ T6400] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 111.458040][ T6400] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 111.467295][ T6400] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 111.476602][ T6400] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 111.558101][ T5763] udevd[5763]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 111.571531][ T5766] udevd[5766]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 111.650310][ T6433] netlink: 4 bytes leftover after parsing attributes in process `syz.1.193'. [ 111.662572][ T6435] netlink: 12 bytes leftover after parsing attributes in process `syz.1.193'. [ 111.781594][ T3402] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.893787][ T3402] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.052305][ T3402] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.087932][ T5784] Bluetooth: hci4: command tx timeout [ 112.209341][ T3402] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.643715][ T6411] chnl_net:caif_netlink_parms(): no params data found [ 112.933611][ T6411] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.949015][ T6411] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.956756][ T6411] bridge_slave_0: entered allmulticast mode [ 112.964055][ T6411] bridge_slave_0: entered promiscuous mode [ 112.973266][ T6411] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.996278][ T6411] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.003535][ T6411] bridge_slave_1: entered allmulticast mode [ 113.021216][ T6411] bridge_slave_1: entered promiscuous mode [ 113.250907][ T6411] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.273460][ T6411] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.508317][ T6411] team0: Port device team_slave_0 added [ 113.576711][ T6411] team0: Port device team_slave_1 added [ 113.684516][ T6453] loop1: detected capacity change from 0 to 32768 [ 113.720106][ T6453] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.197 (6453) [ 113.795694][ T6453] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 113.813623][ T6453] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 113.824833][ T6453] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 113.844531][ T6473] Illegal XDP return value 4291362816 on prog (id 25) dev syz_tun, expect packet loss! [ 113.845319][ T6411] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.873323][ T6453] BTRFS info (device loop1): use lzo compression, level 0 [ 113.886674][ T6453] BTRFS info (device loop1): turning on flush-on-commit [ 113.903937][ T6411] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 113.946484][ T6453] BTRFS info (device loop1): using free space tree [ 113.965051][ T6411] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 114.071133][ T6411] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.082201][ T6453] BTRFS info (device loop1): enabling ssd optimizations [ 114.104379][ T6411] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 114.172757][ T5784] Bluetooth: hci4: command tx timeout [ 114.198788][ T6411] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.550927][ T5774] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 114.612225][ T6493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.203'. [ 114.727948][ T6411] hsr_slave_0: entered promiscuous mode [ 114.746956][ T6411] hsr_slave_1: entered promiscuous mode [ 114.763985][ T6411] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 114.786133][ T6411] Cannot create hsr debugfs directory [ 115.143241][ T6512] loop3: detected capacity change from 0 to 512 [ 115.182330][ T6512] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 115.630967][ T6522] syzkaller0: entered promiscuous mode [ 115.646098][ T6522] syzkaller0: entered allmulticast mode [ 115.746062][ T3402] hsr_slave_0: left promiscuous mode [ 115.772410][ T3402] hsr_slave_1: left promiscuous mode [ 115.797400][ T3402] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 115.816132][ T3402] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 115.835137][ T3402] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 115.853007][ T3402] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 115.876922][ T3402] bridge_slave_1: left allmulticast mode [ 115.899395][ T3402] bridge_slave_1: left promiscuous mode [ 115.921126][ T3402] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.942619][ T3402] bridge_slave_0: left allmulticast mode [ 115.962047][ T3402] bridge_slave_0: left promiscuous mode [ 115.978356][ T3402] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.082643][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 116.094307][ T3402] veth1_macvtap: left promiscuous mode [ 116.121330][ T3402] veth0_macvtap: left promiscuous mode [ 116.142292][ T3402] veth1_vlan: left promiscuous mode [ 116.162906][ T3402] veth0_vlan: left promiscuous mode [ 116.246464][ T5784] Bluetooth: hci4: command tx timeout [ 117.174631][ T3402] team0 (unregistering): Port device team_slave_1 removed [ 117.231043][ T3402] team0 (unregistering): Port device team_slave_0 removed [ 117.274191][ T3402] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 117.326645][ T3402] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 117.604619][ T3402] bond0 (unregistering): Released all slaves [ 118.329097][ T5784] Bluetooth: hci4: command tx timeout [ 119.390306][ T6411] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 119.426948][ T6411] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 119.457960][ T6411] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 119.490686][ T6411] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 119.828691][ T6411] 8021q: adding VLAN 0 to HW filter on device bond0 [ 119.885894][ T6411] 8021q: adding VLAN 0 to HW filter on device team0 [ 119.931628][ T3402] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.938852][ T3402] bridge0: port 1(bridge_slave_0) entered forwarding state [ 119.971263][ T3402] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.978452][ T3402] bridge0: port 2(bridge_slave_1) entered forwarding state [ 120.053943][ T6411] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 120.226296][ T8] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 120.441072][ T8] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 120.472156][ T6411] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 120.480401][ T8] usb 2-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 120.501088][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.941226][ T6411] veth0_vlan: entered promiscuous mode [ 120.998985][ T8] wacom 0003:056A:033B.0003: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 121.013856][ T6411] veth1_vlan: entered promiscuous mode [ 121.057686][ T8] wacom 0003:056A:033B.0003: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.1-1/input0 [ 121.098202][ T6411] veth0_macvtap: entered promiscuous mode [ 121.118100][ T8] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/0003:056A:033B.0003/input/input8 [ 121.166341][ T6411] veth1_macvtap: entered promiscuous mode [ 121.265552][ T6411] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 121.303850][ T6411] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 121.317058][ T6411] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 121.328824][ T6411] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 121.342017][ T6411] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 121.358210][ T6411] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 121.369745][ T6411] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 121.382786][ T6411] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 121.393783][ T6411] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 121.428083][ T6411] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 121.482573][ T6411] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.502631][ T6411] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.515158][ T6411] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.533736][ T6411] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.554507][ T23] usb 2-1: USB disconnect, device number 4 [ 121.738048][ T3453] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.760239][ T3453] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.822956][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.844366][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.516484][ T6686] overlayfs: failed to clone upperpath [ 123.814623][ T6699] FAULT_INJECTION: forcing a failure. [ 123.814623][ T6699] name failslab, interval 1, probability 0, space 0, times 0 [ 123.854311][ T6699] CPU: 0 PID: 6699 Comm: syz.3.252 Not tainted syzkaller #0 [ 123.861649][ T6699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 123.871737][ T6699] Call Trace: [ 123.875011][ T6699] [ 123.877947][ T6699] dump_stack_lvl+0x18c/0x250 [ 123.882659][ T6699] ? show_regs_print_info+0x20/0x20 [ 123.887899][ T6699] ? load_image+0x420/0x420 [ 123.892440][ T6699] ? __lock_acquire+0x7d80/0x7d80 [ 123.897504][ T6699] should_fail_ex+0x394/0x4c0 [ 123.902221][ T6699] should_failslab+0x9/0x20 [ 123.906757][ T6699] slab_pre_alloc_hook+0x59/0x300 [ 123.911797][ T6699] ? sbitmap_queue_init_node+0x24f/0x660 [ 123.917435][ T6699] __kmem_cache_alloc_node+0x53/0x250 [ 123.922814][ T6699] ? sbitmap_queue_init_node+0x24f/0x660 [ 123.928450][ T6699] kmalloc_node_trace+0x26/0xe0 [ 123.933309][ T6699] sbitmap_queue_init_node+0x24f/0x660 [ 123.938765][ T6699] blk_mq_init_tags+0x15d/0x280 [ 123.943617][ T6699] blk_mq_alloc_map_and_rqs+0xc5/0x910 [ 123.949070][ T6699] ? kasan_quarantine_put+0xd8/0x220 [ 123.954355][ T6699] ? lockdep_hardirqs_on+0x98/0x150 [ 123.959558][ T6699] blk_mq_alloc_set_map_and_rqs+0x1a0/0x800 [ 123.965457][ T6699] blk_mq_alloc_tag_set+0x868/0x1020 [ 123.970748][ T6699] loop_add+0x2eb/0x990 [ 123.974904][ T6699] loop_control_ioctl+0x128/0x590 [ 123.979925][ T6699] ? loop_set_hw_queue_depth+0x110/0x110 [ 123.985556][ T6699] ? bpf_lsm_file_ioctl+0x9/0x10 [ 123.990491][ T6699] ? security_file_ioctl+0x80/0xa0 [ 123.995601][ T6699] ? loop_set_hw_queue_depth+0x110/0x110 [ 124.001233][ T6699] __se_sys_ioctl+0xfd/0x170 [ 124.005828][ T6699] do_syscall_64+0x55/0xb0 [ 124.010246][ T6699] ? clear_bhb_loop+0x40/0x90 [ 124.014931][ T6699] ? clear_bhb_loop+0x40/0x90 [ 124.019611][ T6699] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 124.025534][ T6699] RIP: 0033:0x7f06a959e159 [ 124.029948][ T6699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.049550][ T6699] RSP: 002b:00007f06aa454028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 124.057959][ T6699] RAX: ffffffffffffffda RBX: 00007f06a9825fa0 RCX: 00007f06a959e159 [ 124.066010][ T6699] RDX: 00000000ffffffe4 RSI: 0000000000004c80 RDI: 0000000000000004 [ 124.073973][ T6699] RBP: 00007f06a963506b R08: 0000000000000000 R09: 0000000000000000 [ 124.081934][ T6699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.089932][ T6699] R13: 00007f06a9826038 R14: 00007f06a9825fa0 R15: 00007fffe866c858 [ 124.097913][ T6699] [ 124.109823][ T6699] blk-mq: reduced tag depth (128 -> 64) [ 124.598215][ T6717] loop1: detected capacity change from 0 to 128 [ 124.660375][ T6717] FAT-fs (loop1): Directory bread(block 32) failed [ 124.702356][ T788] IPVS: starting estimator thread 0... [ 124.713427][ T6717] FAT-fs (loop1): Directory bread(block 33) failed [ 124.743880][ T6717] FAT-fs (loop1): Directory bread(block 34) failed [ 124.769485][ T6717] FAT-fs (loop1): Directory bread(block 35) failed [ 124.796192][ T6717] FAT-fs (loop1): Directory bread(block 36) failed [ 124.806359][ T6722] IPVS: using max 19 ests per chain, 45600 per kthread [ 124.815402][ T6717] FAT-fs (loop1): Directory bread(block 37) failed [ 124.854301][ T6717] FAT-fs (loop1): Directory bread(block 38) failed [ 124.875328][ T6717] FAT-fs (loop1): Directory bread(block 39) failed [ 124.887219][ T6717] FAT-fs (loop1): Directory bread(block 40) failed [ 124.893788][ T6717] FAT-fs (loop1): Directory bread(block 41) failed [ 125.096285][ T6730] loop4: detected capacity change from 0 to 8192 [ 125.128153][ T6710] loop3: detected capacity change from 0 to 32768 [ 125.141036][ T6717] syz.1.256: attempt to access beyond end of device [ 125.141036][ T6717] loop1: rw=524288, sector=4108, nr_sectors = 4 limit=128 [ 125.237914][ T6717] syz.1.256: attempt to access beyond end of device [ 125.237914][ T6717] loop1: rw=0, sector=4108, nr_sectors = 4 limit=128 [ 125.296586][ T28] audit: type=1800 audit(1789613241.832:6): pid=6717 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.256" name="file1" dev="loop1" ino=1048600 res=0 errno=0 [ 125.304072][ T6710] JBD2: Ignoring recovery information on journal [ 125.475778][ T6710] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 125.660620][ T28] audit: type=1800 audit(1789613242.192:7): pid=6710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.255" name="file1" dev="loop3" ino=17058 res=0 errno=0 [ 126.364860][ T5778] OCFS2: ERROR (device loop3): int ocfs2_validate_gd_self(struct super_block *, struct buffer_head *, int): Group descriptor #1056 has bad signature [ 126.395137][ T6773] netlink: 4 bytes leftover after parsing attributes in process `syz.0.267'. [ 126.435554][ T5778] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 126.468714][ T5778] OCFS2: File system is now read-only. [ 126.474228][ T5778] (syz-executor,5778,0):_ocfs2_free_suballoc_bits:2511 ERROR: status = -30 [ 126.494727][ T5778] (syz-executor,5778,0):_ocfs2_free_clusters:2605 ERROR: status = -30 [ 126.525293][ T5778] (syz-executor,5778,0):ocfs2_sync_local_to_main:1001 ERROR: status = -30 [ 126.544877][ T5778] (syz-executor,5778,0):ocfs2_sync_local_to_main:1013 ERROR: status = -30 [ 126.571198][ T5778] (syz-executor,5778,0):ocfs2_shutdown_local_alloc:449 ERROR: status = -30 [ 126.658136][ T5778] ocfs2: Unmounting device (7,3) on (node local) [ 127.234463][ T6790] (null): rxe_set_mtu: Set mtu to 1024 [ 127.310420][ T6791] netlink: 4 bytes leftover after parsing attributes in process `syz.3.266'. [ 127.979679][ T6808] warning: `syz.4.276' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 128.049904][ T6790] rdma_rxe: rxe_newlink: failed to add syz_tun [ 128.316332][ T6818] Bluetooth: ISO socket layer initialized [ 128.326445][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 128.383052][ T6823] netlink: 4 bytes leftover after parsing attributes in process `syz.0.283'. [ 128.399759][ T6823] netlink: 12 bytes leftover after parsing attributes in process `syz.0.283'. [ 128.494330][ T27] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 128.698140][ T27] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 128.722683][ T27] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 128.767324][ T27] usb 5-1: New USB device found, idVendor=08b7, idProduct=ec00, bcdDevice= 0.00 [ 128.779005][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 128.796024][ T27] usb 5-1: SerialNumber: syz [ 128.949615][ T6837] loop3: detected capacity change from 0 to 512 [ 129.047811][ T6837] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 129.071995][ T27] usb 5-1: 0:2 : does not exist [ 129.090897][ T6837] ext4 filesystem being mounted at /71/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 129.228907][ T27] usb 5-1: USB disconnect, device number 2 [ 129.252437][ T5766] udevd[5766]: incorrect ext4 checksum on /dev/loop3 [ 129.321576][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.340055][ T5763] udevd[5763]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 129.663503][ T6851] loop1: detected capacity change from 0 to 2048 [ 129.783272][ T787] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 129.986202][ T787] usb 4-1: Using ep0 maxpacket: 32 [ 129.994483][ T787] usb 4-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 130.011131][ T787] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.024309][ T787] usb 4-1: Product: syz [ 130.042124][ T787] usb 4-1: Manufacturer: syz [ 130.054740][ T787] usb 4-1: SerialNumber: syz [ 130.065642][ T787] usb 4-1: config 0 descriptor?? [ 130.092058][ T787] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 130.132250][ T6869] retu-mfd 0-0001: could not read Retu revision: -5 [ 130.145555][ T6869] retu-mfd: probe of 0-0001 failed with error -5 [ 130.152774][ T6869] i2c i2c-0: new_device: Instantiated device retu at 0x01 [ 130.186127][ T27] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 130.391675][ T27] usb 2-1: New USB device found, idVendor=046d, idProduct=0850, bcdDevice=61.47 [ 130.408627][ T27] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.433988][ T27] usb 2-1: config 0 descriptor?? [ 130.445434][ T27] gspca_main: STV06xx-2.14.0 probing 046d:0850 [ 130.929553][ T6880] loop4: detected capacity change from 0 to 2048 [ 130.963809][ T6880] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 131.455122][ T27] gspca_stv06xx: HDCS-1000/1100 sensor detected [ 131.515592][ T787] gspca_topro: Sensor cx0342 [ 131.736402][ T8] usb 4-1: USB disconnect, device number 4 [ 131.931670][ T27] STV06xx: probe of 2-1:0.0 failed with error -71 [ 131.943340][ T27] usb 2-1: USB disconnect, device number 5 [ 133.054229][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.071150][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.152268][ T6902] loop3: detected capacity change from 0 to 32768 [ 133.223911][ T6902] XFS (loop3): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 133.445263][ T6902] XFS (loop3): Ending clean mount [ 133.908100][ T5778] XFS (loop3): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 134.371687][ T6970] netlink: 7 bytes leftover after parsing attributes in process `syz.0.327'. [ 134.484493][ T6982] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 134.586910][ T6987] netlink: 'syz.0.331': attribute type 1 has an invalid length. [ 134.712037][ T6987] 8021q: adding VLAN 0 to HW filter on device bond1 [ 134.738254][ T6991] bond1: (slave dummy0): making interface the new active one [ 134.748292][ T6991] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 134.901938][ T7002] overlayfs: failed to clone upperpath [ 134.931510][ T6996] kvm: MWAIT instruction emulated as NOP! [ 135.002917][ T7003] netlink: 'syz.3.333': attribute type 3 has an invalid length. [ 135.218354][ T6987] bond1 (unregistering): (slave dummy0): Releasing active interface [ 135.240250][ T6987] bond1 (unregistering): Released all slaves [ 136.023158][ T7012] loop1: detected capacity change from 0 to 32768 [ 136.119908][ T7012] XFS (loop1): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 136.228361][ T7012] XFS (loop1): Ending clean mount [ 136.520266][ T5774] XFS (loop1): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 137.228000][ T7065] netlink: 24 bytes leftover after parsing attributes in process `syz.4.355'. [ 139.174828][ T7117] loop1: detected capacity change from 0 to 512 [ 139.302402][ T7117] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 139.636360][ T5774] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 139.783998][ T7138] netlink: 'syz.4.371': attribute type 1 has an invalid length. [ 139.974973][ T7138] 8021q: adding VLAN 0 to HW filter on device bond1 [ 140.110508][ T7145] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 140.129214][ T7145] bond1: (slave batadv0): making interface the new active one [ 140.153259][ T7145] bond1: (slave batadv0): Enslaving as an active interface with an up link [ 140.200958][ T7152] netlink: 12 bytes leftover after parsing attributes in process `syz.0.373'. [ 140.232302][ T7153] netlink: 12 bytes leftover after parsing attributes in process `syz.0.373'. [ 141.014287][ T7157] loop1: detected capacity change from 0 to 32768 [ 141.160219][ T7157] JBD2: Ignoring recovery information on journal [ 141.266628][ T7185] netlink: 'syz.0.382': attribute type 10 has an invalid length. [ 141.309097][ T7157] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 141.313863][ T7185] 8021q: adding VLAN 0 to HW filter on device team0 [ 141.349821][ T7185] bond0: (slave team0): Enslaving as an active interface with an up link [ 141.439357][ T28] audit: type=1800 audit(1789613257.972:8): pid=7157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.374" name="file1" dev="loop1" ino=17058 res=0 errno=0 [ 141.945704][ T7200] netlink: 'syz.0.385': attribute type 1 has an invalid length. [ 141.986044][ T5774] OCFS2: ERROR (device loop1): int ocfs2_validate_gd_self(struct super_block *, struct buffer_head *, int): Group descriptor #1056 has bad signature [ 142.026110][ T5774] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 142.036271][ T5774] OCFS2: File system is now read-only. [ 142.041761][ T5774] (syz-executor,5774,1):_ocfs2_free_suballoc_bits:2511 ERROR: status = -30 [ 142.052596][ T5774] (syz-executor,5774,1):_ocfs2_free_clusters:2605 ERROR: status = -30 [ 142.066003][ T5774] (syz-executor,5774,1):ocfs2_sync_local_to_main:1001 ERROR: status = -30 [ 142.074560][ T5774] (syz-executor,5774,1):ocfs2_sync_local_to_main:1013 ERROR: status = -30 [ 142.092236][ T7200] 8021q: adding VLAN 0 to HW filter on device bond1 [ 142.095520][ T5774] (syz-executor,5774,1):ocfs2_shutdown_local_alloc:449 ERROR: status = -30 [ 142.178853][ T5774] ocfs2: Unmounting device (7,1) on (node local) [ 142.187148][ T7203] bond0: (slave team0): Releasing backup interface [ 142.231876][ T7203] 8021q: adding VLAN 0 to HW filter on device team0 [ 142.276106][ T7203] bond1: (slave team0): Enslaving as a backup interface with a down link [ 142.614955][ T7225] netlink: 52 bytes leftover after parsing attributes in process `syz.3.390'. [ 142.634477][ T7225] bridge0: port 2(bridge_slave_1) entered disabled state [ 142.641965][ T7225] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.681696][ T7229] netlink: 52 bytes leftover after parsing attributes in process `syz.3.390'. [ 142.974372][ T5784] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 142.984858][ T5784] CPU: 1 PID: 5784 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 142.992440][ T5784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 143.002526][ T5784] Workqueue: hci2 hci_rx_work [ 143.007248][ T5784] Call Trace: [ 143.010546][ T5784] [ 143.013498][ T5784] dump_stack_lvl+0x18c/0x250 [ 143.018217][ T5784] ? show_regs_print_info+0x20/0x20 [ 143.023456][ T5784] ? load_image+0x420/0x420 [ 143.028009][ T5784] sysfs_create_dir_ns+0x26e/0x2a0 [ 143.033155][ T5784] ? __lock_acquire+0x7d80/0x7d80 [ 143.038218][ T5784] ? sysfs_warn_dup+0xa0/0xa0 [ 143.042934][ T5784] ? do_raw_spin_unlock+0x121/0x230 [ 143.048182][ T5784] kobject_add_internal+0x617/0xc90 [ 143.053421][ T5784] kobject_add+0x164/0x240 [ 143.057873][ T5784] ? kobject_init+0x1d0/0x1d0 [ 143.062589][ T5784] ? get_device_parent+0x366/0x390 [ 143.067744][ T5784] device_add+0x3fa/0xc40 [ 143.072116][ T5784] hci_conn_add_sysfs+0xd5/0x1e0 [ 143.077105][ T5784] le_conn_complete_evt+0xe9a/0x1480 [ 143.082454][ T5784] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 143.088828][ T5784] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 143.094502][ T5784] ? mutex_unlock+0x10/0x10 [ 143.099039][ T5784] ? skb_pull_data+0xf0/0x1f0 [ 143.103753][ T5784] hci_le_conn_complete_evt+0x187/0x440 [ 143.109341][ T5784] ? hci_remote_host_features_evt+0x150/0x150 [ 143.115474][ T5784] hci_event_packet+0x7b4/0x1280 [ 143.120450][ T5784] ? __lock_acquire+0x7d80/0x7d80 [ 143.125511][ T5784] ? lock_chain_count+0x20/0x20 [ 143.130393][ T5784] ? bis_list+0x290/0x290 [ 143.134849][ T5784] ? kcov_remote_start+0x513/0x810 [ 143.140002][ T5784] ? lockdep_hardirqs_on+0x98/0x150 [ 143.145235][ T5784] ? hci_send_to_monitor+0xd7/0x4f0 [ 143.150479][ T5784] hci_rx_work+0x43a/0xd60 [ 143.154939][ T5784] ? process_scheduled_works+0x975/0x1600 [ 143.160705][ T5784] process_scheduled_works+0xa60/0x1600 [ 143.166356][ T5784] ? worker_attach_to_pool+0x370/0x370 [ 143.171859][ T5784] ? assign_work+0x3cc/0x5d0 [ 143.176493][ T5784] worker_thread+0xa5e/0xfe0 [ 143.181152][ T5784] kthread+0x2fa/0x390 [ 143.185252][ T5784] ? pr_cont_work+0x550/0x550 [ 143.189970][ T5784] ? kthread_blkcg+0xd0/0xd0 [ 143.194587][ T5784] ret_from_fork+0x48/0x80 [ 143.199040][ T5784] ? kthread_blkcg+0xd0/0xd0 [ 143.203660][ T5784] ret_from_fork_asm+0x11/0x20 [ 143.208470][ T5784] [ 143.221827][ T5784] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 143.236298][ T5784] Bluetooth: hci2: failed to register connection device [ 144.596754][ T7276] netlink: 24 bytes leftover after parsing attributes in process `syz.3.402'. [ 145.346026][ T28] audit: type=1326 audit(1789613261.872:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7302 comm="syz.1.407" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd82859e159 code=0x7ffc0000 [ 145.426571][ T28] audit: type=1326 audit(1789613261.872:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7302 comm="syz.1.407" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd82859e159 code=0x7ffc0000 [ 145.489949][ T7307] ªªªªª»: renamed from vlan0 [ 145.496517][ T28] audit: type=1326 audit(1789613261.912:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7302 comm="syz.1.407" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7fd82859cfc7 code=0x7ffc0000 [ 145.549040][ T28] audit: type=1326 audit(1789613261.912:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7302 comm="syz.1.407" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd82859e159 code=0x7ffc0000 [ 145.604353][ T28] audit: type=1326 audit(1789613261.912:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7302 comm="syz.1.407" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd82859e159 code=0x7ffc0000 [ 145.658444][ T5774] bridge0: port 3(syz_tun) entered disabled state [ 145.678075][ T28] audit: type=1326 audit(1789613261.912:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7302 comm="syz.1.407" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=428 compat=0 ip=0x7fd82859e159 code=0x7ffc0000 [ 145.724228][ T28] audit: type=1326 audit(1789613261.912:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7302 comm="syz.1.407" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd82859e159 code=0x7ffc0000 [ 145.774091][ T5774] syz_tun (unregistering): left allmulticast mode [ 145.787665][ T5774] syz_tun (unregistering): left promiscuous mode [ 145.795468][ T28] audit: type=1326 audit(1789613261.912:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7302 comm="syz.1.407" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd82859e159 code=0x7ffc0000 [ 145.795640][ T7314] ref_ctr going negative. vaddr: 0x2000001f8002, curr val: -15478, delta: 1 [ 145.819819][ T5774] bridge0: port 3(syz_tun) entered disabled state [ 145.838972][ T28] audit: type=1326 audit(1789613261.912:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7302 comm="syz.1.407" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=429 compat=0 ip=0x7fd82859e159 code=0x7ffc0000 [ 145.843774][ T7314] ref_ctr increment failed for inode: 0x2d9 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88807d465580 [ 146.157540][ T7322] IPVS: Error connecting to the multicast addr [ 146.316910][ T3402] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.489509][ T3402] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.662195][ T3402] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.821664][ T3402] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.968130][ T5784] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 146.983695][ T5784] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 146.993288][ T5784] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 147.003802][ T5784] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 147.013106][ T5784] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 147.022139][ T5784] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 147.804806][ T7332] chnl_net:caif_netlink_parms(): no params data found [ 148.060278][ T7332] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.076510][ T7332] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.083768][ T7332] bridge_slave_0: entered allmulticast mode [ 148.117652][ T7332] bridge_slave_0: entered promiscuous mode [ 148.304365][ T7332] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.316395][ T7332] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.323642][ T7332] bridge_slave_1: entered allmulticast mode [ 148.353178][ T7332] bridge_slave_1: entered promiscuous mode [ 148.520062][ T7332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 148.575149][ T7332] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 148.702730][ T7332] team0: Port device team_slave_0 added [ 148.715160][ T7332] team0: Port device team_slave_1 added [ 148.781328][ T3402] hsr_slave_0: left promiscuous mode [ 148.788122][ T3402] hsr_slave_1: left promiscuous mode [ 148.796542][ T3402] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 148.803986][ T3402] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 148.822105][ T3402] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 148.833043][ T3402] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 148.841373][ T3402] bridge_slave_1: left allmulticast mode [ 148.850561][ T3402] bridge_slave_1: left promiscuous mode [ 148.856928][ T3402] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.872397][ T3402] bridge_slave_0: left allmulticast mode [ 148.878394][ T3402] bridge_slave_0: left promiscuous mode [ 148.884145][ T3402] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.935200][ T3402] veth1_macvtap: left promiscuous mode [ 148.944081][ T3402] veth0_macvtap: left promiscuous mode [ 148.953525][ T3402] veth0_vlan: left promiscuous mode [ 149.127531][ T51] Bluetooth: hci1: command tx timeout [ 149.642960][ T3402] team0 (unregistering): Port device team_slave_1 removed [ 149.691114][ T3402] team0 (unregistering): Port device team_slave_0 removed [ 149.740668][ T3402] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 149.783503][ T3402] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 150.070654][ T3402] bond0 (unregistering): Released all slaves [ 150.161677][ T7332] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 150.169165][ T7332] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 150.195213][ T7332] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 150.214570][ T7332] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 150.221958][ T7332] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 150.248227][ T7332] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 150.321516][ T7332] hsr_slave_0: entered promiscuous mode [ 150.329402][ T7332] hsr_slave_1: entered promiscuous mode [ 150.609604][ T7332] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 150.621072][ T7332] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 150.631748][ T7332] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 150.643992][ T7332] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 150.744080][ T7332] 8021q: adding VLAN 0 to HW filter on device bond0 [ 150.773586][ T7332] 8021q: adding VLAN 0 to HW filter on device team0 [ 150.794371][ T6175] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.801565][ T6175] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.826689][ T6175] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.833835][ T6175] bridge0: port 2(bridge_slave_1) entered forwarding state [ 151.131382][ T7332] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 151.208029][ T51] Bluetooth: hci1: command tx timeout [ 151.433725][ T7332] veth0_vlan: entered promiscuous mode [ 151.452804][ T7332] veth1_vlan: entered promiscuous mode [ 151.500007][ T7332] veth0_macvtap: entered promiscuous mode [ 151.510807][ T7332] veth1_macvtap: entered promiscuous mode [ 151.532332][ T7332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 151.553197][ T7332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 151.566629][ T7332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 151.580681][ T7332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 151.593589][ T7332] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 151.605175][ T7332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 151.618067][ T7332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 151.628336][ T7332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 151.639234][ T7332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 151.650993][ T7332] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 151.670139][ T7332] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 151.680130][ T7332] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 151.690630][ T7332] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 151.699621][ T7332] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 151.784898][ T3453] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 151.792852][ T3453] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 151.828633][ T6175] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 151.846103][ T6175] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 152.077255][ T7433] netlink: 2028 bytes leftover after parsing attributes in process `syz.3.428'. [ 152.105344][ T7433] netlink: 24 bytes leftover after parsing attributes in process `syz.3.428'. [ 153.082289][ T7467] overlayfs: failed to clone upperpath [ 153.140646][ T7470] loop3: detected capacity change from 0 to 512 [ 153.189987][ T7470] EXT4-fs error (device loop3): ext4_quota_enable:7144: comm syz.3.429: inode #32768: comm syz.3.429: iget: illegal inode # [ 153.212594][ T7470] EXT4-fs error (device loop3): ext4_quota_enable:7147: comm syz.3.429: Bad quota inode: 32768, type: 2 [ 153.258142][ T7470] EXT4-fs warning (device loop3): ext4_enable_quotas:7188: Failed to enable quota tracking (type=2, err=-117, ino=32768). Please run e2fsck to fix. [ 153.302133][ T51] Bluetooth: hci1: command tx timeout [ 153.356390][ T7470] EXT4-fs (loop3): mount failed [ 153.481536][ T5763] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 154.255116][ T7502] netlink: 8 bytes leftover after parsing attributes in process `syz.3.435'. [ 155.126215][ T788] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 155.339966][ T788] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 155.366310][ T51] Bluetooth: hci1: command tx timeout [ 155.373766][ T788] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 155.396030][ T788] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 155.405209][ T788] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.416045][ T788] usb 6-1: Product: syz [ 155.420842][ T788] usb 6-1: Manufacturer: syz [ 155.429397][ T788] usb 6-1: SerialNumber: syz [ 155.442891][ T788] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 155.467058][ T788] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 155.482622][ T788] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 156.112559][ T7564] TCP: tcp_parse_options: Illegal window scaling value 254 > 14 received [ 156.254306][ T7568] overlayfs: failed to clone upperpath [ 157.134574][ T7596] overlayfs: failed to clone upperpath [ 157.184621][ T28] kauditd_printk_skb: 12 callbacks suppressed [ 157.184637][ T28] audit: type=1326 audit(1789613273.712:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7592 comm="syz.0.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5c6b19e159 code=0x0 [ 157.446725][ T7522] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot clear input buffers, -110 [ 157.464004][ T27] usb 6-1: USB disconnect, device number 2 [ 157.492775][ T27] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 157.532729][ T27] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 157.562627][ T27] ti_usb_3410_5052 6-1:2.0: device disconnected [ 158.308825][ T7571] loop3: detected capacity change from 0 to 131072 [ 158.368479][ T7571] F2FS-fs (loop3): Found nat_bits in checkpoint [ 158.471644][ T7626] ip_tables: iptables: counters copy to user failed while replacing table [ 158.514222][ T7571] F2FS-fs (loop3): Mounted with checkpoint version = 753bd00b [ 158.760261][ T7571] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 158.823444][ T7571] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 158.913486][ T7641] ref_ctr_offset mismatch. inode: 0x1ae offset: 0x0 ref_ctr_offset(old): 0x2000000000c0 ref_ctr_offset(new): 0x1000000008 [ 159.939118][ T7660] loop3: detected capacity change from 0 to 128 [ 160.003892][ T7660] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 160.071629][ T7660] ext4 filesystem being mounted at /102/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 160.172414][ T7660] syz.3.473 (pid 7660) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 160.458401][ T7660] fscrypt: Adiantum using implementation "adiantum(xchacha12-simd,aes-aesni,nhpoly1305-avx2)" [ 160.563697][ T5778] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 161.081237][ T7704] netlink: 'syz.5.487': attribute type 2 has an invalid length. [ 161.098284][ T7704] netlink: 11575 bytes leftover after parsing attributes in process `syz.5.487'. [ 161.437032][ T7716] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 161.912181][ T7730] netlink: 'syz.3.495': attribute type 10 has an invalid length. [ 161.949483][ T7730] 8021q: adding VLAN 0 to HW filter on device team0 [ 161.989626][ T7730] bond0: (slave team0): Enslaving as an active interface with an up link [ 162.237845][ T7747] overlayfs: failed to clone upperpath [ 162.303233][ T7749] netlink: 64 bytes leftover after parsing attributes in process `syz.5.501'. [ 162.414158][ T7756] (null): rxe_set_mtu: Set mtu to 1024 [ 162.478509][ T7761] netlink: 4 bytes leftover after parsing attributes in process `syz.5.506'. [ 162.591459][ T7764] fuse: Bad value for 'fd' [ 162.875625][ T7756] rdma_rxe: rxe_newlink: failed to add syz_tun [ 163.085474][ T7781] netlink: 'syz.3.514': attribute type 2 has an invalid length. [ 163.093534][ T7781] netlink: 11575 bytes leftover after parsing attributes in process `syz.3.514'. [ 163.662607][ T7799] loop2: detected capacity change from 0 to 7 [ 163.680252][ T7799] Dev loop2: unable to read RDB block 7 [ 163.690137][ T7799] loop2: unable to read partition table [ 163.696461][ T7799] loop2: partition table beyond EOD, truncated [ 163.718786][ T7799] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 164.519059][ T7829] netlink: 'syz.3.528': attribute type 11 has an invalid length. [ 164.928791][ T7849] loop3: detected capacity change from 0 to 2048 [ 164.966378][ T7849] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 164.996944][ T7849] ext4 filesystem being mounted at /113/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 165.095338][ T7831] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.104146][ T7831] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.438664][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 165.807455][ T7831] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 165.890976][ T7864] loop3: detected capacity change from 0 to 2048 [ 165.896879][ T7831] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 165.982718][ T7864] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 166.250217][ T7869] EXT4-fs error (device loop3): xattr_find_entry:337: inode #12: comm syz.3.539: corrupted xattr entries [ 166.528898][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 166.850022][ T7831] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.866892][ T7873] capability: warning: `syz.3.541' uses 32-bit capabilities (legacy support in use) [ 166.882695][ T7831] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.966117][ T7831] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.984626][ T7831] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.140064][ T7877] overlayfs: failed to clone upperpath [ 169.278767][ T7967] overlayfs: failed to clone upperpath [ 170.593103][ T7992] ip_tables: iptables: counters copy to user failed while replacing table [ 170.628924][ T7992] tipc: Started in network mode [ 170.634099][ T7992] tipc: Node identity ac1414aa, cluster identity 4711 [ 170.663597][ T7988] loop3: detected capacity change from 0 to 1024 [ 170.677066][ T7992] tipc: New replicast peer: 172.20.20.187 [ 170.699236][ T7992] ------------[ cut here ]------------ [ 170.705016][ T7992] WARNING: CPU: 0 PID: 7992 at net/core/flow_dissector.c:1107 __skb_flow_dissect+0xb05/0x6e70 [ 170.715395][ T7992] Modules linked in: [ 170.719356][ T7992] CPU: 0 PID: 7992 Comm: syz.5.574 Not tainted syzkaller #0 [ 170.726725][ T7992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 170.736841][ T7992] RIP: 0010:__skb_flow_dissect+0xb05/0x6e70 [ 170.742771][ T7992] Code: c6 e8 9f 38 05 f9 85 db 0f 84 9a 06 00 00 80 3d ab 48 f4 05 01 0f 85 c0 06 00 00 e8 d5 34 05 f9 e9 d5 f9 ff ff e8 cb 34 05 f9 <0f> 0b e8 54 fa 0e 02 89 c3 31 ff 89 c6 e8 69 38 05 f9 85 db 74 18 [ 170.762534][ T7992] RSP: 0018:ffffc90004a1e0a0 EFLAGS: 00010283 [ 170.768680][ T7992] RAX: ffffffff88825685 RBX: 0000000000000000 RCX: 0000000000080000 [ 170.776729][ T7992] RDX: ffffc9000d44b000 RSI: 0000000000011000 RDI: 0000000000011001 [ 170.784732][ T7992] RBP: ffffc90004a1e6b8 R08: dffffc0000000000 R09: 1ffffffff223d6a0 [ 170.792804][ T7992] R10: dffffc0000000000 R11: fffffbfff223d6a1 R12: ffffffff8e8ca338 [ 170.800854][ T7992] R13: 1ffffffff1d19468 R14: ffffffff8e8ca342 R15: dffffc0000000000 [ 170.808908][ T7992] FS: 00007f0d82c3d6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 170.817907][ T7992] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 170.824519][ T7992] CR2: 00007f0d81deb840 CR3: 0000000069917000 CR4: 00000000003506f0 [ 170.832574][ T7992] Call Trace: [ 170.835849][ T7992] [ 170.838838][ T7992] ? __skb_flow_dissect+0x1eb/0x6e70 [ 170.844174][ T7992] ? __lock_acquire+0x357f/0x7d80 [ 170.849329][ T7992] ? bpf_flow_dissect+0x3f0/0x3f0 [ 170.854395][ T7992] ? verify_lock_unused+0x140/0x140 [ 170.859711][ T7992] ? rcu_read_lock_sched_held+0x8a/0x110 [ 170.865374][ T7992] ? __bpf_trace_rcu_stall_warning+0x160/0x160 [ 170.871606][ T7992] ? rcu_is_watching+0x15/0xb0 [ 170.876450][ T7992] ? cpufreq_update_util+0x91/0x230 [ 170.881699][ T7992] ? try_to_wake_up+0x680/0x10e0 [ 170.886717][ T7992] ? __lock_acquire+0x7d80/0x7d80 [ 170.891786][ T7992] ? do_raw_spin_unlock+0x121/0x230 [ 170.897097][ T7992] ? __queue_work+0xc0d/0xfd0 [ 170.901824][ T7992] ? mark_lock+0x94/0x320 [ 170.906240][ T7992] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 170.912261][ T7992] __skb_get_hash+0xf3/0x2e0 [ 170.916926][ T7992] ? queue_work_on+0x110/0x1f0 [ 170.921722][ T7992] ? __skb_get_hash_symmetric+0x1d0/0x1d0 [ 170.927518][ T7992] ? queue_work_on+0x19a/0x1f0 [ 170.932325][ T7992] ? once_disable_jump+0x150/0x1a0 [ 170.937523][ T7992] nft_trace_init+0x1bb/0x420 [ 170.942238][ T7992] ? nf_trace_fill_pkt_info+0x870/0x870 [ 170.947864][ T7992] ? ipt_do_table+0x13b3/0x15c0 [ 170.952748][ T7992] nft_do_chain+0x1523/0x1620 [ 170.957527][ T7992] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 170.963473][ T7992] ? nf_nat_inet_fn+0x7da/0xb20 [ 170.968512][ T7992] ? nf_nat_packet+0xf0/0xf0 [ 170.973138][ T7992] nft_do_chain_ipv4+0x160/0x230 [ 170.978152][ T7992] ? nf_tables_netdev_event+0x9d0/0x9d0 [ 170.983741][ T7992] ? nf_nat_ipv4_local_fn+0x411/0x560 [ 170.989146][ T7992] ? nf_tables_netdev_event+0x9d0/0x9d0 [ 170.994687][ T7992] nf_hook_slow+0xbd/0x200 [ 170.999175][ T7992] ? nf_hook+0x390/0x390 [ 171.003448][ T7992] nf_hook+0x228/0x390 [ 171.007610][ T7992] ? nf_hook+0xa2/0x390 [ 171.011795][ T7992] ? __ip_local_out+0x5f0/0x5f0 [ 171.016742][ T7992] ? nf_hook+0x390/0x390 [ 171.021021][ T7992] ? rt_set_nexthop+0x72f/0xa10 [ 171.025909][ T7992] ? ip_route_output_key_hash+0x13d/0x330 [ 171.031804][ T7992] ? ip_fast_csum+0x1ee/0x2b0 [ 171.036576][ T7992] __ip_local_out+0x4db/0x5f0 [ 171.041283][ T7992] ? nf_hook+0x390/0x390 [ 171.045561][ T7992] ip_local_out+0x2a/0x130 [ 171.050093][ T7992] iptunnel_xmit+0x4d0/0x910 [ 171.054717][ T7992] udp_tunnel_xmit_skb+0x22f/0x380 [ 171.059932][ T7992] tipc_udp_xmit+0x861/0xb40 [ 171.064583][ T7992] ? tipc_udp_xmit+0xb7/0xb40 [ 171.069350][ T7992] ? tipc_udp_msg2addr+0x1d0/0x1d0 [ 171.074502][ T7992] ? __asan_memcpy+0x40/0x70 [ 171.079187][ T7992] ? __pskb_copy_fclone+0x978/0x1000 [ 171.084509][ T7992] ? __asan_memcpy+0x40/0x70 [ 171.089203][ T7992] ? __pskb_copy_fclone+0x978/0x1000 [ 171.094543][ T7992] tipc_udp_send_msg+0x27e/0x3e0 [ 171.099588][ T7992] tipc_bearer_xmit_skb+0x2ad/0x3f0 [ 171.104910][ T7992] ? tipc_bearer_xmit_skb+0xaa/0x3f0 [ 171.110291][ T7992] ? tipc_bearer_min_mtu+0x1d0/0x1d0 [ 171.115625][ T7992] __tipc_nl_bearer_enable+0x10a7/0x13e0 [ 171.121366][ T7992] ? tipc_nl_bearer_disable+0x30/0x30 [ 171.126815][ T7992] ? trace_contention_end+0x39/0xe0 [ 171.132068][ T7992] ? tipc_nl_bearer_enable+0x17/0x30 [ 171.137459][ T7992] ? mutex_lock_nested+0x20/0x20 [ 171.142435][ T7992] ? __nla_parse+0x40/0x50 [ 171.146951][ T7992] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 171.153318][ T7992] ? genl_family_rcv_msg_attrs_parse+0x20a/0x290 [ 171.159749][ T7992] tipc_nl_bearer_enable+0x22/0x30 [ 171.164893][ T7992] genl_family_rcv_msg_doit+0x21a/0x310 [ 171.170521][ T7992] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 171.176504][ T7992] ? bpf_lsm_capable+0x9/0x10 [ 171.181194][ T7992] ? security_capable+0x89/0xb0 [ 171.186119][ T7992] genl_rcv_msg+0x611/0x7a0 [ 171.190662][ T7992] ? genl_bind+0x360/0x360 [ 171.195105][ T7992] ? __tipc_nl_bearer_enable+0x13e0/0x13e0 [ 171.201011][ T7992] netlink_rcv_skb+0x235/0x4c0 [ 171.205808][ T7992] ? genl_bind+0x360/0x360 [ 171.210291][ T7992] ? netlink_ack+0x1160/0x1160 [ 171.215079][ T7992] ? __lock_acquire+0x7d80/0x7d80 [ 171.220170][ T7992] ? net_generic+0x1e/0x240 [ 171.224689][ T7992] ? down_read+0x1ac/0x2e0 [ 171.229155][ T7992] genl_rcv+0x28/0x40 [ 171.233152][ T7992] netlink_unicast+0x7b1/0x930 [ 171.237998][ T7992] netlink_sendmsg+0x8d0/0xbf0 [ 171.242803][ T7992] ? netlink_getsockopt+0x590/0x590 [ 171.248093][ T7992] ? apparmor_socket_sendmsg+0x8e/0x330 [ 171.253652][ T7992] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 171.259002][ T7992] ? security_socket_sendmsg+0x80/0xa0 [ 171.264482][ T7992] ? netlink_getsockopt+0x590/0x590 [ 171.269735][ T7992] ____sys_sendmsg+0x61b/0x980 [ 171.274524][ T7992] ? __asan_memset+0x22/0x40 [ 171.279166][ T7992] ? __sys_sendmsg_sock+0x30/0x30 [ 171.284212][ T7992] ? __import_iovec+0x5f2/0x850 [ 171.289167][ T7992] ? import_iovec+0x73/0xa0 [ 171.293693][ T7992] ___sys_sendmsg+0x2a6/0x360 [ 171.298423][ T7992] ? __sys_sendmsg+0x2b0/0x2b0 [ 171.303234][ T7992] __se_sys_sendmsg+0x1d0/0x2c0 [ 171.308153][ T7992] ? __x64_sys_sendmsg+0x80/0x80 [ 171.313116][ T7992] ? lockdep_hardirqs_on+0x98/0x150 [ 171.318381][ T7992] do_syscall_64+0x55/0xb0 [ 171.322827][ T7992] ? clear_bhb_loop+0x40/0x90 [ 171.327586][ T7992] ? clear_bhb_loop+0x40/0x90 [ 171.332302][ T7992] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 171.338283][ T7992] RIP: 0033:0x7f0d81d9e159 [ 171.342712][ T7992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 171.362389][ T7992] RSP: 002b:00007f0d82c3d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 171.370871][ T7992] RAX: ffffffffffffffda RBX: 00007f0d82025fa0 RCX: 00007f0d81d9e159 [ 171.378917][ T7992] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000006 [ 171.386955][ T7992] RBP: 00007f0d81e3506b R08: 0000000000000000 R09: 0000000000000000 [ 171.394942][ T7992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 171.402978][ T7992] R13: 00007f0d82026038 R14: 00007f0d82025fa0 R15: 00007ffd298d8c18 [ 171.411016][ T7992] [ 171.414030][ T7992] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 171.421308][ T7992] CPU: 0 PID: 7992 Comm: syz.5.574 Not tainted syzkaller #0 [ 171.428611][ T7992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 171.438687][ T7992] Call Trace: [ 171.441984][ T7992] [ 171.444939][ T7992] dump_stack_lvl+0x18c/0x250 [ 171.449734][ T7992] ? show_regs_print_info+0x20/0x20 [ 171.454921][ T7992] ? load_image+0x420/0x420 [ 171.459416][ T7992] panic+0x2ca/0x720 [ 171.463299][ T7992] ? bpf_jit_dump+0xd0/0xd0 [ 171.467821][ T7992] __warn+0x2e0/0x470 [ 171.471818][ T7992] ? __skb_flow_dissect+0xb05/0x6e70 [ 171.477123][ T7992] ? __skb_flow_dissect+0xb05/0x6e70 [ 171.482411][ T7992] report_bug+0x2be/0x4f0 [ 171.486748][ T7992] ? __skb_flow_dissect+0xb05/0x6e70 [ 171.492054][ T7992] ? __skb_flow_dissect+0xb05/0x6e70 [ 171.497339][ T7992] ? __skb_flow_dissect+0xb07/0x6e70 [ 171.502620][ T7992] handle_bug+0xcf/0x120 [ 171.506889][ T7992] exc_invalid_op+0x1a/0x50 [ 171.511391][ T7992] asm_exc_invalid_op+0x1a/0x20 [ 171.516239][ T7992] RIP: 0010:__skb_flow_dissect+0xb05/0x6e70 [ 171.522129][ T7992] Code: c6 e8 9f 38 05 f9 85 db 0f 84 9a 06 00 00 80 3d ab 48 f4 05 01 0f 85 c0 06 00 00 e8 d5 34 05 f9 e9 d5 f9 ff ff e8 cb 34 05 f9 <0f> 0b e8 54 fa 0e 02 89 c3 31 ff 89 c6 e8 69 38 05 f9 85 db 74 18 [ 171.541731][ T7992] RSP: 0018:ffffc90004a1e0a0 EFLAGS: 00010283 [ 171.547792][ T7992] RAX: ffffffff88825685 RBX: 0000000000000000 RCX: 0000000000080000 [ 171.555755][ T7992] RDX: ffffc9000d44b000 RSI: 0000000000011000 RDI: 0000000000011001 [ 171.563718][ T7992] RBP: ffffc90004a1e6b8 R08: dffffc0000000000 R09: 1ffffffff223d6a0 [ 171.571686][ T7992] R10: dffffc0000000000 R11: fffffbfff223d6a1 R12: ffffffff8e8ca338 [ 171.579648][ T7992] R13: 1ffffffff1d19468 R14: ffffffff8e8ca342 R15: dffffc0000000000 [ 171.587621][ T7992] ? __skb_flow_dissect+0xb05/0x6e70 [ 171.592917][ T7992] ? __skb_flow_dissect+0x1eb/0x6e70 [ 171.598202][ T7992] ? __lock_acquire+0x357f/0x7d80 [ 171.603240][ T7992] ? bpf_flow_dissect+0x3f0/0x3f0 [ 171.608264][ T7992] ? verify_lock_unused+0x140/0x140 [ 171.613468][ T7992] ? rcu_read_lock_sched_held+0x8a/0x110 [ 171.619096][ T7992] ? __bpf_trace_rcu_stall_warning+0x160/0x160 [ 171.625245][ T7992] ? rcu_is_watching+0x15/0xb0 [ 171.630014][ T7992] ? cpufreq_update_util+0x91/0x230 [ 171.635220][ T7992] ? try_to_wake_up+0x680/0x10e0 [ 171.640152][ T7992] ? __lock_acquire+0x7d80/0x7d80 [ 171.645179][ T7992] ? do_raw_spin_unlock+0x121/0x230 [ 171.650386][ T7992] ? __queue_work+0xc0d/0xfd0 [ 171.655066][ T7992] ? mark_lock+0x94/0x320 [ 171.659413][ T7992] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 171.665427][ T7992] __skb_get_hash+0xf3/0x2e0 [ 171.670035][ T7992] ? queue_work_on+0x110/0x1f0 [ 171.674802][ T7992] ? __skb_get_hash_symmetric+0x1d0/0x1d0 [ 171.680525][ T7992] ? queue_work_on+0x19a/0x1f0 [ 171.685300][ T7992] ? once_disable_jump+0x150/0x1a0 [ 171.690415][ T7992] nft_trace_init+0x1bb/0x420 [ 171.695095][ T7992] ? nf_trace_fill_pkt_info+0x870/0x870 [ 171.700642][ T7992] ? ipt_do_table+0x13b3/0x15c0 [ 171.705498][ T7992] nft_do_chain+0x1523/0x1620 [ 171.710190][ T7992] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 171.716089][ T7992] ? nf_nat_inet_fn+0x7da/0xb20 [ 171.720953][ T7992] ? nf_nat_packet+0xf0/0xf0 [ 171.725543][ T7992] nft_do_chain_ipv4+0x160/0x230 [ 171.730478][ T7992] ? nf_tables_netdev_event+0x9d0/0x9d0 [ 171.736028][ T7992] ? nf_nat_ipv4_local_fn+0x411/0x560 [ 171.741400][ T7992] ? nf_tables_netdev_event+0x9d0/0x9d0 [ 171.746952][ T7992] nf_hook_slow+0xbd/0x200 [ 171.751368][ T7992] ? nf_hook+0x390/0x390 [ 171.755608][ T7992] nf_hook+0x228/0x390 [ 171.759675][ T7992] ? nf_hook+0xa2/0x390 [ 171.763826][ T7992] ? __ip_local_out+0x5f0/0x5f0 [ 171.768682][ T7992] ? nf_hook+0x390/0x390 [ 171.772923][ T7992] ? rt_set_nexthop+0x72f/0xa10 [ 171.777771][ T7992] ? ip_route_output_key_hash+0x13d/0x330 [ 171.783486][ T7992] ? ip_fast_csum+0x1ee/0x2b0 [ 171.788176][ T7992] __ip_local_out+0x4db/0x5f0 [ 171.792870][ T7992] ? nf_hook+0x390/0x390 [ 171.797125][ T7992] ip_local_out+0x2a/0x130 [ 171.801544][ T7992] iptunnel_xmit+0x4d0/0x910 [ 171.806138][ T7992] udp_tunnel_xmit_skb+0x22f/0x380 [ 171.811256][ T7992] tipc_udp_xmit+0x861/0xb40 [ 171.815848][ T7992] ? tipc_udp_xmit+0xb7/0xb40 [ 171.820521][ T7992] ? tipc_udp_msg2addr+0x1d0/0x1d0 [ 171.825636][ T7992] ? __asan_memcpy+0x40/0x70 [ 171.830221][ T7992] ? __pskb_copy_fclone+0x978/0x1000 [ 171.835508][ T7992] ? __asan_memcpy+0x40/0x70 [ 171.840095][ T7992] ? __pskb_copy_fclone+0x978/0x1000 [ 171.845386][ T7992] tipc_udp_send_msg+0x27e/0x3e0 [ 171.850329][ T7992] tipc_bearer_xmit_skb+0x2ad/0x3f0 [ 171.855526][ T7992] ? tipc_bearer_xmit_skb+0xaa/0x3f0 [ 171.860807][ T7992] ? tipc_bearer_min_mtu+0x1d0/0x1d0 [ 171.866110][ T7992] __tipc_nl_bearer_enable+0x10a7/0x13e0 [ 171.871762][ T7992] ? tipc_nl_bearer_disable+0x30/0x30 [ 171.877137][ T7992] ? trace_contention_end+0x39/0xe0 [ 171.882346][ T7992] ? tipc_nl_bearer_enable+0x17/0x30 [ 171.887628][ T7992] ? mutex_lock_nested+0x20/0x20 [ 171.892561][ T7992] ? __nla_parse+0x40/0x50 [ 171.896978][ T7992] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 171.903299][ T7992] ? genl_family_rcv_msg_attrs_parse+0x20a/0x290 [ 171.909625][ T7992] tipc_nl_bearer_enable+0x22/0x30 [ 171.914734][ T7992] genl_family_rcv_msg_doit+0x21a/0x310 [ 171.920289][ T7992] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 171.926188][ T7992] ? bpf_lsm_capable+0x9/0x10 [ 171.930855][ T7992] ? security_capable+0x89/0xb0 [ 171.935708][ T7992] genl_rcv_msg+0x611/0x7a0 [ 171.940212][ T7992] ? genl_bind+0x360/0x360 [ 171.944626][ T7992] ? __tipc_nl_bearer_enable+0x13e0/0x13e0 [ 171.950442][ T7992] netlink_rcv_skb+0x235/0x4c0 [ 171.955202][ T7992] ? genl_bind+0x360/0x360 [ 171.959615][ T7992] ? netlink_ack+0x1160/0x1160 [ 171.964389][ T7992] ? __lock_acquire+0x7d80/0x7d80 [ 171.969422][ T7992] ? net_generic+0x1e/0x240 [ 171.973929][ T7992] ? down_read+0x1ac/0x2e0 [ 171.978345][ T7992] genl_rcv+0x28/0x40 [ 171.982328][ T7992] netlink_unicast+0x7b1/0x930 [ 171.987097][ T7992] netlink_sendmsg+0x8d0/0xbf0 [ 171.991868][ T7992] ? netlink_getsockopt+0x590/0x590 [ 171.997073][ T7992] ? apparmor_socket_sendmsg+0x8e/0x330 [ 172.002618][ T7992] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 172.007904][ T7992] ? security_socket_sendmsg+0x80/0xa0 [ 172.013358][ T7992] ? netlink_getsockopt+0x590/0x590 [ 172.018556][ T7992] ____sys_sendmsg+0x61b/0x980 [ 172.023326][ T7992] ? __asan_memset+0x22/0x40 [ 172.027918][ T7992] ? __sys_sendmsg_sock+0x30/0x30 [ 172.032943][ T7992] ? __import_iovec+0x5f2/0x850 [ 172.037801][ T7992] ? import_iovec+0x73/0xa0 [ 172.042308][ T7992] ___sys_sendmsg+0x2a6/0x360 [ 172.046987][ T7992] ? __sys_sendmsg+0x2b0/0x2b0 [ 172.051788][ T7992] __se_sys_sendmsg+0x1d0/0x2c0 [ 172.056638][ T7992] ? __x64_sys_sendmsg+0x80/0x80 [ 172.061586][ T7992] ? lockdep_hardirqs_on+0x98/0x150 [ 172.066784][ T7992] do_syscall_64+0x55/0xb0 [ 172.071286][ T7992] ? clear_bhb_loop+0x40/0x90 [ 172.075961][ T7992] ? clear_bhb_loop+0x40/0x90 [ 172.080639][ T7992] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 172.086530][ T7992] RIP: 0033:0x7f0d81d9e159 [ 172.090940][ T7992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 172.110538][ T7992] RSP: 002b:00007f0d82c3d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 172.118952][ T7992] RAX: ffffffffffffffda RBX: 00007f0d82025fa0 RCX: 00007f0d81d9e159 [ 172.126919][ T7992] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000006 [ 172.134907][ T7992] RBP: 00007f0d81e3506b R08: 0000000000000000 R09: 0000000000000000 [ 172.142872][ T7992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 172.150836][ T7992] R13: 00007f0d82026038 R14: 00007f0d82025fa0 R15: 00007ffd298d8c18 [ 172.158816][ T7992] [ 172.162075][ T7992] Kernel Offset: disabled [ 172.166469][ T7992] Rebooting in 86400 seconds..