last executing test programs:

16m41.997316995s ago: executing program 32 (id=84):
capset(&(0x7f0000a31000)={0x20080522}, &(0x7f0000000080))
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff}, 0x13f, 0x4}}, 0x20)
write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {}, 0xa9c7, 0x9}}}, 0x90)

15m30.679725618s ago: executing program 33 (id=251):
r0 = socket$nl_route(0x10, 0x3, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x6000)
sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="01020400000000002800128008000100736974001c00028008000200c612000106000800190000"], 0x58}}, 0x0)
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000002c0))
getpid()
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f00000009c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket$unix(0x1, 0x1, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socket(0x2b, 0x1, 0x1)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
landlock_restrict_self(0xffffffffffffffff, 0x0)
landlock_create_ruleset(0x0, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xffff, 0xe}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}}, 0x24040084)
getgid()
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB="28010000100007000000000000000000ff020000000000000000000000000001e00000020000000000000000000000004e200000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc000000000000000000000000000000000000000000000000000000000000000200000000000000fdffffffffffffff0000001000000000ffffffffffffffff00000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a000000000000000000000a000200340000000000000014000e00fe8000000000000000000000000000bb2400090003001500000000000100000000000080b40000000000000005"], 0x128}}, 0x0)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast1, 0xffff, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0)
sendmsg$netlink(r0, 0x0, 0x4014)

13m29.547252173s ago: executing program 34 (id=516):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e)
sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r0, &(0x7f0000000480), 0x400034f, 0x2, 0x0)
truncate(&(0x7f0000000900)='./file1\x00', 0x3000000)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d)
fallocate(r2, 0x0, 0x37e9, 0x2f92)

13m0.898912243s ago: executing program 0 (id=626):
socket$inet6_mptcp(0xa, 0x1, 0x106)
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401)
socket$inet_sctp(0x2, 0x1, 0x84)
socket$inet_smc(0x2b, 0x1, 0x0)
timer_create(0x0, 0x0, &(0x7f0000000300))
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x2]}, 0x8, 0x80000)
socket$nl_route(0x10, 0x3, 0x0)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8)
syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00')
pselect6(0x40, &(0x7f00000001c0)={0x0, 0x80002, 0x3, 0xfffffffffffffffd, 0x3, 0x40000000080, 0x9}, 0x0, &(0x7f0000002080)={0x3ff, 0x0, 0x8, 0x8, 0x4000, 0x663, 0x7fffffff, 0x6608c64b}, 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x20000, 0x0}, &(0x7f0000000240)="588d7acda0b2", 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8915, &(0x7f0000000000)={'erspan0\x00', @random="0200ac7f7f00"})

12m59.898548474s ago: executing program 0 (id=627):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x38, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x9c}, 0x1, 0x0, 0x0, 0x4000854}, 0x40)

12m59.693910366s ago: executing program 0 (id=628):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
socket$unix(0x1, 0x1, 0x0)
r2 = socket(0x400000000010, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd21, 0xfbffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x400)
sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newtfilter={0x88, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0xf}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_ife={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x92, 0x4, 0x8, 0xffeffffc}, 0x1}}, @TCA_IFE_METALST={0x4}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x88}}, 0x4c800)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x200, 0x0)
close(r3)
socket$inet6(0xa, 0x2, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}})
r4 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$kcm(r4, &(0x7f0000000500)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r5, 0x26}, 0x80, &(0x7f0000000080)=[{&(0x7f00000002c0)='\r', 0x1}], 0x1}, 0x4)

12m58.035988595s ago: executing program 0 (id=629):
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x2a5b091, 0x0)
mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0)
mount$9p_unix(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0/../file0/file0\x00', 0x0, 0x1000, 0x0)

12m57.82259387s ago: executing program 0 (id=630):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0)
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000))
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000400)={'wlan1\x00', <r4=>0x0})
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r3, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x48, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@msdu=@type10={{}, {}, @from_mac=@broadcast, @device_b, @device_a, {0x0, 0x45}}}}]}, 0x48}}, 0x800)
prctl$PR_SET_MM(0x23, 0x4, &(0x7f0000ffd000/0x2000)=nil)
r6 = socket$netlink(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000440)={0xd8, 0x1403, 0x1, 0x1ffff, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bridge_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bond\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'team0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bond_slave_0\x00'}}]}, 0xd8}, 0x1, 0x0, 0x0, 0x80c9}, 0x20000000)
sched_setparam(r0, &(0x7f0000000000)=0x1)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1, 0x8000}, 0x28)
ioctl$VIDIOC_DQEVENT(0xffffffffffffffff, 0x80785659, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000140)={0x3, 0x98f90f, 0x1})
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', <r8=>0x0})
sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@bridge_delvlan={0x24, 0x71, 0x425, 0x70bd2d, 0x7f, {0x7, 0x0, 0x0, r8}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x63, 0x1}}}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x4040010)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)

12m57.41711884s ago: executing program 0 (id=631):
socketpair$unix(0x1, 0x2, 0x0, 0x0)
setuid(0xee00)
writev(0xffffffffffffffff, 0x0, 0x0)
io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0xa, 0x20002f7})

12m56.845619861s ago: executing program 35 (id=631):
socketpair$unix(0x1, 0x2, 0x0, 0x0)
setuid(0xee00)
writev(0xffffffffffffffff, 0x0, 0x0)
io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0xa, 0x20002f7})

7m30.187108351s ago: executing program 8 (id=1551):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00')
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x804000, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0])

7m29.872714252s ago: executing program 8 (id=1555):
r0 = epoll_create1(0x0)
r1 = socket$unix(0x1, 0x5, 0x0)
close(r1)
r2 = socket(0x10, 0x3, 0x0)
r3 = syz_open_dev$vim2m(0x0, 0x7f, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000380)={0x1, @pix_mp={0x0, 0x0, 0x34325842}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000300)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0xffff, 0x4)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000000c0)={0xa0028000})
r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/wakeup_count', 0x0, 0x10)
read$char_usb(r7, &(0x7f0000000340)=""/170, 0xaa)

7m27.774106203s ago: executing program 8 (id=1563):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0)
sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x20040090}, 0x4010)
sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003d0000000000080003252d3a4400080001000000000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x20004810}, 0x40)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket$unix(0x1, 0x1, 0x0)
r3 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', <r4=>0x0})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
r8 = bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="12000000060000000400000002"], 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r8}, &(0x7f0000000040), &(0x7f0000000140)=r7}, 0x20)
r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NBD_CMD_CONNECT(r9, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01002cbd700000000000010000000c00020002000000000000001c0007800c00018008000100", @ANYRES32=r6, @ANYBLOB="0c00018008000100", @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x55ebfcb85e78e904}, 0x4)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000002f000903feff00000000000006"], 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0)
recvmsg(r11, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x2000)
recvmsg$unix(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000004c0)=""/8, 0x8}], 0x1}, 0x10022)
r12 = socket(0x400000000010, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r4, 0x3e}, 0x80, &(0x7f0000001f40)=[{&(0x7f0000001d80)="ca", 0x1}], 0x1}, 0x20004014)
setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000740)=@nat={'nat\x00', 0x1b, 0x5, 0x388, 0x0, 0xf8, 0xffffffff, 0x0, 0xf8, 0x320, 0x320, 0xffffffff, 0x320, 0x320, 0x5, &(0x7f0000000340), {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x43}, 0xffffffff, 0xffffffff, 'vlan0\x00', 'vlan0\x00', {0xff}, {0xff}, 0x2e, 0x2, 0x20}, 0x0, 0xc0, 0xf8, 0x0, {}, [@common=@addrtype={{0x30}, {0x200, 0x0, 0x1, 0x1}}, @common=@socket0={{0x20}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x11, @remote, @loopback, @icmp_id=0x65, @icmp_id=0x68}}}}, {{@ip={@local, @multicast1, 0x0, 0xff000000, 'syz_tun\x00', 'ip_vti0\x00', {}, {}, 0x67, 0x1, 0x48}, 0x0, 0x70, 0xa8}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x4, 0x2, 0x2}, {0x3, 0x1, 0x1}, {0x3, 0x1}, 0x5, 0x1}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x4, @loopback, @broadcast, @icmp_id=0x68, @gre_key=0x1}}}}, {{@ip={@broadcast, @private=0xa010102, 0xffffff00, 0xffffffff, 'bridge0\x00', 'pimreg0\x00', {}, {0xff}, 0x5c, 0x2, 0xb}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0x2c}, @icmp_id=0x64, @gre_key=0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3e8)

7m25.524082951s ago: executing program 8 (id=1572):
socket$inet6(0xa, 0x2, 0x3a)
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x200000, &(0x7f0000000140)={[{@stripe={'stripe', 0x3d, 0x4}}, {}, {@sysvgroups}, {@norecovery}, {@dioread_nolock}, {@oldalloc}, {@oldalloc}, {@sysvgroups}, {@norecovery}]}, 0x3, 0x566, &(0x7f00000015c0)="$eJzs3V9rW+UfAPDvSdv9//3WwRjqhRR24WQuXVv/TBA2L0WHA72foc3KaLqMJh1rHWy7cDfeyBBEHIgvwHsvh2/AVyHoYMgoeuFN5aQnW9YkTZtlNvN8PnC25znnpN/z5DnPk+/JSUgAuTWR/lOIeDkivkoiDrdsG41s48TGfmuPbsymSxLr65/8kUSSrWvun2T/H8wqL0XEz19EnCy0x62trC6UKpXyUlafrC9enaytrJ66vFiaL8+Xr0zPzJx5a2b63XfeHlhbX7/w17cf3//gzJfH17758cGRu0mci0PZttZ2PINbrZWJmMiek7E4t2nHqQEEGyZJrx06nAPsvpFsnI9FOgccjpFs1AP/fTcjYh3IqcT4h5xq5gHNa/sBXQe/MB6+v3EB1N7+0Y33RmJf49rowFry1JVRer07PoD4aYyffr93N12ix/sQNwcQD6Dp1u2IOD062j7/Jdn817/T23jXb3OMvL3+wG66n+Y/b3TKfwqP85/okP8c7DB2+9F7/BceDCBMV2n+917H/Pfx1DU+ktX+18j5xpJLlyvl0xHx/4g4EWN703q/93Na8790SeM3c8HsOB6M7n36MXOleqnPcG0e3o545Un+m0Tb/L+vketu7v/0+biwzRjHyvde7batd/tbDT4DXv8h4rWO/f/kjlay9f3Jycb5MNk8K9r9eefYL93i76z9g5f2/4Gt2z+etN6vre08xvf7/i5329bv+b8n+bRR3pOtu16q15emIvYkH7Wvn37y2Ga9uX/a/hPHt57/Op3/+yPis222/87R7mnQMPT/3I76f+eFXz/8/Ltu8bfX/282SieyNduZ/7Z7gM/y3AEAAAAAAMCwKUTEoUgKxcflQqFY3Ph8x9E4UKhUa/WTl6rLV+ai8V3Z8RgrNO90H275PMRU9nnYZn16U30mIo5ExNcj+xv14my1MrfbjQcAAAAAAAAAAAAAAAAAAIAhcbDL9/9Tv43s9tEBz52f/Ib86jn+B/FLT8BQ8voP+WX8Q34Z/5Bfxj/kl/EP+WX8Q34Z/5Bfxj8AAAAAAAAAAAAAAAAAAAAAAAAAAAAM1IXz59Nlfe3Rjdm0PndtZXmheu3UXLm2UFxcni3OVpeuFuer1flKuThbXez19yrV6tWp6Vi+Plkv1+qTtZXVi4vV5Sv1i5cXS/Pli+Wxf6VVAAAAAAAAAAAAAAAAAAAA8GKprawulCqV8pJC18LZGIrD6LuQ9Orls9nJ0FeI0d1voMJzKOzyxAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALf4JAAD//5CPL9Y=")
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x8004587d, &(0x7f0000000080)={@desc={0x1, 0x0, @desc2}})
mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000780)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000003c0)=@file={0x1, './file0\x00'}, 0x6e)

7m24.591291499s ago: executing program 8 (id=1580):
setns(0xc9, 0x0)
socket(0x2a, 0x2, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x94, 0x7fff0000}]})
close_range(r0, 0xffffffffffffffff, 0x0)

7m21.033514056s ago: executing program 8 (id=1588):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2042, 0x19d)
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0)
r4 = fanotify_init(0xf00, 0x1000)
fanotify_mark(r4, 0x105, 0x10000839, r3, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x42, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2)
readv(r4, 0x0, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c)
listen(r5, 0x6)
syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0)
r6 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write$FUSE_OPEN(r6, &(0x7f0000000080)={0x20, 0x8000000000000009, 0x0, {0x0, 0x8}}, 0x20)
clock_gettime(0x3, 0x0)
quotactl_fd$Q_SYNC(r5, 0xffffffff80000101, 0x0, 0x0)
clock_settime(0x0, 0x0)

7m20.00496675s ago: executing program 36 (id=1588):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2042, 0x19d)
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0)
r4 = fanotify_init(0xf00, 0x1000)
fanotify_mark(r4, 0x105, 0x10000839, r3, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x42, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2)
readv(r4, 0x0, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c)
listen(r5, 0x6)
syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0)
r6 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write$FUSE_OPEN(r6, &(0x7f0000000080)={0x20, 0x8000000000000009, 0x0, {0x0, 0x8}}, 0x20)
clock_gettime(0x3, 0x0)
quotactl_fd$Q_SYNC(r5, 0xffffffff80000101, 0x0, 0x0)
clock_settime(0x0, 0x0)

5m14.892693468s ago: executing program 3 (id=2021):
r0 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x0, 0xe8, 0x0, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@multicast1, @broadcast, 0xff000000, 0xff, 0x9, 0x12, {@empty, {[0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, 0x0, 0x3, 0x3, 0xa90a, 0x6, 0x3ff, 'veth0_vlan\x00', 'wg2\x00', {0xff}, {0xff}, 0x0, 0x71}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f8}}, {{@arp={@empty, @loopback, 0x0, 0xffffffff, 0xe, 0x2, {@mac=@local, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@random="8e932bc3db22", {[0x0, 0xff, 0x0, 0xff]}}, 0x0, 0x0, 0x400, 0x4fd9, 0x0, 0x98dc, 'team_slave_1\x00', 'macsec0\x00', {0xff}, {0xff}, 0x0, 0x280}, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @loopback, 0xf, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, @loopback, @multicast1, 0xf}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440)
r1 = socket$unix(0x1, 0x5, 0x0)
sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r1, @ANYBLOB="3bf81bb9f9"], 0x20000600}}, 0x0)
r2 = socket$unix(0x1, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x60, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r3 = getpid()
sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, 0x0, 0x0)
syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x80)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'})
r6 = socket$nl_route(0x10, 0x3, 0x0)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fefdffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400010000000404000001000000b70500002a0000006a0a00fe00000000850000000b000000b70000005920000095000000000000006c8457920ba0fad478e86823cc07b88f5d76781dcb7729f41726a067818b990b13bfdd5db1b7ef826f015cd03018d546fa9b6827767c171a4f0720596bb3b4d821d976f5843061cc2e3afbae82d7932d4f91f718f0e56315040148e11bac31821236192321fa3b3042"], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000040)=""/24, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0}, 0x50)
sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0xc0d0)
openat(0xffffffffffffffff, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x58)
unshare(0x6a040000)
ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305)

5m12.779468796s ago: executing program 3 (id=2029):
r0 = socket$packet(0x11, 0x3, 0x300)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56d43, 0x1, 0x25d7dbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7, 0xa, 0x4000000, 0x70000000}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x50}, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r3)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', <r4=>0x0})
sendto$packet(r0, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14)

5m11.261896389s ago: executing program 3 (id=2037):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(r0, &(0x7f0000004d80)={0x0, 0x0, 0x0}, 0x4000000)

5m10.082689898s ago: executing program 3 (id=2039):
syz_usb_connect(0x6, 0x36, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000440)='net/sockstat6\x00')
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0)
ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0xeeef0000})
ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000740)=""/183, 0x0, 0x9000})
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1)
ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@my=0x1})
r2 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10)
close_range(r0, 0xffffffffffffffff, 0x0)

5m8.971150076s ago: executing program 3 (id=2047):
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0f00000004000000080000000300000000", @ANYRES32=0x0, @ANYRES32], 0x50)
socket$can_raw(0x1d, 0x3, 0x1)
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$inet6(0xa, 0x2, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$inet_udp(0x2, 0x2, 0x0)
socket(0xa, 0x5, 0x0)
syz_open_dev$usbmon(&(0x7f0000000100), 0x5, 0x80000)
socket(0x10, 0x80002, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
io_uring_setup(0x2301, &(0x7f0000000440)={0x0, 0x8270, 0x800, 0x5, 0xa2})
socket$packet(0x11, 0x3, 0x300)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$igmp(0x2, 0x3, 0x2)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r5=>0x0})
sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r5, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r1], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)

5m8.631979445s ago: executing program 3 (id=2052):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={&(0x7f00000001c0), 0xc, &(0x7f0000000200)={&(0x7f0000000240)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)

5m3.71819729s ago: executing program 7 (id=2068):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000f40)={'pimreg\x00', 0x3c32})
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000300)=[{0x0}, {&(0x7f0000000040)="010130a7cd08f1cac7c721e886dd", 0xe}], 0x2, 0xa74a, 0x80000000, 0x10)

5m2.002771303s ago: executing program 7 (id=2075):
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000280)='./file0\x00', 0x280440e, &(0x7f0000000300)={[{@debug}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0xab}}, {@noblock_validity}, {@errors_remount}, {@test_dummy_encryption_v1}, {@norecovery}, {@dax_always}, {@nogrpid}, {@minixdf}]}, 0x1, 0xbf3, &(0x7f0000000bc0)="$eJzs3M1rXGsZAPDnnEy+2tRJRcS6aUSkBXGaVlJsEWyl4saFoFuhIZ2UkOkHSaQmDTjRf0DUf8CNCy1KF3bdjYJbN1q3FhcXyiW3uRcul3tzOTNnkjSZyUczk5O2vx+8mffjnPM+T04y57wwcwJ4Z41lP9KIMxFxM4ko5/1pRAw0akMR9eZ2a6vLUx+tLk8lsb7+k/eTSCLi5eryVOtYSf56Mm8MRcS/vp/EF3+9c975xaXZyVqtOpe3LyzcuX9hfnHpWzN3Jm9Xb1fvXrz8nYlLE5fHr0x0LdeP/3ftyYdf++H/65/86dNHH/zuj0lci5F8bGseedaHNhZjG7+TrUoRMdmF4x8HfXk+W/NMSnvslPY4KAAAOkq33MN9OcrRF5s3b+X4+78LDQ4AAADoivW+iPVX9Mf2HgAAAOBNl1jtAwAAwFuu9TmAl6vLU61S7CcSjtaL6xEx2sx/LS/NkVLUG69D0R8RJ14msfVrrUlzt0Mbi4jn/73y16xEm+8h91p9JSK+0u78J438R/NvQm/PP42I8S7MP7at/Sblf60L8xedPwDvpqfXmxeynde/dOP+J9pc/0ptrl2vo+jrX+v+b23H/d9m/n0d7v9+vM85HpbiQdsHweT5f/fJD/7SKtn82esh09q3FysRXy21yz/ZyD/pkP/NPY6dRPMQ5c8eVDttU3T+63+IOBft829Jdn8+0YXpmVp1vPmz7Rwr/5z4c6f5i84/O/8nOuS/y/kfyvruv3Kkzg/1+dmNG493dOab751/+t5A8tNGbSDv+cXkwsLcxYiB5Ec7+y/tnm9rm9YxsvzPf333//92f//Ze0I9/9vIUlnJX7P2r7bN+b1HD//WKZ7W+q/I83/r4Oe/0febfc7xjX/89vz2vtbztbauf7OSzf88aa6FAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAljYiRSNJKRCSNeppWKhEnI+JLcSKt3Ztf+Ob0vZ/fvZWNRYxGfzo9U6uOR0S52U6y9sVGfbN9aVv72xFxOiJ+Xx5utCtT92q3ik4eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACADScjYiSStBIRaUSsldO0Uik6KgAAAKDrRosOAAAAAOg5638AAAB4+1n/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0GOnzz59lkRE/epwo2QG8rH+QiMDei0tOgCgMH0H2Ha4h3EAR69UdABAYQ64xj/I7QLwhkj2GB9q25u9ewz2JB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjqdzZ54+SyKifnW4UTID+Vh/2z3OHmF0QC+lRQcAFKZvt8HS0cUBHL3X/hc/1d04gKPXfo0PvEuSPcaHNrepvzoy2LOYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADh+RholSSsRkTbqaVqpRJyKiNHoT6ZnatXxiPhCRPyn3D+YtQdbO/cVGzsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADdM7+4NDtZq1XnXqeSHG73t7cScSzCaFMZPR5h7Fn55fEI42grSaMyVHQYzUrR70wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABRhfnFpdrJWq87NFx0JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAULT5xaXZyVqtOrePyuODbLylUnSOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU5/MAAAD//6AkBvc=")
openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev\x00')
pread64(r3, &(0x7f0000000080)=""/102356, 0x18fd4, 0x1c2a)

4m59.683564285s ago: executing program 7 (id=2081):
r0 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$get_persistent(0x16, 0x0, r0)

4m59.320264698s ago: executing program 7 (id=2085):
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wg0\x00'})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf32ce000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
r3 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc1}, &(0x7f0000000080)={0x0, "5d9bc136c963254c661fb620148b6f72ca6ae2a44829bfa79ec13499f8ec9077d85d879711d98bb1687ad36dfe5f14a7b0ce15c1e6be0e7ecabfdfde0dfa00b1"}, 0x48, 0xffffffffffffffff)
keyctl$set_timeout(0xf, r3, 0xfffffffffffff423)
add_key$user(0x0, 0x0, &(0x7f0000000400)="3aa6947b74aaae8ec03d", 0xa, r3)
syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000083c0)="4e5350994ebf71ce3049a58c5d050078bf16b0757a4c27b455e2a547739587dd3380b5df8f40a0696c5bd6cdb672cffe4d878000000092095b9ebf3e92fe31d8cd74275d857d34a74f7eecc7fac15e2f148d4e9d47bb45b858bbf078999970d180f28d7b2cefd92635d45a563d9229c9fd770efdc0848e52fa5efd9ada5c94a1ba94b4b7c7507f8b0819bb20910f9f50a83a010abbe126dd9f6a7b84eab6b0d5ce78d2ade77a5f7e4e997df1d03ffab4b4c945d803e4457909013127a98769c938c237f37263bc509a42bc56ff2dbf80e847e2c407009eef94f18e1e59069d62298fdbadae007ffbdf403c5049a4530ac0abecceb5608da02754c9a575af52c0b7e41226e2d642a814861c4310c935bcbae413516dde2132652b39c7aa0218a6ce65dabb4494965209ce879ba7e7e59039db5c1d36d6a7f86d72dd59954fd6f46124a2506b245a0db11aa89d2feb312a6596ea2fecaa7b6021f37a255f628da7ff6b6c36b514d3b6be34e505f9dac6acfb888198004699fb350ac93431533554658c4957df36703591438d6488bc03dd8290a75ebb367a481a50e79a46b04d005649cabd79e5c6326c066bc2b6fc5febb87ef66d832ef31a16c2a450a0b990fb549a5d810c928d1a81fa1dc795db2607ac7d46cb5716b68acdeb00987e429fe6a394632c83b43336e7b51d9cfdb50e83d8c6ba1784d9f74c16b476e048e65e7ac0af683b347d7377ac1795422e00e5bd8da9b313af83abb3348861116de7a99959169b7dff9f7d9b7a6d107f2e76670a6214a419bf8298f80eb570fa29264ba57a383c5ec5836ce33104ecaf1aec76e311280a1d2c8bd7abff3a5a242e6a637f7db63038ef5d78aca9c680d72b60da4dbeb0e1e683ddc82898647c589a81b8f92db06711d8a0af05560cd77fa7005283db71e8da21713fccd450822062b994d152aaed2cdcf0dec9c60617e15ba4df628da4e71279bf9d1eee5c7f055c27cddfdd45f9225d5d5529ef7119e2e3c9838e7362971e069be487797e949b24297de19c61340d1cd7a2bfa3880b91a71e934720a59e1e0ea992d2a1633a0852ad8addfcab73a291e35745e694a6471f429b124305886c1f79f67c78de3f3ec998c91e7fc59d26766cd446f6f0de603f2c6892e13cdaa37d9e8e118d098b6986ccd991993ec152193e7d77394b05b99e7d310c506707f1be52249438fba9615f6dad2ec7244fedf36e34ec311b7d6bee64271d6491079e161190ded7e28e2ada4307a9b2986c267b1a30d2f720ff23408011f1d589ce9ee77f981c7833656ccf7df5b3a87ec253ff7c7ef1e67ceeb10c93e3fa683cdadad65850ffbc402b7744e94cdecef9db9d264c755c53d36278df23d4c9685fdefa69f7588a33b8a64b35191ee81abcb9765577d175cb06e31c582807ff7243bfef44961fbc0f8a235242f51ee991ea621803d4dcfed90d26f004b299425bf219f6d185fe6e088ae44601b03defada18794feac93787696a5d419f09f769bc590f43d2df6a131f6895da2de120c2644685e57b1d476c6aba5881e954fb2575356452b118b942cb02b4ea0fcf8f1bbb9a23b6e32c9d0accd3dd861452a3ad77b38fe709e216974932deb5397fd8033ff0e073d93ac0b4be762bca0424d69bd57b22ba914133f87671a29498b268c2911e793215463ca2164e38059456107dcb29beedfd6277e2b41a11d1c6f1361b19875c9384f04f9c53c1856d71f360a8fafe05f7aef750ec0cf2bfcfa971c017ad071b69a18fdaf970b384d4c889cfa5a0397dbe89543a5c6302645d6edf959aa60709ce0225fe6c3266c7ef62157ac8e78fddcd8a1f2ca5b58128218d19276885515775326aeeee0226cc810843eb05144bf8e2fe3340cf60b32cafd96d23cd7d0d3adcbdfec9a2a3d88307c362633b1c5637608ea8476d900b3f836a9734bc5862ef52983577128d3f74b903b0e3bf64326c1b564ae42aeeb0c07702b63a9ff74a2af6b45e5185a53f36c17bc29dfbc0ea28ca5cca43a15d751e9887ad3e6a87faacb6a278c4c8a8d21b9a77b9776f33102a6e645e99cc5cbc543ed0674282c2b9f8e5d14c2599aa9ac8f81438c77f2b9368bdac82edcdc5366f39adec9e9a3fbd55b79abc16d2ebff26b7d0c88f18b486e5836333575e3fc7808cb423b44781c57965767862922b4ff32d9bae76296843a46f430211c27ef9db168430026a5691623284dfd459dbdd1f1a6ec9bfad666507e6eacb1e2a7866da2e12e6d596d0bbb150500590013d9288af20596447f97bf1744eb9cfb244d8fca269b1fb71e14de664be4e95d83fff1d7abcfebcf3e78c1c66d28f260fb0c19f9fbcd2abbdd7dd7246e49dc25d954bf25f810a2ff6f9069dfdc62e7170fe3b0964b2ac95024256dfa3e7a426be5bb5f707fd82c2b3afec5d5dcf5bbb8fcb6dbc1b59f6c5330966c70d8b016956903a4278817414ba3652a102d7e7e37ecc79400267fc3bf7601c0731f87d479c33f100735e748874155267f708cea49d549e93cf7a398b20373dc90ad9afd56d9c77cd24e2c4a18f7130b366c7fe5b26bc4d11ca1ed1b98fa0b4d7396f82ae6593f4575d19f4d8fd586c991129e5cbe15c8bacc89c3ee15ca471dea966b5c48ede0d3ba2a7e28c75c04e6a4aa49a61f4e391ffe78eb5e40a5ef349f3aa4d15f2291cc86ec7e47ae301bf0b6083dae44b695820a893d46732553ef15ed1c16d28268d52a7e3a7e7c009d0c0708a356d3310c1ebcbcca4d7acf433e34bfc9fc115498142dcc725e7a16879c75e4c2f01c6c98b39619f3248bf530e6ee593467e38cf4026cfdc4db6296565722d587f3c580750b1453ecc141c0461495551297d88ae034acbd4f5e80ce198e6640c4c1e9501529988109cef006eb2090a6fcd974d7f60290b78f1a8ce3051ac2d69636c3219f0a6ad8c254764396a1684b2fd9805b1853525f2e640e513197283cc4d4073ac033e0539a88f08aabe1423cd40b8a7e073437d812b57a5d39a0531dcbe13f4466e89efc66c2a1e4b39a3e0b3073c9d44e6cf9b85f4df5c4e03628d05bc0f94ec04234c9eca4ed17463f190406834b02888728f625371cda75d15ec19efebd59f00ab659eb94eb88bcb2110862a369ad599610c1530fcc118f5b82205bc5215fe3623ac8ec297d8ff4eee75ace20731c5d505e6605c26203b7f754164c9463f0a6eefe3a2880b8e06e7bc66bb2adcc1a3f9b0325f5ec31d12a25f1f73c2aa6bb3a7680d786a082a63b13cce1822fa6a4b085a871ae3409eecbc1fd8661b5d52bb2b8b72f23e24a225075f272ed2ba0c6c5c693811a0ef8db6da7cfe7c966c647f0187ad223eedb1012a5b7af103e98464ac768c79b21ca45b12a52cf261de0d367442cda71c4b8ee39c94ded1b22ba06c13836cb467ebab4efea07bdf1e3de8da56a0ee6d4f848011253cc21fac10700003513d3167b7a73e0d752b861c49814bc5410ebe53a0264f76068c91ee6ec9e2daa343482b2f0f06e605c5aaf81f2a3cd570efc2094b4bc452f9526f1bbe7b22b694fb8109a5a987fabf6250912d6099e67da9cac79e8b6f2cce4702d1f17cbc5d06c38b8a48155ec758369c185ded839fb58cd736fbb74105fe5baf44e7e3ed06843f23601b60a43b1f88fd29e9b3f58479f9b95392a39d5ba1a31ee4441ca2d1fb57c0a8678a07a724b7a65b2ab16d1da197f435bce3ef003fce27fa2f0a67c9dd6c930a4bcf59e79e57b010000006fe34972958c28b56642d14ea89bf4d7d6f7fcbcf4fd92bd08fc9fe424de4359112b11f81fbdc1505658363697713ff6e1f8ca3c4be34a79993a9091f6017cda6c7489ae5c07062555231427c3eb42a049f42d22a060983b044a7d34ab5d2b5386cca79af72396a48aad6b8dcd7855410fc6106e4a165994f26efff1e7ea0aa8f560333b5dfdb2a0d899b0fda955155f90c75effd3c9535d88508e836feb7807d57b2a57cca42d3d08fe7de60d2a33376f49bdacdd3f814bd0927f417f15ad62a10b302f46dc53a26fd997f3af46bbf990b6ada45ef83ce13029d167c65134e7b82b59ddfdc367e61c40defd2732ccebb1d4000f6c742df964e1fb390c255d2b1dfc745c6ab34af8096b5b67aa179e3f341854f7a69f7bf47664c832037ec7a78f8e27209e3f20f833fb6e8c0fc4a40920a5ad2b0618982ff72540009d5db82f0f5bcaed2a27f35d1e50eaa0cf8e48c7a2d43c25d0264db750a7f33b44a4bfaae576cf9ee7594ed204513899566564ed8bbc97ed18b1d8868f926a5c70ac06fbac1eade46792186be7bf8ffa3301239edd093449b7d77192782b5111c14169d2b4a1b3443ad62e4abdf11aac6a5b89a5b20ab0ad0abd949b9d64582c67ffce018e7e46de4091fcc77a65b971fc67c8d9cbf0c341ca1d46ae2fad159afe86dd1df9b8246411827e19535ca0aa9f83050b06e70aa2737f27e93d584a9cef878a642e9361efaa5d20bd8da901fa2e064656f686d3b3ea31d1d850ae9196b7764548f5c6450a32a717e09b6b7e75d43fbbda76e43a24f186d5578933f408bfa28e0435cde525fb91e71d92d704cc5a9b5e3db7aaec46d2b1f8dcb3f921f69bd7397c96a1e132c39c8f1656cea4365c779abf76199cb5b6aada022edec5c901cdafa2e7f3765af9c8b20cb1a6785085fcb0dc901367b89051bdfdc6b68c5215fd04e2b3c7e1c454a4d21132953b25c50995af0f7159a5a8d0a1621f4808f126a5bd40ddc79fed90f49925ee367a57a05c070fbe39fe2c213e7c1724a907ecfa69efe6e021c06a262471a4377f3c9809e9fee4f375e27c31b6afbb2151da86b7cab63c7b4fa4b77fb30172b9d0d78b1c0535ec0639c4910b5eeecbb5b8b5c8aa74c140e7ad347812e36db3097a7ff85c09ab2c0020202307f50efefcdb497b9c060ca68c4be54a9165b4cebc6b2e2e14e5ffb9213142418faedcdf26fd326b7672399e71cfffe3ed712ced5317c254f9199ee10c24c802d102bd8749513d3145201ca4e01bc7c8bbcf430afa541ec5665f86dfb143be648521bb0f2b029018201444787f644f8c88b79e754e6ea9c797babdaec72a9680abadf3a41684cdd57c2b6e833acc0846be5aa927f1b1b36562d2acb9ecfb758455230d050daec6748ba280a5edc86d48e3f8af0f8f4ffb18ae3cd3c19a82d504a4fd52bb62289ae8026572a497fe268f87ef4b4b5886aa07eeb698b7cbf99683f710afc9ed1f8a488883ce0eb8f7fd055b82a9fe21a409caa231c41ba151008e9658919c611e157d7f3926a5e4248532a6860e615b9c86e9fea212128d96ed58c9b84ef22706071eb69f492e4d8321ed9faf6c6a8928f86172bdc930244583ea15be497d9ce4ae79cb3e6293a8512ffaa9e8e358f3c7c7117001fb92891a40b84f9126cc3def5cde67f463bbac9668b9f56c3e4ee72fceebb47e52fc226bab213d8193516e7064459fd1365350a95c5a1c3ac44a73bbba2a4c17ebe49dd781bff1995cd706b77bb533117594ad63566f4c0730beab85ff4c713b7f10b95480fe99a0f676c529a11116b21e87887b462aa9770e85509e4e60f198148115f0a3ce6028516a946178d1acacf7767f6be7277891369eff67762aa58f928d48b7231e44d899cea8289003349117a53d61bc27b207fdc91c9db61e677d1e1a1bc6a1b6e8564130b335233db4b5de8d62324e6d0ccb2b08c2ff922324eb8c506711142d4b8d7a21223ef0a3d534fdb0de58be95cd827152f71bdd0a82766b62b4c87536f0b7e7df343c4263187da887de6e65d11d0360e2376c1d71c367ae85edeed8f767d24c644b1a9b455ded1dc3cc224f99936a6ee66931c45e5e3db2427719ab2d5cd9c20d9bb0ec004b69bccb00649f3d8e34a3572c257de114b9f027d76bc7db9007175cc03b9e2061b6b3fe7409e009b5371544e56fe438cbd361e5b11efbf2d79d1c250a1e73ca8c601c4f4d1e3761290950421c48c7daa45965e472f5ef3c4b8597444dc5dc01cd25358055b5000617f3e7291da3413e3f0853b1271366612405c35ff1b785b984d921b518425628a533a29ab65d3c11f44c6daa86f8b6457ebb9419274c481aa6f3fa4547641670aff58b9cc62c0993d49a509f02dee755ee5f1fd2710c995c43a91c4f873afa1bbdff14427cba2641052a8f361ecbc72e8a6cf587e83f8bd3110c95fb080edc77a6d43cd58c447b0e02261e4109500c6458dce70acb17aa8f9dc1d15b94a61354164031b5d563c25d0246fc45e6401cefceb501e1468903e5d677759dbe3f24bd48ce55ff8b8f26529fb3b2d669202a1e8a498984b449b4830a0126b18f0e78182c9ce78fe0c448c0e27845b926cfde28fa85e156fa98fefaeb19ed1247c9643b447b4342c97cba5ca94ef1c555d5b49aa70e6aad45bfb557f15e8fdb2d6e3d10d8338a13fe3f187751985b37a5bb10b750f79e36fc2e2ee9bdecc3ed156e202ed7b45a94809d77edaa398042fc6a825a4848c334c557303d24eb3f8e01be06995ceb283c70272b00da61c3381628f0e372fe2fcc779ff7daf7e4b7f2686c39d3fab674b8867b62b0bf9d5cfd0c1d3b270521f55f147de75142ffd7fc9ac7e5dae7ca2fdf26a9222d060823852409dd040cfd1f66f218c6dbdaaacddab34b123af22f97384d64fac64d84fd638c96378c8f9532a11927d48440bc777ff8b8b9be88f930f3b579a713c0bc449dca3a3bd5f2efa98240ccc594299e44451dc60c6c5c9edd0d7b777912b3dc40c57e0ea5f4425cd7047e686c7304f04ba9f7b5de6ad2bd524f1d29f8802a524441fa286015adf4589431710aa4d76de8a956dc1d39c0a13abb7fc309d24222d036e204ab6bb46ef8a7595d9e4512e0b9d5f8fd719a4e3072e1d806967045789c67a1681f2a9f1f4b19f4f5e1afdafc17db7a6d5196161499e62ab4b0ec27648f3eeb1fb2b78f8ecf9b05cf9509a3b9e2a361238deb1c91bdbc8b1d11bbeb939fd9da811cd439069da0ecc00665d72357aac01f259a0325409b201859cc0569e0eba67a7a9ca7e8b78078d9370bd3e37f0571680ede60cb6bbfe69435d6ab5efd80cf051d119a7004fc0b600844d49218d844de8f521524a47ee50229c7da25e42a8639b5db225e7f23967f5d4f8a297aff04a3cbedc2985b6393a5ba0b26b6c7b4ca22d369b35b410799d1ad02825104d34f73408db1948438597931ed1c1c260e78340517bfa2f734537dbdf5ec303518ff4640efe7f7b1c2f46babdb9247ce8eabad9718a8b9ddb7a18d5e87ced554c9d6de78f85d293349590c6c32483534bc968b24a28eb54b9515589d6dd8eb51a5ad0b4d896ce92250397cbc404323fcdf0ee47ed634e0c58213bc5b35a72b21a098e11b79c061430dc817c1e0c79a5b6ed3b002979933f1b83a17f250b1bd5c4958df4d75531ca03efbda89f6a92fe08c23ad9014ff562a7f3dcde578d6825b9847b5df04dbca4f2aa52d8e0f4cf8183ce121e39b50358a9796acde0372a8ff97769874a80ab997cd889145aad4888c06963c2f5b82f53a748a6729fbc79d35c06d84e05c62e44ff78040e56ebfc6efcf0d8b49337d5a17c4041f0d5a8b616244d585a162b69db073accd9071d12df5b326a43b834bbffc2f2a60deafcbddf1c6438a1769d6fb09fbe1990e89da12164ef237f326edb5be64bb64b143a030de8a99b3c5e543c871cb581e2be090a92134aa587701f864907cadd7c1ce20fcf8f5dc7f7ecd06a6c19d89a92ca0ad4393c208b80bba990c7a3702a9c79bddde75d5db244719ac32191b6ceb041ab541fb47680a97dc0422b8a50d91e32cb08cd341b0b099aca5bd12b69d4f89d10b755b351a6489180b786a3beb018000000000000007bce6c090d1aaaff079e36d5394a612f1351b90c13a0fa6bf9d188d548dfe6fa51a9026edb52009c03ed45ac51d05c58a957bcc67e05a588985ba00d79f33ae9cdd5f5721d9fdc72ee6e880708be87e8a60c3c035c146f2091d1b9a4c2cfa56f292fe1ba62290d4e56c05669291bbe917f3cac51802a2cc8e9c90dadfe666c233c5a5bb71ee17deec51ce60c73f57bf9ecb84873afcc44815131810c6c1217bea485ef9aa2785e859b25315ef8aa3a274982786e45d622ae831fb76010d69a181b069e4cc55d4436edb10d1119b0c6000c6d5cff7c72f740a59dc0507e7a952b69403c62673f122c9d1264fac6ce2262e86cd8d6a402672f88530fc2d16f31736dd497a4e853253ac8d5aff8d1376895e9f5519b2490cc2a2412ba0c99cec855f668837310035e92fb646486de1b0acffb91ae7516df3eeef381456b55e65baa58e71461c928687e699d2b21814805591382e95e1b970aaa53259917f070281f2336b7d570249d838b3f1a32753c336864e15f4561badf8fee034a29c52ff3fca7456ae140f83e3b2fd5b57c9aef3f20c664200d235f236ec47dd2fc20b14dc6000812237aea992d987e5460679e8c5b76d80000000000000007e3106b6ce2db9de6f228fdf3ffc38710c0e8d5000a195a79d1fa2301038f5b27c40b09c34c025e5099d40c2204ea0eae985263c9101cab88d6857a320c9e497f22348a24861a5fb8d734e08cad09f9933748ff01eab22f17756f58688dc1b486a397563ee9ad0784b8833cdb5f7c6bcf76d9c1105f71c3c6aabefd70dc6cd5c66d31caf916145ac5ed7fa070b4277c0448ab1eb78c943be9aeab0587d321a4bcb7754f070881178f8be668b686124899fac252519f4b60ec42db766a908755040463125c26850177402a977246d36d23afac0a11889d54640bd8f6f670d686cfd33f6fc5d90cf6cbd63d9d0fd201dd4c74dbbab899f3c23c0b7e37ea0b2aff421327200d0da58b5893a4186ae3652cc6e11c2c2a0e52184a3872532acce98c94cebf4f31333663a620f0dba0ffd89c3124380075bd28caa6d449a050b3661b8fbaf4747b77c4928b1378fdc8c7a7b38ade1aeec44bdfacc8271d0b132b2029b0f3582f9919f5c8cd543abc9caf6b82b197cd482c3ef61a64743506342bf50a3c1ff544563bb8b2002911ee1fad698f4ac133ffed5bfe81239c918207a03c7a8bd71a0a502aea78d38e970e3ab2abf754b598acb79cf276792aa08724d0ba24f2a694912ab795b3f45f52dec50d9bfbc99ae27e1d2c2216afec6709d6513a64b29ef58255bbe18478c5d4f15f74ea63a1e15487752eec8fd019f1d4a7aa25277664754bd2d7cd3a7a018b92c56d965a1974885363757286da9e055ef7fac17876f0a64c1026a597733b897a9155ecbf420159ae8e5209aa83a3544fff1fb4566f2d54f95e3bbd30dcca5f24397e4bd47ff01292f0d6fe9dd47a810e0c25382fa69b4987d1afd9b69ef125110ad6b240eaa9c85829a2646f9ab7874bc02bfa8346cc9190943e9d46b44880670b1e2aa3a29e83be5472d7418885a353faade6e8b18f4b588607bbb758588d1e2f11a9dfa1c4d61be50249f1ee32e6ff8c0c7722aaec1bc79654a4772efc578bd6a14c79abcc77a4e09c8b6c6ea35cd3ab31e35268fb55db843176f8042f8ce7be0ddd4ead6dbdad0ef9e7cb2323db5cc48119a72b27306b8ff6366c0bc682a85ab9e2cf2238b6d6eb2e38a97d5577e6334cb2aa6e7c86e489e876f9d7053577a5cb57f52812fab7c4bd7b19a34c228ffb67dcac9281612f778b58c580c140542200fd00cb3ad81d93420df93c5af2493f646d8de797102fa0a650b2c7638623b823ff11444fdde453570f99f9099b60061a908b83383ba8b82bb78edd074dccf9342afdf8d11a6129ba6ea7030f3629056264f1736c2b926171b6dc7e1fa455a473de656390495f3b6ad2f9f46f35eacb075628ff739ef78f28ba683448068c7f18fb63f28ba7dbbb78999100dde0a94e8b8570817c7114c13e139ceb333782b29a84a5b19497fa785915c7680dd7f972cb59ba22161f60886e5cb3c3e808726cbf96bc4da78914eee565c6d9d18e70d22cf8c0244cf3cf488c3550eaa400bc0f26d64e0f1bc8d0301a841d954073a641f3ef883d81f4d5db8e9df708e64e640b38df7295f7fe573863653086bae5507c880ab7fdb7a6c5ce77027ffa7395233d3ce536d77ae6c2e9c8ffb6fee78a3bcb3b5f888bd595caa3a5586948776b950a89cde4db8247ffff27491c882b430afdd60e7a22324f6635a9aa7139f3e624c6d9ece60f7f8153b2080cf0544fbf8e1c436503766e670b902604ab521e11aa5a65cedd64cfaf898ac5f55c08c87693c323517bcb0d99c28f5e072d4f6540c7ead70138d47c1a67fd72bd6ef5613af33a0af311c3d0a631ca2a2dfbe35d1021eb610e40b9be128683235a788b5a4cacf99babee382458d59e8aa1dd7bba7e09dd30c055a3df8ed721a1778b2c6ed587a403566325cd19962edd7831caa44a6b716517bad15f0aa6fcf6a5ce5288dc84c0170f622ae0b1e1166a9c2c0771d91df9f9dd82ae210469602ce38964746c1c1d043e26fca3a64eb801dbea7ec39505457e778208774d72673626c998b002c46a9b4b1e390d9344f0ca62212a1b6d41043a2100b35196bce42d40caa0ea9a486bf8526fd1f0f0d362c2cac463ea7377a20b54b9435442ca529fc00da4fd7e27c4eaf14215a06857b54254c26346956fd7fe215a5ce57ec38cedf50a3c759e563a4fd87494f00e7bd9b44f3b7e99c6ef67187056a21d2fe1ac9d24125b1947eb293189fdc448b591af4d9b8eb091d6bbb5e50fae79d000044e282bb2ab6c63cc9562b151c214e45015354e62be63e1881238b907f7bdb791ff44a4e03fa29dbd26db2f49d0f4729b7cd9ba69a65b0b493466d35d09b3f590c67c31660d95e2ab4af2c9f1df91f04ce5a57dde2d75206b42e3423126774d76593c2f713ae279d7092506b513fd5b38f0f52d3fafd7141dfd4a0de1063754dba865faf8dc0f6be9d90ef21ec86a275533f6ad4b4e360dc775413f29eab8b3daac6279b9abfe163ea2f183e09ed91ef67fbb090875109288a182cfdcc46d90678efe5edceda6518335e678438cac4bb47d376f3f0e12aa55301735d7f42653c073d6a4a37b2e17d332dc1be6b50918c007b14886307cc39250e81efecd63d24067a49994572725a9df1760caac13a28f5255556b27ec245e93969b85cdec7cd1c2d2a433d3f9572b93054a7ce8adff81bc1d30884d5fc4791e251bd907e37af5bec74235c3e2f804e4e0450b715289942b7859ad207bafcfec1b586dc15e7911fe6d20aa3d02fcd47e9956780e300d7c53c17dfa15754deb4c20efebc7270bda0fa6b37fc88c6be4250cac38c1b8186b364482026ab52d65d3a691903fccc39772277011bfaa421adba76bed9731077be00000000d40f36bbd2a839c67dc4b862c968491b877d4fd13fc90f8da57229121e12f78e85af765cd66e72ba513593fe1cdf20019985b065d828707d8e509c6834eab188deea5c9ee97955f4b07d37b6fc7beed73be94887d423a349f35bb8782bc654ceaec870d97f061bda02ae73f6d575f81e0b6326eae6c1b3085cc584686120e12dd9ad8ce44036bec8a189f900", 0x2000, 0x0)

4m58.089890597s ago: executing program 7 (id=2088):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000180)={0x54, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_FRAME={0x38, 0x33, @disassoc={{{}, {}, @device_b, @device_a, @from_mac=@broadcast}, 0xfffd, @val={0x8c, 0x18, {0x0, "24e5ea3c21c3", @long="5601f5f04ef706287517224b9d6d386c"}}}}]}, 0x54}, 0x1, 0x0, 0x0, 0xc040}, 0x0)

4m57.650644087s ago: executing program 7 (id=2093):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000400)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r3, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x48, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@msdu=@type10={{}, {}, @from_mac=@broadcast, @device_b, @device_a, {0x0, 0x45}}}}]}, 0x48}}, 0x800)
prctl$PR_SET_MM(0x23, 0x4, &(0x7f0000ffd000/0x2000)=nil)
r5 = socket$netlink(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000440)={0xd8, 0x1403, 0x1, 0x1ffff, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bridge_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bond\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'team0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bond_slave_0\x00'}}]}, 0xd8}, 0x1, 0x0, 0x0, 0x80c9}, 0x20000000)
sched_setparam(r0, &(0x7f0000000000)=0x1)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1, 0x8000}, 0x28)
ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000140)={0x3, 0x98f90f, 0x1})
socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', <r7=>0x0})
sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@bridge_delvlan={0x24, 0x71, 0x425, 0x70bd2d, 0x7f, {0x7, 0x0, 0x0, r7}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x63, 0x1}}}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x4040010)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)

4m52.286684577s ago: executing program 37 (id=2052):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={&(0x7f00000001c0), 0xc, &(0x7f0000000200)={&(0x7f0000000240)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)

4m41.222441263s ago: executing program 38 (id=2093):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000400)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r3, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x48, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@msdu=@type10={{}, {}, @from_mac=@broadcast, @device_b, @device_a, {0x0, 0x45}}}}]}, 0x48}}, 0x800)
prctl$PR_SET_MM(0x23, 0x4, &(0x7f0000ffd000/0x2000)=nil)
r5 = socket$netlink(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000440)={0xd8, 0x1403, 0x1, 0x1ffff, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bridge_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bond\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'team0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bond_slave_0\x00'}}]}, 0xd8}, 0x1, 0x0, 0x0, 0x80c9}, 0x20000000)
sched_setparam(r0, &(0x7f0000000000)=0x1)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1, 0x8000}, 0x28)
ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000140)={0x3, 0x98f90f, 0x1})
socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', <r7=>0x0})
sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@bridge_delvlan={0x24, 0x71, 0x425, 0x70bd2d, 0x7f, {0x7, 0x0, 0x0, r7}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x63, 0x1}}}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x4040010)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)

10.788059086s ago: executing program 5 (id=3135):
sendto$packet(0xffffffffffffffff, &(0x7f0000000380)="fad33075218151db00316f3a277fedbc86", 0x11, 0x6008092, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x56}, 0x28)

9.788888877s ago: executing program 1 (id=3136):
syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000200)={[], [{@smackfstransmute={'smackfstransmute', 0x3d, '9p\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x34, 0x61, 0x63, 0x62, 0x35, 0x32, 0x38, 0x38], 0x2d, [0x6, 0x32, 0x36, 0x61], 0x2d, [0x33, 0x50, 0x61, 0x54], 0x2d, [0x30, 0x62, 0x35, 0x65], 0x2d, [0x61, 0x35, 0x37, 0x66, 0x31, 0x39, 0x62, 0x36]}}}]}, 0x1, 0x79e, &(0x7f00000007c0)="$eJzs3c9rXNUeAPDvnfxq0r6XPHjwXl0FBA2UTkyNrYKLigsRLBR0bRsm0xAzyZTMpDQhixYR3ChaXAi66dpq3bn1x1b/CxfSUjUtVlxI5E5m2kkzk07a+VHI5wM3c8695+ac75z748zcy9wA9q3x9E8m4nBEfJREjFbnJxExUEn1R5zcKnd3Yz2XTklsbr75W1Ipc2djPRd166QOVjP/j4jv34s4ktlZb2l1bWGmUMgvV/OT5cXzk6XVtaPzizNz+bn80vGp6eljJ144cbx9sf7x09qhmx+/9uxXJ/9693/XP/ghiZNxqLqsPo52GY/x6nsykL6F27za7sp6LOl1A3gk6a7Zt7WXx+EYjb5KqonhbrYMAOiUTQBgH0qMAQBgn6l9D3BnYz1Xm3r7jUR33XolIg5sxV+7vrm1pL96ze5A5TroyJ1k25WRJCLG2lD/eMSHVyKuff7N29ei2g+upQHdcOlyRJwdG995/E923LOwV8/ttnBzqPIy/sDs/Xb+gV76Nh3/vNho/Je5N/6JBuOfoQb77qN4+P6fudGGappKx38v193bdrcu/qqxvmruX5Ux30Bybr6QT49t/46IiRgYSvNTlaKNR24Tt/++3az+NP507JdOv19554u0/vT1fonMjf6h7evMzpRnHjfumluXI57qbxR/cq//kybj39Mt1vH6S+9/1mxZGn8ab23aGX9nbV6NeKZh/9/vy2TX+xMnK5vDZG2jaODrnz8daVZ/ff+nU1p/7bNAN6T9P7J7/GNJ/f2apb3X8ePV0e+aLXt4/I23/8HkrUp6sDrv4ky5vDwVMZi8sXP+sfvr1vK18mn8E0833v+3qm28/aefCc+2GH//zV+/fPT4OyuNf3ZP/b/3xPW7C33N6m+t/6crqYnqnFaOf6028HHeOwAAAAAAAAAAAAAAAAAAAAAAAABoVSYiDkWSyd5LZzLZ7NYzvP8bI5lCsVQ+cq64sjQblWdlj8VApvZTl6N1v4c6Vf09/Ep+oJA/Vp+fL+Sfj4j/RMQnQ8OVfDZXLMz2OngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqDrY5Pn/qV+Get06AKBjDvS6AQBA1zn/A8D+s7fz/3DH2gEAdI/P/wCw/7R8/j/b2XYAAN3z4Pm/r1GhhjMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgJadPnUqnzT831nNpfvbC6spC8cLR2XxpIbu4ksvmisvns3PF4lwhn80VF7etnKlLX9p6KRSL56djaeXiZDlfKk+WVtfOLBZXlspn5hdn5vJn8gNdjQ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWlNaXVuYKRTyyxK7Jobb8X8Gex1F+xL98UQ0Q6JjifqjxHDvDlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAT7h/AgAA///wSSzL")
openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x10380, 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000))
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15)
ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0x106, 0x2, 0xff, 0x1}})

9.42061948s ago: executing program 5 (id=3138):
socketpair$unix(0x1, 0x1, 0x0, 0x0)
fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
setxattr$trusted_overlay_upper(0x0, 0x0, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x80080, 0x0)
read$FUSE(r1, &(0x7f0000003d00)={0x2020}, 0x2020)

8.849542947s ago: executing program 1 (id=3139):
r0 = io_uring_setup(0x70c3, &(0x7f0000000180)={0x0, 0x2c3f, 0x0, 0x20002, 0x2})
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r1, &(0x7f0000002140)={0x2020, 0x0, <r2=>0x0, <r3=>0x0, <r4=>0x0}, 0x2020)
syz_fuse_handle_req(r1, &(0x7f0000004180)="92756f43b31ffe542788ef586b7c5a344424e3acac2590be6bbe37adface4a8f2e534ffe76a83a93f0b3680a72fddfde83f96d01982384e8d689219cb9669b14dbaa1b799f82ea1fc926126a4163618e16d4f94143a4e0f27c44fcef3920a0b3805ed4e78098d8689cc7791bd86648070718d238664332948d87866c8d2590fc0f017f9853abd9ed60b99f1aa6ae2dbd24ab6dbcebdb055246815ace147cc50fa3b2861148fcda374d5b203e51d72c45e4dde3e9ee9a47ffe458baf7bb49035135a8194aa1f0a83fa2abed56398f90daff679634619453f533f22583a6e0a4dc09e9de46684d5e0136e229510f3702cf3a4cd0065d3e5d3c419e38a80b070ca55010e082a9c510fd18cc0b26bb5e8e459e747befbc5c6b60ace80bf41417b7b78cf57e5b3984f0cdddc615c5e0000454d3f4a196fb6d18aa629cf0b0245f95ba958d86dc175616f8cd3ac473057dc3a5ff7107973326350107f4468e7ecd48d689b82c12d22ae5f1858302a1b4cfde8fd347a99ddcde40d1c49d9b5099fbccf09e782212be4b2ce36a2bc3c9ee794abffe72a5501e6c4f3f7f68b74761ffd6620609224a3bf11f655dadb5c8a5813b02fb46830e9ac6825f5d0e89910352eb3a58c0dd82d094f94dd2c85666f684a8f437bbd0e66b9f4d366117b67a054d212c4fbc287848cb0578391335d5d616b14d99a2e3df8e8a152d5de99bcefcaab5bb5cc71f3ddd66b379c104648e190e0b28a180d3aecc5423575d4ba7dbf31215c717da7b87dd454b6efcd36c91aaa631127f5bd88723d221752f102bc0c7ac6c5c7a1ad6747af40d01b6d39eab7b0e1292b44683c586386ad00acf60fb8f9bac551a6eb5bab7317b5d89f64db10bd9018dfa6d65d93862e851afbc30fd70fe5f0de322462045177231852ca80e4e78da4fea0c79ba354333026c8bc77d308a8d256a19ec45d2088c196691d3f9aac28ded36004a65ee1ce49ba9599ceee84534bb61d02d04a6732f1e27d72962f74b59f3522bf844c5022986d55934e48b8681b7f5b7532391448caeef00315d28320a46d8bd7813544e1e4bf994e14a519c2654ff20b42bdb69c262897e28eca528f0999840b00ed8256597d27cfc20d71d5f40d0bbca759f7594c6034aa1e16a84ed152fad0fdc1c303a7f61225712714f823afc5ea241d482d3585759623af8c97ca6a84a2033b3d7314ea0ef7ba9b288b362a294c92c8b9736829c16f61c5a1ee04aca965d71162292274595ea62c9c2918e8279c99f5d2830c617c58211fd7452330184b9428d5ec1d5cd75ddcc6de3326fdc70e891104b3b013c30ffccfaf3308d9671b01f6b080a930dac2052c6f39817a662121d90d40d6a1facfb50bec7d408030b6d0ae3e744f3bcc327c35dc43cf86b743db78ff2e593b19923235ed6467f299b08718fe1840c16a748935dff941150fb08b30573b37bf9af5c86cc8d9e229a832e4ef25ec91f71120f2b3e9062485976c280a2d172386029e2f2a4801197fca0a13514edacf5ddbac5a62e8bb13dd1572657a821a8739297f72e29239d1cdddf3e30cbe9af3141f2275ee4ae85d86ec888fe9a6751f252057e95b8beb055e276439581afee93cd44f1e92f70e5f725451d3ab662918ffbb1269509fbd511e95a00ec717f9d60d643864abd6ad1cc4dd7f933379a6078a86c2158db8076e7b660366fca7b1c46d09d2c8e67a6494bfb4c2c6750e76593895b5e2b2bc78093840c3c4a807826bc2750a96b4e1dd5b82b492bb2215518c92064d1763c37132604e52e73fac3f4511f791753aeecfbb19816e0da7a1bfbea9eeaa0f256eaedcb119a61f7d0ea0f5cd4969d45cb014800f2c888d5c2217cf0f69a7507779883b57352bb8883cc584891950d6e792537074f4fc4337aa19b9bf60e18edd939d289fb4a6b7aa6c66da20774e249ca4f779d3c910b1a9a8e4c38af6adecc87d5481d181fd66023ffff246f4e2556b218fe8110acebe20b1675f1de6f265b6d1d8514a53522396bf0e2f2b153c498e48b36d16f8b9bd56f45d7f5b9397d7f1339117a176d0bad0b68e800682416d3e18fe2197c7f8dc20600feb95cc6ba86ad47f113e159bd4389e30eab2874bd27eebc56020c4dab9973b13f3e82aa62a7e0a151d73de48cb811e32be63ffd303f5a6ea6f097ed763fbf36c430821e451146de79922348354ce285af0997bf3c66e6ef02942e24b8f1ccdd542f09cfe65c0da0094c0b5fd26bbc061538b41e5ed2cbb390ee29b10a4b7a696009e1b5b86c44c0a561a257c15415feaeb1433ea275ed6e4b228503fe71ee5942665164faaed6697112206be0fe7863aebd4bbe951d5dea1da294dba0793196385f4d5141c9d6c4b0fa22b2e200cfb70b52aca31655e71e5a576ccb8ccb5b1364748aa981edbb81a813b1aebc67be1f7619e7e197622d981280429f6ca5145c5b3b05e6bace9191e5c58fbf140f71f594cbfd4db0e9f6923f1758ff9464a61a720a5d4f09c622c3ce3f5d0d3a1d191111168108f41f12b16e9eaf3617c353715cd35260560cbfd0555d51ce5c40bbdb7c95ceaeadadb8902974de50b0863348183864f5ea682e678286a06a6f396af29a7c7fb33a3579e25835963612f3c0d4cf369d85959a0adeda94d35824050e6fba7f83f90867583f713d7783323c7010e94c9be331f860db395dbde6face5bfdb616fcefa9c6b01f6963daa840a31ff554a458c0c50cb5e09f91f54f63234589decaf45bbfbaef0dcbff4ae6e65ca26a530261c491ef8eb9a855a1d7463391c9b66be96cf24c3c321ee5a5bdc857f60b582683c6ae1e3775b62a9f19ff8fa51380ca8a2a3c6de79012f5727ba12025e7e6723a23a81e067ca6e54c7b38ff64880d235d21e7ee5258953dcbf9e2a962f006ca4ffe870859242c850cbae4222b3b72c4f86934379ba2ead1dcde906241b994d95c88355af5a9a30ace9c933a6942f341ad221dd825846a8fd44c03e2eaa9311c26e15a1bd7cbba961a22ef23d7ebba0e34cec5ef09b1ce72814a97e33bd29f3d9ec80a4f45d1d29486accf15c11f1a800bd84918e7626f678275d7c7acb02cc0e6e34bb766ba6b75c3ad14fca9352e09c3b69390c045cfc842ff9ade8ca693c07fadc7047a946e6e570c3afc5b501c964103397f5ddadc2d59a048348dd42f07cfe31bc9b5ae453f5086bb41bba4c8a3e518e30b0855184b053f923025dd72ce1bcbf41231978b34a8547c71d7313992165078903c61d312b0d9469413c9fd97ccdf0ea270fb6c47ec8861a1c8d909eeace761b5a06ba46e25785ff87f867777abb237c6c980687991f1ed0157d58492260c712cec34c1fc0962103955db4d5090b6e8409cf3c3c79d0e691cf4fbc0b2251a016dcd456969cd32e5429533bf0d6f8bda84c05f0e2040de8b53bfb8676eec4b76c3df6f46b1e43732035dda577e75f640777f6ae90fd2f1af42ba462dac732019c599bfef01acd6a0d4d1796bcb8f58519d6f9ad9a3206704a94d472516b988141f44ecd2e6f28a49aa0c449db87972fc995a97379914546ea43143ea2cf779a9cbe81f111fe89129db3610492164ab2598eca7e60d9a6963d8ba03a86729db86e420fd96d61b8fb11edc2b339b57a740074ae5b775eaf60cd85dc934e604bf2b4bd58ee01205b4df57ac20ff8db45a05982b579643882407050c005102a2e71f1e56dc76dbf5331112e83e48bfb5cf2a78a893190d78426175c162ffaa7278a43b9932318fc17fb8cb0dfac610b1ad235b91f9cb7623b155117e07f7b876a3c37627aa31eafed141cc0c5491c4f621a66b6d837a144d78719c46511c04a093cf65fce9fabe5bd6d499eceb63538ece3cf19053550a239bf978c08c879f9954485a4e3e0d5bedb84b407ced85c4dfc4d75af116815992c29f0bc927c4a990c38ae4fcc9feb90fec1b1b555e04d010423010855394d5ccfc8ed21164190cd8f83be5debb70290c3547f07e4dc42814f1e001798e6ceee2558b0c6ff8c1759f90269ee226131116332b99ac8dd104c92088e1f91ace3198c0f59bfb75c4e4a697660eed43a29c831a552de37fce6dce96fa51b6e2111f3071a4e94422d15e102e5f67da7ca6cae6bed7743ebffacb8a811a143605791d17232181a517e872f71262c3c73668f0ef83aad498f67fa26bae698cf78f24c2dbecd399a190e6b8d0684e929f2e8083765eb2c67793a1adbb89d36b58bfb197cdc5f3c894ac9d886e8f3b0936fabd233c09de8fab8099f72a74d908ba5c5e4d39790b0bf9e45b710f5587b7c937c76690c5c5fce621a53a9fd03b0a4ee6d8d1abbe2ed561820a77f12a08cad0755540ab6dd1604b7c30a8652995ab80b85e919011de9438a4637eb0291124ed4b745e782cff98510cb03be79c2a81351abf276584d75cdd96b9c97e73eb71000b3ab7c3c19c2cab4497298fcb3052b5d4503d05e7f310318be6f848547b1a4f4db82caee190801478be28065036aa4d91f290c1f396343e73a5fe8bb5ccf0a317177ed1f77acda1a4a49dccfcab8d1b5d79f015f788b6d5e9f8228a8bcdc0696e6b19f5edffbcd7e9509c87fbe1f726b93bf8c6d8d37428763e142560c46c9e894f7317859000c25abc4f3691ebcd020171e0d4911b5d97a238109aedeb00b2eb475c1e7b45175f8aa85193b5c0f43b434c15de01610c4d022646cd6e3637f349a434a77f571ac1c5d698452d1b991e267f78dca5e592ecd31ccafcad84e4e98d134b4adc525b81bd6843428883023a6ea407201738c8bf16b541ff7280274a34d4cf14819f2dbae167ca0cae8471c495e006b45194ad91c4516f21cbb10e0d26fd5d734cd7725df5b3fbe92955f4a9bb3b9b813aeeff79d6ed5db92def19d060a208c3ec8c42c110786f1e1496c50a7249b03fc792764366894a35320b99d0bef9fd0b6a246c36a357c6b985dc83a37a8d9b8b9ad643dea94860cbe763bb73cc8422b69d4d12332242c8954075fb7117a6679638073617abcdb4619855b2036af160647f66b3531645a3bf047ae290d6ae2249f114e7a8464278bae1486022bcc7c37390c8d9a0efb0e1cfa0da8ef7a5e072f99a47ecc75e4e442880375193db49bb82ba34901286ca473ed5b63e4048db4dc455e74b3fdd2e7898ca3f4c3a02d435cde6141eea645055123a7dcf0d22057f8d425701afc55859f5147954e719d58c7486b1e02ac16cb799b77632c66bb78e6e52e11017c1736424fa4d433f1e19b4c881d23f0b2a12d5fae3ae24339088088d9b496ad97bd9f6e20a8597d1452a0c72dcf43dbbda8f18166585c06d21fbffe5fe7b55f71c9b9f1b34a02bd05ca63c7c1b1bebbb9dd24fb10291b04c665d45154dd28b85d821ce7e613119128996785e1006a8dabc4899b10d2671107d5a0658ed363b9d4b39d02f8cc5e350fbf0a31048adecd1f9e2ca749bd86f195eb48e9b4605f050de03d642940d79184618f7f88a9a0a4683ad84d6134e395305bc1d4d9d17cc334b97653529d6682a87a5fac80a6d46d6e72fc22e58be7b8f8617b3372ef2622110ab1ec448717118b257acffe55d18c7855e9e8710ad977a6792b2315a189eb4468c68641e9b60c0dab7016ac1ad63cd8004b6eca8fc88b1e4263acc00499255c16b11487a0af858075f9c892dc8044c4146e5a5677c4a2cb24bde5e078985020d4ab1e4c87492e76b7e6f4bbd71d84bab1885c9702849e70cf728776b1a94c2a8fb8c7ca01b6111ef6f2032a290949bfe473fe215273b8b5b3ad540f187490f63077dccbca6f62f0a7a66717c596cdef412f2560b10685ede967b3ee68b8c951959aeb1d7564c3b9d806b2ce858381393a79916b78f7e90beadae30ffc0b2b614380f1c2cc551a44565209db3516be379ef566ab00c673fd8aaeeecdcf1168c1960e9a477b9e13757498a44ff089351d1f27abf9fd76816f924504647d1247715ca861ebe624172c322146d66eb2b247f8ecb3e1b5ddca89b287c57510cec40fcf89d802cf4368a861af320e01e34f7a6177d4bc549181b5e87ecdfe02f78c9a59a3bf91ebb6364023ec06410e7b4476ec4e3685bfa3bfe9ef9ecc12dcd899abe0f3c7f16b4686801c0c0a949aa26bed57df56f2bc54ef19af7fcbc7b0d691075f42a4a67acf980b568acb2342f42249f7c1ee3527c13182b096064ecd250887a942d26f637e1c4041b139659d2462a68680bb04387a3b399e396b9fe74de10356125fa47d0a20827370cbf36a79b6fffade91c439dd6cfff4bbe0dd3efefb61c491ee32f935d62307cba369ac8c20f6fe3d4857ce6d240ece5e4d149f0587155a8350fcc18efae2ff11cdbe15218a82499a1996df8b5462ee170b284321e76bbe5c3f4158387644d95f087c598e3d46fbe27f63fa784bda239512113424045a2c5dbc6bc3662ca730a86d13cf8f6fe2743224ca7b535caf6b4701a7dae9cfad3d7290104bbba15b6a064ae6e909a099f75fbe47c9e654d8e3b8dc0f3dbffe829e6c56f7a241e565136812a857f59ab565a9991c6b1d8abcc94c6b33bba314f6e5060e657e4647f969a551dd6c51dfca0ff5d9e4f401fedbc2c927eb1ed95ef25f4e5accba4999322ba1539499310dd5875433a22835cfd42fd77fd4680b7fe767d7aa5c33acde04a65bd3a663fcde4c80e9f2af498f13bf9abbaa1c1265edc691e94abdcc92270c05811cd2a8104eb18efbfec9e4ba9ae5cde211b9b93082ce034b6cd5fbe9cfbac4f7e2404ef159766124f73017cc3600f3c81cd78db25fc3459629eaf20dfdb062c7e502aa69412381d847a9d254d5befc451cda3606f0bc8ae62e0aee928f9ed0b21d705a8d31b899e16445ee064563d32f7b6bb5ad197023cf528d9b329ec67815c6ddf27d2a6ffa7328bb993407cde3d166159fd49fe469254b84c2916daea8df9d69bef019f1351b9bce193e30278835b82ea5f60dc0bdd7f7452b7a820ae7cd6dc29d7ac6a6c1b6411711a96338b1e769146b2a385d282bfaae61b041166efafab2d89a4567b9460cc22d752f8e9aacaaa0db7c84879f5359662d55df6570d4214740851c74574ced733807cbb54571110410892394c3dea07bd4154d0e5689d57c3360207dac951f96a358e9c466a5c5113f3a632e184f57f075edef4dcc9721b963beb95df09dedf848260cbc1ebfdc7408218eaba6d2c51928cd37c4c0c9f321fbb0994a56947cfd9643056db5dbea60a241f8f004c932bc8e645b2ec2eb9bc4e9e2f4156293234d05e70cb26b8a370b0206c756bda6defc11c5eb386640f535a4ffb714168defc6d82f40d8f5ba8768537ead5773c53bd779ca899a2dd31c9138569ff5107c2fb12b804375c3b3dc9b828bfd550328adf358f71e86a0c49fb119f5ef9e06c13855cbfc7d1a62ca2ea655ed912a6dc7bb8b18656e8923fc7a1702ab36947d79384d681c31923e98cf40209f776bc2b219a7ccd139e756a905aa351e6eaae90770c8a193f96cd5c66e4d77a357985556e14333716d80204a5c390e0d76f4081afe917f99ad8a0976b3342f51854b374b4baa9a7f22124d2b82749446e30d9795acb9c3c3a305a6d273ac528e8e9c95c37a78e765fdda55982c2961fbc85a14fc095a78b4654ee6dfc3298749a639ab9c8e155af3a77f8a409ce174532a492ef550a140f774d77d732b3b4ca5bc41fa4488ce5957ce219b032ae1f585273748d81b19edcf3e6cb9a93ec24e41c6b3c472f9baf3ca46cb8b9a91df18acebe7d83bd4473750c4f26806da2f95b9ea48b342460af729ab15e9f033eda67feec645f985d4b9489cf6ceec1b100d007bf46c74be53c7ea17296f9c5b5cbae736491213c93b513009ebdecfcd60d46d7b86c6e3b5e288f2ba5867c07936e7bd1b00de52191eb8630ff82ccafb27a59295164751811bf74eff1e5e2abdf3c93bc5dc9814be83b2562477935e2fa30db7ebb6ec380170cf10c1f98f8c5eb71c730c2b31b55a1dd1c12a64802ab95b63c529e0a96cec8f38680221d6089926d8309796c79994d63b67bfb62f66b4a502f30ed12be41e896e88bc45a160a526fbd5f002e677322f116ec5740d7563cd23ee853c008b84998e38fdf158556e28a532573956e7c00f91f08ca245c295a3d5e003a99ea727f61d12893b435d4c8f2f5cce00c6a3091e2a47f290c07168975c53d7529b71d10faf42d2bac9db8d53669cf59c709c25e9e40b5feaed4c37dde8b84c4961c00712326fb6aaa06e80d766b40b72480f3971def61d1d129676df2478e778d899ed317426ec33e496d1fdd2ec27128f8faee92828e13da72d6aee8330a7988ea1cc8b64ec4d8b20990864c16c52c4be6d00b304b87d97bffdd9c66a740b517223089d9f3f414abedc53c768dab9220b980e6c18d5f20ba8994cc8886d7bdee213442f456d79fce1b1eb48fbf600a666c8ade24d118e6328251cf7b57a6285c650e019850f392b1c29aec5c8fc489a3819d60d5de377d4c11b8ee5625b7c02c5d50d2af3397006f2e2a41a06f039229eef5878ed91f9f6be7e988924dbaeb8455f616275e8698d93fb536e2c839b203aa69bceceddbf9c53f8addba53d50ca0f7a4729a42ac6eb757f1b408ad4a0147546173e62f7621eb18a9e1681510cceb48e0a30ab7a1bf71d56742d5f034f2d725e7ea68a011dbb100fa6eefe4ee093873de366d34f4240ca027a25c5b979c9ac47dd1dcb6ed82c4aee09dcc23cf329a8644f89b5cf00e5683934b1837574e9b39b31b1009f276e15aa040959fdf100838ca3f5ab17e45036668d06044e3a13f3a0a6f68579e50d5b0164f900d7bcfcde78396cf30f0b1dff76dc397ab1a5a44b207eb1eaaf73b945c575029ae2dce20724991e6550155ded6a42672609f2439c5aab4882b2ffaf7da787b71d05d15516bd68c6f1a9d79b675395845f24ee853f877e72c14b6c6702f7b8775ca1bfabbbcf4019f7bccf07f1c211531dfc66a7a1df79e92a20dd1cbe1b22e1209e7e3ecb9d3c2450fc22a57bfe09bd735f61c361cdac2488ae0adc7885edc0712655daaf535e1de96ccbe7869d531d8bf3db512fbd17c772332a3f8cf1e052ee0202eb99a36a0f8d7219888acbb57090cdaf3b28e1e62e8fc2ec237bdf18592a7afe4d8390dcb5e7fcc31bf4f797e6f5710070902265cc2e8c459b7da1451046abd6c8c5b02c0be2d2f505a65376266563ac7b59ef3b4e2570a6cb0bd94d46ad861317c743ce1de12bfa2295a98cdded4414d87a1580b1e4675bbdf73a22cac4a1d8d456d089e0b60cbfd16158f073bd1dac481db49fa5d8801d0fb0844b4afec1bab4e61fa0f381fa667880a1cd8163953be7b591cc9dfd7f91902370b783ae8a0f3c7cbefa7d229a37c00f523529e159b11d2e240629b64af2d11404773e991207a722c320221ce23baed7cbe40a440c5680814b122cfba9092fe03478f85adcbdeacb76d6cbf2491eafae98327b278e267821a0e1cd06ef90cb0328e246c19d8c63b9332291a89bc9f989effc675c79a870ac024756c6f5a7e32babd69625d61487ae7399490b70dd0fade7d70ad9b0757300a2dde77abaff4f63a0303853589d44efa968e10d36561f04408ad0cc227fc6b2f904cead189a0fcca9b2e6cbde5498652e0b3bc9d8b7921474403718feb5cc750dc70f5a9b1a0ae2c642015b6a1a8ab0572182b4e39e0c869cbdc60c9465f5d564d18ba2f5b3bc3e05a458744077430c5ea031ee02dd8f0a65d7dd8d90dd9b8717f77d202239a5778719423fb2aec7ca86eb07c39de65a34b988d65377a7473e9145f16d79593e96903330bbf3a8024fc15519d9baa0fae2018786f4b1846fca355ff0fccf65cccad1896309a5ccf2056dd542c929850cc91cd655962360fe316557ab3fb378328f77a07d9da24447d3fa2020b382ed2e808ec9529a01273434c64b0b7c35a06a019e4ab51cdc9c0f266ab25b6984338a0ba910d1060283b636c5d7e8a3f969c1ee1c99b54bba7ff3679fbeecbb70349f076480a867cc4ee4cacaea39c80f642533599486d2ffb77b8c9109a9d25fa0b06e58eca764f7d56469eb9547036bbea9d5c3d35b4c1fbc3d39a372c2b7ad184965cad3819c8928f1588d00949949c0c4c93d30ac7f6665247c0108bd89dff3aafe780ac66febfacc8c6a3cc387d09da6de700487a80e2c8d56df94d7ebd3e1d9e06411a6c5f7eb6da41c6f52997b5ad47ba985261103fdf12eb4a2828b248f652ef00b6abccab2eb161b878b9dbc0aa911405b6f67adda83c16187748d7b524ffe6381f489f432d592e6171bd9ccb2cd52f977143f57fbf2ab0b823d449ae55f02440972334344cda01837b93afa4f46a2fdefe27e92764cf9596780846de2e3b1ea83e62ee43b1c05aee675e25363504addfaa68e7c53ed685413f5ba951f120d0a646e474872c81e5a887464c19f8460ae814ffff24cb51dd2dca28d597ab2ea60949f8dbbe67f263e722fdb51bce4e328a19f5ff1218e1f63b8da6d40dbd5490964499b2522ea323310634893ead661407966207a66ab13adfcf1a725ed14339c46011c0e0401f2386b47cd9f902fdf84bc85e74d3ae7cc544e4d65670a554a537712c6ee9f75191631d2a4c4da06fc38423b1d5b828d7201235b2974164f52aa16bee70ee509250752f4fdd6b9f8d021943df8320682a6f80ff0d67ab7a4ceea807bd5b3b7b6380b0c7f0caa67b0208ba71317f0355a3b755af0e2c007186389438615df80b7b25104a733fc90625b62682198733c0f1625dfaa08cf81e3df043094b7b5a098b3b36f803b5b0f10a057bf814ae3579932c0a5f208985bab3d817f975283b8838ae5cb709be72b58df7425e059fdbf4e0ee51b3da01fe0b44963c1196baee5ec5909ad80d9d1660f3edd90374952a0bf8b3bece2c2f944593f4de7de5e05ded096b8f4f05d65dfc2e806f78220d84b3db564fb12f4e5e8f5eab316591f004e9374cce8e787263bc3827affe6793c130b8621d3bbb2a86fd87f070ea21718281ee7aec4bb3bb71af4bf5721cecd139c4be8c9df4ec8dfb09a5cf1d86a25d39faa9f064a997c214f334e4410917fc3b4d67ada8d87a38c0f86b02bf653dddaeb5b75b300f8bcfd792858bef8ab23e063421939c59212964c9ed5dd56e215db58cef53d31a966bb8ce4ed56287fecb3a85ba435e0b41b20ba1164b9c9f2c49fa0f7b17a89e0ec47eefe992d63ee29c8c0a1ece2664fee8edadd43636a54c48519b4fcf55b0d9103602b92441a5f85cf8c5e406d0f5815f8f37309934bd78fbc2acf0a03b051b4528db4f7c09de7d0aabafca3736b8259c818ca338ca6754e0747717c2794d664a1cacc1e9c52764a308e6df73d975638630b74cce6c49b1bac16454e96852c4f9d8ed118e86d2f1c8dc33bccd4a07be128db5e80f5684ddcc1158e744411acde590f902f0987cfb750bb5bfeed53bff076868986b566d7701f48ddfcacbd325c8d930bcef26713bf60585d5c991e2a6cc33ccbc27f7ddfba18f998497c2eb378cc8f2cc07a1b4f141c5e0fb6f52e18242e505bcf6dd20e33a469d056a0b4fd5e72d0da9d0bcce1e2f9e9dc7d1c7b6cb0f3604287eca", 0x2000, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x1, {0x6, 0x2, 0x9, 0xfffffffffffffffd, 0x6, 0x0, {0x40, 0x0, 0xb, 0xfffc, 0x0, 0x1, 0x0, 0xffffffff, 0x120, 0x2000, 0xa8, r3, r4, 0x501, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0})
write$FUSE_INIT(r1, &(0x7f0000000440)={0x50, 0x0, r2, {0x7, 0x29, 0x0, 0xffffffff9046dce8, 0x40, 0x73, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}}, 0x50)
openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x60a41, 0xb3836f6d7a15f29)
close_range(r0, 0xffffffffffffffff, 0x0)

8.596317746s ago: executing program 9 (id=3140):
rt_sigprocmask(0x2, &(0x7f0000000200)={[0xfffffbfd]}, 0x0, 0x8)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000003900), 0x34aa945a513d639, 0x0)
recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0)
r3 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=<r4=>0x0)
clock_gettime(0x0, &(0x7f00000000c0))
timer_settime(r4, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0)
futex(&(0x7f000000cffc)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc)
socket$inet_tcp(0x2, 0x1, 0x0)
syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff)
ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9)
socket(0x10, 0x803, 0x0)

7.406776626s ago: executing program 1 (id=3143):
socket$l2tp(0x2, 0x2, 0x73)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRESOCT=r0], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r1 = getpid()
r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x800, 0x20082)
ioctl$USBDEVFS_GETDRIVER(r2, 0x41045508, 0x0)
sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000600)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0xa, 0x0, &(0x7f0000001080))
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/auth.unix.gid/channel\x00', 0x2, 0x0)
write(r6, &(0x7f00000001c0)="2032393439363720393520325c30305b7bd95bb5135a30373030303020300a4cc4af2e0d381adf349283277cd45edc557a788e31", 0x34)

7.287125505s ago: executing program 6 (id=3144):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
socket$nl_xfrm(0x10, 0x3, 0x6)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$inet6(r3, &(0x7f00000004c0)={&(0x7f00000000c0)={0xa, 0x4e1f, 0x7, @mcast2, 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=[@hoplimit={{0x14, 0x29, 0x34, 0x804006}}, @hoplimit={{0x14, 0x29, 0x34, 0x8}}, @pktinfo={{0x24, 0x29, 0x32, {@private0={0xfc, 0x0, '\x00', 0x1}}}}, @dstopts={{0x40, 0x29, 0x37, {0x1d, 0x4, '\x00', [@padn={0x1, 0x1, [0x0]}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @padn={0x1, 0x2, [0x0, 0x0]}, @hao={0xc9, 0x10, @private2}, @enc_lim={0x4, 0x1, 0x8}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x3}}], 0xb0}, 0xc894)
r4 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r4, 0x0)
dup3(r2, r1, 0x80000)
r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)
getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000080)={{{@in=@dev, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8)
keyctl$get_persistent(0x16, r6, r5)
keyctl$get_persistent(0x16, 0x0, r5)
socket$inet_sctp(0x2, 0x5, 0x84)
r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0)
syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x1, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0, @ANYBLOB="2c00eb5543485962e53fc646358c0251b331be42ce7fc189df12a9c44f701c6811d290b8e235f2f2e6364729baa741907db958005ccf52d438fed9a7b74e265d364bf7395e99fd53fb8183ce23741c0a4daf90bd3d581acad4bf35c7b9bfb17eb5b608956c2131c1bdd89524176f87cb6403eec3f360c9008f2e53d3dc7e6d6fb0976b64c2158cb1c8b5543db99390a61b41313d9860b8f26ef8d7e93686ae1ed7"], 0x3e, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0)
r8 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r8, &(0x7f0000000140)={&(0x7f0000000180)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @rand_addr=0x64010102}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0x0)
syz_fuse_handle_req(r7, 0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x50, 0x0, 0xd, {0x7, 0x2b, 0x9, 0xffffffff80440084, 0xfffd, 0x7, 0xe9d, 0xffffffff, 0x0, 0x0, 0x8, 0xffffffff}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r9 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_MAXSEG(r9, 0x84, 0xd, 0x0, 0x0)

5.595222209s ago: executing program 1 (id=3146):
socket$kcm(0xa, 0x922000000003, 0x11)
socket$nl_route(0x10, 0x3, 0x0)
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup=r1, 0x6, 0x0, 0x50d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r4 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0)

5.593295385s ago: executing program 6 (id=3147):
socket$nl_netfilter(0x10, 0x3, 0xc)
close(0x3)
ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, 0x0)
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000140)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}})
io_uring_enter(r0, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0)

5.225633482s ago: executing program 9 (id=3148):
sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000008c0)=ANY=[@ANYBLOB="b00000000002010800000000000000000700001090000a80080001400000000108000140000000000800014000000001680002800c00028005000100360000000c00028005000100060000000c0002800500010010000000060003400001000014000180080001007f00000108000200ffffffff0600034000010000060003400002000006000340000000000c00028005000100060000000400028008000140000000000c000a0400000140fffffffd"], 0xb0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x1000, 0x3d, 0x6, 0x9}]})
r0 = socket(0x10, 0x803, 0x0)
sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0)
r1 = socket(0x2, 0x80805, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={<r3=>0x0}, &(0x7f00000004c0)=0x27)
getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000600)={r3, 0xf}, &(0x7f0000000640)=0x8)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000006c0)={r3, @in={{0x2, 0x4e20, @empty}}, [0x23, 0x8000, 0x3, 0x80c, 0x2, 0x5, 0xb1d, 0xffffffffffff8000, 0x0, 0x9, 0x5, 0x3ff, 0x4, 0x0, 0xfffffffffffffffe]}, &(0x7f0000000880)=0x100)
sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x8880}, 0x4)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300))
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000000)={0x0, 0x346f, 0x40000060, 0x100007f, 0x1a, "9f940b3491d052d172e0e573229ac6de50806c"})
mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@version_u}]}})
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400})

5.03096646s ago: executing program 5 (id=3149):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = socket(0x400000000010, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20000c40)
r4 = socket(0x400000000010, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x34, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xfff3}, {}, {0x8, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8080)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x400000000010, 0x3, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xf, 0x3}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x8080)

5.02919861s ago: executing program 6 (id=3150):
sendto$packet(0xffffffffffffffff, &(0x7f0000000380)="fad33075218151db00316f3a277fedbc86", 0x11, 0x6008092, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000084ffffffff00000000"], 0x0, 0x56}, 0x28)

4.815782052s ago: executing program 4 (id=3152):
syz_emit_ethernet(0x3a, &(0x7f0000000200)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local, {[@timestamp_addr={0x44, 0x4, 0x3c, 0x1, 0xf}]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xfffe}}}}}}, 0x0)

4.809649057s ago: executing program 6 (id=3153):
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x84, @rand_addr=0x64010100, 0x4e21, 0x3, 'wrr\x00', 0x1, 0xa8a, 0x30}, 0x2c)
r1 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, 0x0, 0x0)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev, 0x9}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000040)={0x4000000, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="020f08001000000000000000fedbdf25030005000000000002000020000000000000000000000007080012000300000000000000000000000600320000000000000000000000000000000000000000000000ffffe0000001fe800000000000000000000000000018030006000020000002"], 0x80}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10)
ioctl$sock_inet_SIOCDARP(r4, 0x8953, &(0x7f0000000300)={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x16, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 'syz_tun\x00'})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
getsockopt$sock_cred(r6, 0x1, 0x11, 0x0, 0x0)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
gettid()
sendmmsg$unix(r6, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYRESOCT=r1, @ANYRES32, @ANYRES32, @ANYRES32=r5, @ANYBLOB="00100006"], 0x38, 0x4004c}}], 0x1, 0x804)
setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, 0x0, 0x1224)
sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x50, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x50}}, 0x0)

4.476895053s ago: executing program 4 (id=3155):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
close(r0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100bd030000080003"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)

4.415165658s ago: executing program 9 (id=3156):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x2, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {0xffe0, 0xb}, {0x7, 0xfff1}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x54815}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})

4.406801191s ago: executing program 6 (id=3157):
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x8480, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000400)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000001c0)={0x28, 0x2, r1, 0x0, &(0x7f0000007000/0x3000)=nil, 0x3000, 0x80000000})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000000)={0x28, 0x4, r1, 0x0, &(0x7f00004f9000/0x3000)=nil, 0x3000})
ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000180)={0x28, 0x6, r1, r1, 0x1000, 0x19fffffffffe, 0x3ffb})

4.387338922s ago: executing program 5 (id=3158):
socket$l2tp(0x2, 0x2, 0x73)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRESOCT=r0], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r1 = getpid()
r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x800, 0x20082)
ioctl$USBDEVFS_GETDRIVER(r2, 0x41045508, 0x0)
sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000600)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0xa, 0x0, &(0x7f0000001080))
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/auth.unix.gid/channel\x00', 0x2, 0x0)
write(r6, &(0x7f00000001c0)="2032393439363720393520325c30305b7bd95bb5135a30373030303020300a4cc4af2e0d381adf349283277cd45edc557a788e31", 0x34)

4.176190831s ago: executing program 4 (id=3159):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
socket$nl_xfrm(0x10, 0x3, 0x6)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$inet6(r3, &(0x7f00000004c0)={&(0x7f00000000c0)={0xa, 0x4e1f, 0x7, @mcast2, 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=[@hoplimit={{0x14, 0x29, 0x34, 0x804006}}, @hoplimit={{0x14, 0x29, 0x34, 0x8}}, @pktinfo={{0x24, 0x29, 0x32, {@private0={0xfc, 0x0, '\x00', 0x1}}}}, @dstopts={{0x40, 0x29, 0x37, {0x1d, 0x4, '\x00', [@padn={0x1, 0x1, [0x0]}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @padn={0x1, 0x2, [0x0, 0x0]}, @hao={0xc9, 0x10, @private2}, @enc_lim={0x4, 0x1, 0x8}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x3}}], 0xb0}, 0xc894)
r4 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r4, 0x0)
dup3(r2, r1, 0x80000)
r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)
getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000080)={{{@in=@dev, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8)
keyctl$get_persistent(0x16, r6, r5)
keyctl$get_persistent(0x16, 0x0, r5)
socket$inet_sctp(0x2, 0x5, 0x84)
r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0)
syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x1, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0, @ANYBLOB="2c00eb5543485962e53fc646358c0251b331be42ce7fc189df12a9c44f701c6811d290b8e235f2f2e6364729baa741907db958005ccf52d438fed9a7b74e265d364bf7395e99fd53fb8183ce23741c0a4daf90bd3d581acad4bf35c7b9bfb17eb5b608956c2131c1bdd89524176f87cb6403eec3f360c9008f2e53d3dc7e6d6fb0976b64c2158cb1c8b5543db99390a61b41313d9860b8f26ef8d7e93686ae1ed7"], 0x3e, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0)
r8 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r8, &(0x7f0000000140)={&(0x7f0000000180)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @rand_addr=0x64010102}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0x0)
syz_fuse_handle_req(r7, 0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x50, 0x0, 0xd, {0x7, 0x2b, 0x9, 0xffffffff80440084, 0xfffd, 0x7, 0xe9d, 0xffffffff, 0x0, 0x0, 0x8, 0xffffffff}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r9 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_MAXSEG(r9, 0x84, 0xd, 0x0, 0x0)

4.17539346s ago: executing program 6 (id=3160):
rt_sigprocmask(0x2, &(0x7f0000000200)={[0xfffffbfd]}, 0x0, 0x8)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r1, &(0x7f0000003900), 0x34aa945a513d639, 0x0)
recvmmsg(r0, &(0x7f0000000040), 0x80002c1, 0x2, 0x0)
r2 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)=<r3=>0x0)
clock_gettime(0x0, &(0x7f00000000c0))
timer_settime(r3, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0)
futex(&(0x7f000000cffc)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc)
socket$inet_tcp(0x2, 0x1, 0x0)
syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff)
ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9)
socket(0x10, 0x803, 0x0)

3.012445292s ago: executing program 4 (id=3161):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt(r1, 0x84, 0x7f, &(0x7f0000000040)="020c0000098011", 0x7)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_SAVE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="600000000806050000000509000200"], 0x60}, 0x1, 0x0, 0x0, 0x4040080}, 0x2000c084)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'team_slave_1\x00', &(0x7f0000000000)=@ethtool_eee={0x45, 0x7, 0x80000008, 0xa07b, 0x7, 0x7b24, 0x80000001, 0x0, [0x7, 0x4]}})
syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0)
r3 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0)
close(r3)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, 0x0, 0x0)
mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r5 = socket$inet_smc(0x2b, 0x1, 0x0)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="09000000010000006d05000005"], 0x50)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040))
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'syz_tun\x00'})
bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14)
sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000c80)={0x0}, 0x1, 0x0, 0x0, 0x2000c0c5}, 0x8000)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r7, 0x2000000, 0x7, 0x0, &(0x7f0000000600)="c9f7b986000000", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0xb4)
syz_emit_ethernet(0x3a, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r6}, 0x38)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000004c0), 0x1000, r6}, 0x38)
getsockopt$inet_tcp_int(r5, 0x11e, 0x1, 0x0, 0x0)
r8 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r8, &(0x7f00000065c0)=[{{&(0x7f0000000140)={0x2, 0x4e24, @remote}, 0x10, &(0x7f0000000740)=[{&(0x7f0000000680)="ef", 0x1}], 0x1}}, {{&(0x7f00000007c0)={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, 0x0}}], 0x2, 0x200080c4)
setsockopt$sock_int(r8, 0x1, 0x7, &(0x7f0000000000), 0x4)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x18d3e94a}, &(0x7f00000001c0)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r8, 0x84, 0x17, &(0x7f00000002c0)=ANY=[@ANYBLOB="0318ebd0de60196b2927efbe1a97fbe128cd900d9d109bfa5ea67de112787f556e"], 0xa)

3.012041965s ago: executing program 5 (id=3162):
socketpair$unix(0x1, 0x1, 0x0, 0x0)
fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
setxattr$trusted_overlay_upper(0x0, 0x0, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x80080, 0x0)
read$FUSE(r1, &(0x7f0000003d00)={0x2020}, 0x2020)

2.55072958s ago: executing program 9 (id=3164):
setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000140)={0x0, 0x1, 0x0, 0x0, @vifc_lcl_addr=@rand_addr=0xc0586300, @private=0xffffffff}, 0x10)

2.316741034s ago: executing program 2 (id=3165):
sendto$packet(0xffffffffffffffff, &(0x7f0000000380)="fad33075218151db00316f3a277fedbc86", 0x11, 0x6008092, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000084ffffffff00000000"], 0x0, 0x56}, 0x28)

2.249020624s ago: executing program 9 (id=3166):
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0)
ioctl$TIOCVHANGUP(r0, 0x5437, 0x0)
io_setup(0x4, &(0x7f00000003c0)=<r1=>0x0)
io_submit(r1, 0x0, 0x0)

2.104001488s ago: executing program 2 (id=3167):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100))
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f0000000100)={0x3f, 0x0, 0x4, 0x0, 0x131c, 0x0, 0x400000004, 0x1000008}, 0x0, 0x0, 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000fc0), 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

1.927805107s ago: executing program 9 (id=3168):
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f0000000400)={[{@grpquota}, {@nogrpid}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x4fa, &(0x7f0000000ac0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb)

1.887115266s ago: executing program 2 (id=3169):
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9)
getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, 0x0, &(0x7f0000000080))

1.703998275s ago: executing program 4 (id=3170):
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x84, @rand_addr=0x64010100, 0x4e21, 0x3, 'wrr\x00', 0x1, 0xa8a, 0x30}, 0x2c)
r1 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, 0x0, 0x0)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev, 0x9}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000040)={0x4000000, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="020f08001000000000000000fedbdf25030005000000000002000020000000000000000000000007080012000300000000000000000000000600320000000000000000000000000000000000000000000000ffffe0000001fe800000000000000000000000000018030006000020000002"], 0x80}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10)
ioctl$sock_inet_SIOCDARP(r4, 0x8953, &(0x7f0000000300)={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x16, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 'syz_tun\x00'})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
getsockopt$sock_cred(r6, 0x1, 0x11, 0x0, 0x0)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
gettid()
sendmmsg$unix(r6, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYRESOCT=r1, @ANYRES32, @ANYRES32, @ANYRES32=r5, @ANYBLOB="00100006"], 0x38, 0x4004c}}], 0x1, 0x804)
setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, 0x0, 0x1224)
sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x50, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x50}}, 0x0)

1.613222817s ago: executing program 1 (id=3171):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0)
sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x20040090}, 0x4010)
sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003d0000000000080003252d3a440008000100"/40], 0x28}, 0x1, 0x0, 0x0, 0x20004810}, 0x40)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket$unix(0x1, 0x1, 0x0)
r3 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', <r4=>0x0})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
r8 = bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="12000000060000000400000002"], 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r8}, &(0x7f0000000040), &(0x7f0000000140)=r7}, 0x20)
r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NBD_CMD_CONNECT(r9, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01002cbd700000000000010000000c00020002000000000000001c0007800c00018008000100", @ANYRES32=r6, @ANYBLOB, @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x55ebfcb85e78e904}, 0x4)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000002f000903feff00000000000006"], 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0)
recvmsg(r11, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x2000)
recvmsg$unix(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000004c0)=""/8, 0x8}], 0x1}, 0x10022)
r12 = socket(0x400000000010, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r4, 0x3e}, 0x80, &(0x7f0000001f40)=[{&(0x7f0000001d80)="ca", 0x1}], 0x1}, 0x20004014)
setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000740)=@nat={'nat\x00', 0x1b, 0x5, 0x388, 0x0, 0xf8, 0xffffffff, 0x0, 0xf8, 0x320, 0x320, 0xffffffff, 0x320, 0x320, 0x5, &(0x7f0000000340), {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x43}, 0xffffffff, 0xffffffff, 'vlan0\x00', 'vlan0\x00', {0xff}, {0xff}, 0x2e, 0x2, 0x20}, 0x0, 0xc0, 0xf8, 0x0, {}, [@common=@addrtype={{0x30}, {0x200, 0x0, 0x1, 0x1}}, @common=@socket0={{0x20}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x11, @remote, @loopback, @icmp_id=0x65, @icmp_id=0x68}}}}, {{@ip={@local, @multicast1, 0x0, 0xff000000, 'syz_tun\x00', 'ip_vti0\x00', {}, {}, 0x67, 0x1, 0x48}, 0x0, 0x70, 0xa8}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x4, 0x2, 0x2}, {0x3, 0x1, 0x1}, {0x3, 0x1}, 0x5, 0x1}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x4, @loopback, @broadcast, @icmp_id=0x68, @gre_key=0x1}}}}, {{@ip={@broadcast, @private=0xa010102, 0xffffff00, 0xffffffff, 'bridge0\x00', 'pimreg0\x00', {}, {0xff}, 0x5c, 0x2, 0xb}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0x2c}, @icmp_id=0x64, @gre_key=0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3e8)

1.487552952s ago: executing program 2 (id=3172):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
close(r0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100bd030000080003"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)

1.307453045s ago: executing program 4 (id=3173):
r0 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x0, 0xe8, 0x0, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@multicast1, @broadcast, 0xff000000, 0xff, 0x9, 0x12, {@empty, {[0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, 0x0, 0x3, 0x3, 0xa90a, 0x6, 0x3ff, 'veth0_vlan\x00', 'wg2\x00', {0xff}, {0xff}, 0x0, 0x71}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f8}}, {{@arp={@empty, @loopback, 0x0, 0xffffffff, 0xe, 0x2, {@mac=@local, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@random="8e932bc3db22", {[0x0, 0xff, 0x0, 0xff]}}, 0x0, 0x0, 0x400, 0x4fd9, 0x0, 0x98dc, 'team_slave_1\x00', 'macsec0\x00', {0xff}, {0xff}, 0x0, 0x280}, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @loopback, 0xf, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, @loopback, @multicast1, 0xf}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440)
r1 = socket$unix(0x1, 0x5, 0x0)
sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r1, @ANYBLOB="3bf81bb9f9"], 0x20000600}}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x60, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, 0x0, 0x0)
syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x80)
mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000001, 0x11, 0xffffffffffffffff, 0xc10c3000)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b18, &(0x7f0000000000)={'wlan0\x00'})
r5 = socket$nl_route(0x10, 0x3, 0x0)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fefdffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400010000000404000001000000b70500002a0000006a0a00fe00000000850000000b000000b70000005920000095000000000000006c8457920ba0fad478e86823cc07b88f5d76781dcb7729f41726a067818b990b13bfdd5db1b7ef826f015cd03018d546fa9b6827767c171a4f0720596bb3b4d821d976f5843061cc2e3afbae82d7932d4f91f718f0e56315040148e11bac31821236192321fa3b3042"], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000040)=""/24, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0}, 0x50)
sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0xc0d0)
openat(0xffffffffffffffff, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x58)
unshare(0x6a040000)
ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305)

1.260356922s ago: executing program 2 (id=3174):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
socket$nl_xfrm(0x10, 0x3, 0x6)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$inet6(r3, &(0x7f00000004c0)={&(0x7f00000000c0)={0xa, 0x4e1f, 0x7, @mcast2, 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=[@hoplimit={{0x14, 0x29, 0x34, 0x804006}}, @hoplimit={{0x14, 0x29, 0x34, 0x8}}, @pktinfo={{0x24, 0x29, 0x32, {@private0={0xfc, 0x0, '\x00', 0x1}}}}, @dstopts={{0x40, 0x29, 0x37, {0x1d, 0x4, '\x00', [@padn={0x1, 0x1, [0x0]}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @padn={0x1, 0x2, [0x0, 0x0]}, @hao={0xc9, 0x10, @private2}, @enc_lim={0x4, 0x1, 0x8}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x3}}], 0xb0}, 0xc894)
r4 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r4, 0x0)
dup3(r2, r1, 0x80000)
r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)
getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000080)={{{@in=@dev, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8)
keyctl$get_persistent(0x16, r6, r5)
keyctl$get_persistent(0x16, 0x0, r5)
socket$inet_sctp(0x2, 0x5, 0x84)
r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0)
syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x1, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0, @ANYBLOB="2c00eb5543485962e53fc646358c0251b331be42ce7fc189df12a9c44f701c6811d290b8e235f2f2e6364729baa741907db958005ccf52d438fed9a7b74e265d364bf7395e99fd53fb8183ce23741c0a4daf90bd3d581acad4bf35c7b9bfb17eb5b608956c2131c1bdd89524176f87cb6403eec3f360c9008f2e53d3dc7e6d6fb0976b64c2158cb1c8b5543db99390a61b41313d9860b8f26ef8d7e93686ae1ed7"], 0x3e, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0)
r8 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r8, &(0x7f0000000140)={&(0x7f0000000180)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @rand_addr=0x64010102}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0x0)
syz_fuse_handle_req(r7, 0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x50, 0x0, 0xd, {0x7, 0x2b, 0x9, 0xffffffff80440084, 0xfffd, 0x7, 0xe9d, 0xffffffff, 0x0, 0x0, 0x8, 0xffffffff}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r9 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_MAXSEG(r9, 0x84, 0xd, 0x0, 0x0)

1.198698364s ago: executing program 5 (id=3175):
r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1)
ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000380)=<r3=>0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054)
write$nci(r0, &(0x7f0000001380)=ANY=[@ANYBLOB="5201"], 0x4)
close(r0)

1.145204968s ago: executing program 1 (id=3176):
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e23, @multicast2}}, 0x0, 0x0, 0x20, 0x0, "bb02dfc344ca41d4357e544508474004a18b56c53a306d8bcf11007bbe00040000000000000000000000000000000000000000000000000000000000000000fee58bb2e86600"}, 0xd8)
r0 = socket$kcm(0x23, 0x5, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40041, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x6, 0x4)
listen(r0, 0x800)
accept4(r0, 0x0, 0x0, 0x80000)
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00"], 0x78)

0s ago: executing program 2 (id=3177):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x2, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {0xffe0, 0xb}, {0x7, 0xfff1}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x54815}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})

kernel console output (not intermixed with test programs):

om 0 to 256
[  541.501537][T11050] netlink: 44 bytes leftover after parsing attributes in process `syz.9.1110'.
[  541.678803][T11053] fuse: Bad value for 'fd'
[  541.926604][T11062] loop9: detected capacity change from 0 to 512
[  541.979763][T11061] block nbd5: shutting down sockets
[  542.029426][T11062] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[  542.143851][T11062] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode
[  542.182347][T11062] EXT4-fs error (device loop9): ext4_orphan_get:1425: comm syz.9.1113: bad orphan inode 131083
[  542.222298][T11062] loop9: lost filesystem error report for type 5 error -117
[  542.243527][T11062] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  542.316557][T11071] loop8: detected capacity change from 0 to 256
[  542.390638][T11071] FAT-fs (loop8): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  542.531897][T11071] FAT-fs (loop8): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001)
[  542.621967][T11062] overlayfs: upper fs needs to support d_type.
[  542.665108][T11071] FAT-fs (loop8): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001)
[  543.497953][T11062] overlayfs: failed index dir cleanup (-512)
[  543.527012][T11062] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index.
[  543.684802][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  544.533311][T11090] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  545.465235][T11093] block nbd0: server does not support multiple connections per device.
[  545.566273][T11093] block nbd0: shutting down sockets
[  546.057230][T11116] fuse: Bad value for 'fd'
[  546.249032][T11111] block nbd6: shutting down sockets
[  547.055788][T11123] loop2: detected capacity change from 0 to 512
[  547.117288][T11123] EXT4-fs: inline encryption not supported
[  547.159237][T11123] EXT4-fs: Ignoring removed i_version option
[  547.239975][T11123] EXT4-fs (loop2): 1 orphan inode deleted
[  547.254889][T11123] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  547.380062][T11123] EXT4-fs error (device loop2): htree_dirblock_to_tree:1051: inode #2: comm syz.2.1131: Directory hole found for htree leaf block 0
[  548.440361][ T8308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  549.994399][T11157] netlink: 132 bytes leftover after parsing attributes in process `syz.7.1139'.
[  550.687875][T11159] loop6: detected capacity change from 0 to 512
[  550.983626][T11159] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  551.000407][T11159] ext4 filesystem being mounted at /75/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  552.071928][   T30] audit: type=1800 audit(1785590367.335:19): pid=11159 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1141" name="file1" dev="loop6" ino=15 res=0 errno=0
[  552.096625][T11166] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  553.774469][ T5748] usb 10-1: new high-speed USB device number 2 using dummy_hcd
[  553.817131][T11177] block nbd2: shutting down sockets
[  553.835201][T11171] block nbd0: shutting down sockets
[  554.007069][ T8413] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  554.035681][ T5748] usb 10-1: Using ep0 maxpacket: 8
[  554.117063][ T5748] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024
[  554.134060][T11185] bond0: option mode: unable to set because the bond device is up
[  554.201566][ T5748] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024
[  554.273907][ T5748] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  554.335122][ T5748] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  554.406338][ T5748] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  554.470453][ T5748] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  555.775915][ T5748] usb 10-1: can't set config #16, error -71
[  555.957642][ T5748] usb 10-1: USB disconnect, device number 2
[  556.868601][T11218] loop7: detected capacity change from 0 to 1024
[  557.025026][T11218] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  557.105284][T11228] IPVS: set_ctl: invalid protocol: 1 0.0.0.0:20004
[  557.142283][T11226] loop9: detected capacity change from 0 to 512
[  557.184206][T11218] EXT4-fs warning (device loop7): ext4_expand_extra_isize_ea:2859: Unable to expand inode 12. Delete some EAs or run e2fsck.
[  557.229491][T11226] EXT4-fs warning (device loop9): dx_probe:843: Directory (ino: 2) htree depth 0x0002 exceedsupported value
[  557.288070][T11218] EXT4-fs error (device loop7): ext4_xattr_inode_iget:441: inode #11: comm syz.7.1155: missing EA_INODE flag
[  557.331483][T11218] EXT4-fs (loop7): Remounting filesystem read-only
[  557.341536][T11226] EXT4-fs warning (device loop9): dx_probe:848: Enable large directory feature to access it
[  557.684625][T11226] EXT4-fs warning (device loop9): dx_probe:933: inode #2: comm syz.9.1152: Corrupt directory, running e2fsck is recommended
[  557.714458][T11226] EXT4-fs (loop9): Cannot turn on journaled quota: type 1: error -117
[  558.271432][T11226] EXT4-fs error (device loop9): ext4_iget_extra_inode:5179: inode #15: comm syz.9.1152: corrupted in-inode xattr: invalid ea_ino
[  558.531901][T11226] loop9: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117
[  558.532574][T11226] EXT4-fs (loop9): Remounting filesystem read-only
[  558.541819][    C1] EXT4-fs (loop9): error count since last fsck: 1
[  558.541852][    C1] EXT4-fs (loop9): initial error at time 1785590373: ext4_iget_extra_inode:5179: inode 15
[  558.541908][    C1] EXT4-fs (loop9): last error at time 1785590373: ext4_iget_extra_inode:5179: inode 15
[  558.634099][T11226] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  558.720730][ T8395] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  559.231890][T11253] block nbd7: shutting down sockets
[  559.254804][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  560.305580][T11265] loop7: detected capacity change from 0 to 512
[  560.419217][T11265] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  560.449705][T11265] ext4 filesystem being mounted at /81/file2 supports timestamps until 2038-01-19 (0x7fffffff)
[  560.693111][T11265] syzkaller0: entered promiscuous mode
[  560.717616][T11265] syzkaller0: entered allmulticast mode
[  560.812225][T11280] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1170'.
[  560.869511][  T989] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[  561.081331][  T989] usb 3-1: Using ep0 maxpacket: 8
[  561.131074][  T989] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024
[  561.181082][  T989] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024
[  561.232613][  T989] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  561.283582][  T989] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  561.348545][  T989] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  561.416190][  T989] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  561.616902][ T8395] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  561.718334][  T989] usb 3-1: GET_CAPABILITIES returned 0
[  561.756879][  T989] usbtmc 3-1:16.0: can't read capabilities
[  562.005118][ T5768] usb 3-1: USB disconnect, device number 2
[  562.644752][T11311] netlink: 132 bytes leftover after parsing attributes in process `syz.6.1177'.
[  563.323639][T11314] block nbd7: shutting down sockets
[  563.875655][T11326] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  564.981364][T11340] netlink: 'syz.5.1189': attribute type 1 has an invalid length.
[  565.015104][T11339] loop6: detected capacity change from 0 to 256
[  565.871312][T11340] 8021q: adding VLAN 0 to HW filter on device bond2
[  566.180525][T11349] bond2: (slave veth0_to_bond): making interface the new active one
[  566.237279][T11340] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1189'.
[  566.282720][T11349] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link
[  566.559391][T11356] bond2: entered promiscuous mode
[  566.586643][T11356] veth0_to_bond: entered promiscuous mode
[  566.617931][T11356] bond2: entered allmulticast mode
[  566.805157][T11356] veth0_to_bond: entered allmulticast mode
[  566.992135][T11374] netlink: 132 bytes leftover after parsing attributes in process `syz.9.1195'.
[  567.944231][T11376] block nbd9: shutting down sockets
[  568.043720][ T5768] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[  568.257870][ T5768] usb 7-1: Using ep0 maxpacket: 8
[  568.291570][ T5768] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024
[  568.339945][ T5768] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024
[  568.388651][ T5768] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  568.433078][ T5768] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  568.508386][ T5768] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  568.552706][ T5768] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  568.732588][T11389] loop9: detected capacity change from 0 to 256
[  568.859136][T11389] FAT-fs (loop9): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001)
[  568.908250][ T5768] usb 7-1: GET_CAPABILITIES returned 0
[  568.934637][T11389] FAT-fs (loop9): Filesystem has been set read-only
[  568.937152][ T5768] usbtmc 7-1:16.0: can't read capabilities
[  568.982510][T11389] FAT-fs (loop9): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001)
[  569.020255][T11389] FAT-fs (loop9): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001)
[  569.073599][   T30] audit: type=1800 audit(1785590383.038:20): pid=11389 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.1199" name="file1" dev="loop9" ino=1048675 res=0 errno=0
[  569.165512][   T24] usb 7-1: USB disconnect, device number 2
[  569.503806][T11402] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1203'.
[  570.457915][T11421] netlink: 'syz.8.1209': attribute type 1 has an invalid length.
[  570.703097][T11430] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  570.799376][T11437] netlink: 44 bytes leftover after parsing attributes in process `syz.8.1209'.
[  570.938113][T11421] 8021q: adding VLAN 0 to HW filter on device bond5
[  571.025795][T11444] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1211'.
[  571.738932][T11426] bond4: (slave veth0_to_bond): Releasing active interface
[  571.809007][T11426] veth0_to_bond: left promiscuous mode
[  571.909300][T11426] veth0_to_bond: left allmulticast mode
[  571.997223][T11453] loop5: detected capacity change from 0 to 512
[  572.039531][T11426] bond5: (slave veth0_to_bond): making interface the new active one
[  572.077992][T11445] block nbd0: server does not support multiple connections per device.
[  572.089417][T11426] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link
[  572.111253][T11453] EXT4-fs: Ignoring removed mblk_io_submit option
[  572.119043][T11445] block nbd0: shutting down sockets
[  572.176814][T11433] bond5: entered promiscuous mode
[  572.206753][T11453] EXT4-fs (loop5): Test dummy encryption mode enabled
[  572.305391][   T30] audit: type=1326 audit(1785590385.947:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11448 comm="syz.9.1215" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdfe7d9e019 code=0x0
[  572.349013][T11433] veth0_to_bond: entered promiscuous mode
[  572.362488][T11453] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode
[  572.453537][T11433] bond5: entered allmulticast mode
[  572.663534][T11433] veth0_to_bond: entered allmulticast mode
[  572.739664][T11453] EXT4-fs error (device loop5): ext4_orphan_get:1425: comm syz.5.1217: bad orphan inode 131083
[  572.856275][T11453] loop5: lost filesystem error report for type 5 error -117
[  572.872799][T11453] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  573.025597][T11453] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-aesni"
[  573.199332][T11468] overlayfs: upper fs needs to support d_type.
[  574.096428][T11468] overlayfs: failed index dir cleanup (-512)
[  574.115734][T11468] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index.
[  574.557821][T11487] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1220'.
[  575.839674][   T24] usb 7-1: new high-speed USB device number 3 using dummy_hcd
[  575.850397][ T8292] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  576.287127][   T24] usb 7-1: Using ep0 maxpacket: 8
[  578.452947][   T24] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024
[  579.470083][   T24] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024
[  580.098831][T11518] loop8: detected capacity change from 0 to 8
[  580.192561][T11520] loop9: detected capacity change from 0 to 256
[  580.196687][   T24] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  580.258691][T11519] netlink: 'syz.5.1232': attribute type 1 has an invalid length.
[  580.449100][T11518] SQUASHFS error: Failed to read block 0x62: -5
[  580.523123][T11518] squashfs image failed sanity check
[  580.727280][T11526] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1232'.
[  580.745899][   T24] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  580.759807][   T24] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  580.769221][   T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  580.845207][   T24] usb 7-1: can't set config #16, error -71
[  580.860353][T11519] 8021q: adding VLAN 0 to HW filter on device bond3
[  580.874214][   T24] usb 7-1: USB disconnect, device number 3
[  580.936299][T11523] bond2: (slave veth0_to_bond): Releasing active interface
[  580.976167][T11523] veth0_to_bond: left promiscuous mode
[  580.995809][T11523] veth0_to_bond: left allmulticast mode
[  581.120916][T11523] bond3: (slave veth0_to_bond): making interface the new active one
[  581.183269][T11523] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link
[  581.259595][T11525] bond3: entered promiscuous mode
[  581.275854][T11525] veth0_to_bond: entered promiscuous mode
[  581.312961][T11525] bond3: entered allmulticast mode
[  581.336058][T11525] veth0_to_bond: entered allmulticast mode
[  583.077090][T11563] loop6: detected capacity change from 0 to 512
[  583.259072][ T5632] Bluetooth: hci0: command 0x0406 tx timeout
[  583.938311][T11563] EXT4-fs (loop6): warning: checktime reached, running e2fsck is recommended
[  584.026661][T11563] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  584.048725][T11563] ext4 filesystem being mounted at /95/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  585.069404][T11574] block nbd2: shutting down sockets
[  585.347643][T11577] overlayfs: upper fs does not support RENAME_WHITEOUT.
[  585.387716][T11577] overlayfs: failed to set xattr on upper
[  585.419981][T11577] overlayfs: ...falling back to redirect_dir=nofollow.
[  585.449684][T11577] overlayfs: ...falling back to index=off.
[  585.500356][T11577] overlayfs: ...falling back to uuid=null.
[  585.531000][T11577] overlayfs: NFS export requires "index=on", falling back to nfs_export=off.
[  585.603176][ T8413] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  586.270113][ T5789] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[  586.366434][T11592] loop8: detected capacity change from 0 to 256
[  586.431522][T11592] FAT-fs (loop8): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  586.476541][ T5789] usb 3-1: Using ep0 maxpacket: 8
[  586.526302][ T5789] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024
[  586.546697][T11595] syzkaller0: entered promiscuous mode
[  586.586045][ T5789] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024
[  586.589800][T11595] syzkaller0: entered allmulticast mode
[  586.648072][ T5789] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  586.697955][ T5789] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  586.779758][ T5789] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  586.821775][ T5789] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  587.109011][ T5789] usb 3-1: GET_CAPABILITIES returned 0
[  587.146821][ T5789] usbtmc 3-1:16.0: can't read capabilities
[  587.281978][T11607] loop9: detected capacity change from 0 to 512
[  587.329525][T11607] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode
[  587.379325][T11607] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082]
[  587.405688][T11607] System zones: 1-12
[  587.424310][    C1] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71
[  587.433640][    C1] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71
[  587.442953][    C1] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71
[  587.507511][T11607] EXT4-fs (loop9): 1 truncate cleaned up
[  587.540898][ T5790] usb 3-1: USB disconnect, device number 3
[  587.548603][T11607] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  588.188502][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  589.996915][T11639] block nbd9: shutting down sockets
[  590.307840][T11649] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1262'.
[  590.344979][T11649] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1262'.
[  591.076056][T11664] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1266'.
[  593.391394][T11683] loop5: detected capacity change from 0 to 256
[  593.420672][T11683] exfat: Deprecated parameter 'utf8'
[  593.439666][T11683] exfat: Deprecated parameter 'namecase'
[  593.469703][T11683] exfat: Deprecated parameter 'utf8'
[  593.570534][T11683] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0xb89b369d, utbl_chksum : 0xe619d30d)
[  593.611736][T11687] tipc: Started in network mode
[  593.619568][T11687] tipc: Node identity 625d45901d7f, cluster identity 4711
[  593.667657][T11687] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  593.749381][T11690] syzkaller0: entered promiscuous mode
[  593.839502][T11690] syzkaller0: entered allmulticast mode
[  593.883801][T11683] exFAT-fs (loop5): start_clu is invalid cluster(0x0)
[  594.214036][T11690] tipc: Resetting bearer <eth:syzkaller0>
[  594.306533][T11681] tipc: Resetting bearer <eth:syzkaller0>
[  594.517257][T11681] tipc: Disabling bearer <eth:syzkaller0>
[  594.580266][   T50] Bluetooth: hci0: unexpected event for opcode 0x0c1a
[  595.288660][T11700] block nbd8: shutting down sockets
[  597.645851][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[  597.679622][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[  597.805197][T11742] netlink: 'syz.6.1286': attribute type 1 has an invalid length.
[  598.109064][T11742] 8021q: adding VLAN 0 to HW filter on device bond2
[  598.119097][T11750] loop9: detected capacity change from 0 to 256
[  598.135104][T11752] netlink: 44 bytes leftover after parsing attributes in process `syz.6.1286'.
[  598.158719][T11750] FAT-fs (loop9): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  598.167100][T11753] loop2: detected capacity change from 0 to 256
[  598.195329][T11753] exfat: Deprecated parameter 'utf8'
[  598.245248][T11746] bond1: (slave veth0_to_bond): Releasing active interface
[  598.260320][T11753] exfat: Deprecated parameter 'namecase'
[  598.298178][T11746] veth0_to_bond: left promiscuous mode
[  598.320953][T11753] exfat: Deprecated parameter 'utf8'
[  598.339996][T11746] veth0_to_bond: left allmulticast mode
[  598.419475][T11753] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xb89b369d, utbl_chksum : 0xe619d30d)
[  598.437138][T11746] bond2: (slave veth0_to_bond): making interface the new active one
[  598.494230][T11746] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link
[  598.669411][T11748] bond2: entered promiscuous mode
[  598.727525][T11748] veth0_to_bond: entered promiscuous mode
[  598.757329][T11748] bond2: entered allmulticast mode
[  598.796614][T11753] exFAT-fs (loop2): start_clu is invalid cluster(0x0)
[  598.840270][T11748] veth0_to_bond: entered allmulticast mode
[  600.229035][T11779] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1298'.
[  600.803890][T11790] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  604.827360][T11839] loop7: detected capacity change from 0 to 256
[  605.903589][T11846] loop9: detected capacity change from 0 to 256
[  605.911803][T11845] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1315'.
[  605.955632][T11846] FAT-fs (loop9): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  606.640414][T11865] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  607.553916][T11870] block nbd8: NBD_DISCONNECT
[  607.559110][T11870] block nbd8: Send disconnect failed -32
[  607.565952][T11870] block nbd8: Disconnected due to user request.
[  607.572844][T11870] block nbd8: shutting down sockets
[  607.689537][T11867] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  608.680325][T11881] loop2: detected capacity change from 0 to 512
[  608.809578][T11881] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  608.943229][T11881] ext4 filesystem being mounted at /120/file2 supports timestamps until 2038-01-19 (0x7fffffff)
[  609.503303][ T8308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  610.268559][T11914] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  612.845364][T11933] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  613.227823][T11931] loop7: detected capacity change from 0 to 4096
[  613.235566][T11931] EXT4-fs: inline encryption not supported
[  613.356446][T11931] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled
[  613.365331][T11931] EXT4-fs (loop7): Test dummy encryption mode enabled
[  613.435291][T11931] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003]
[  613.443926][T11931] System zones: 0-5
[  613.492347][T11931] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  613.549266][T11931] process 'syz.7.1344' launched './file3' with NULL argv: empty string added
[  614.080461][ T8395] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  614.307346][T11945] loop8: detected capacity change from 0 to 8192
[  615.927185][T11970] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  618.281450][T12002] loop9: detected capacity change from 0 to 256
[  618.376538][T12004] netlink: 'syz.8.1363': attribute type 3 has an invalid length.
[  618.384355][T12004] netlink: 'syz.8.1363': attribute type 1 has an invalid length.
[  618.392261][T12004] netlink: 224 bytes leftover after parsing attributes in process `syz.8.1363'.
[  618.403115][T12004] NCSI netlink: No device for ifindex 767
[  618.626909][T12002] FAT-fs (loop9): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  619.497193][ T5632] Bluetooth: hci0: command 0x0406 tx timeout
[  619.777453][T12022] netlink: 132 bytes leftover after parsing attributes in process `syz.7.1367'.
[  620.352050][T12025] netlink: 16 bytes leftover after parsing attributes in process `syz.8.1368'.
[  628.713009][T12090] netlink: 132 bytes leftover after parsing attributes in process `syz.7.1383'.
[  629.268423][T12094] dyndbg: bad flag-op n, at start of net/
[  629.327285][T12094] dyndbg: flags parse failed
[  630.509773][T12106] loop6: detected capacity change from 0 to 256
[  630.548553][T12106] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  631.977153][T12122] tipc: Started in network mode
[  632.042242][T12122] tipc: Node identity 2ab54febda4f, cluster identity 4711
[  632.150022][T12122] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  632.234687][T12126] syzkaller0: entered promiscuous mode
[  632.328148][T12126] syzkaller0: entered allmulticast mode
[  632.486937][T12122] tipc: Resetting bearer <eth:syzkaller0>
[  632.572132][T12121] tipc: Resetting bearer <eth:syzkaller0>
[  632.780259][T12121] tipc: Disabling bearer <eth:syzkaller0>
[  633.740508][T12149] dyndbg: bad flag-op n, at start of net/
[  633.766664][T12149] dyndbg: flags parse failed
[  633.885016][T12151] input: syz0 as /devices/virtual/input/input5
[  637.763648][T12202] loop9: detected capacity change from 0 to 512
[  638.323307][T12208] dyndbg: bad flag-op n, at start of net/
[  638.341390][T12208] dyndbg: flags parse failed
[  638.909252][T12202] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  638.951534][T12202] ext4 filesystem being mounted at /123/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  639.047741][T12200] loop6: detected capacity change from 0 to 8192
[  639.083973][T12200] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  639.138285][T12202] EXT4-fs error (device loop9): ext4_xattr_delete_inode:2972: inode #15: comm syz.9.1416: corrupted xattr block 33: invalid checksum
[  639.265180][T12202] loop9: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -74
[  639.277897][T12217] loop8: detected capacity change from 0 to 256
[  639.340893][T12202] EXT4-fs warning (device loop9): ext4_evict_inode:287: xattr delete (err -74)
[  639.414116][T12217] FAT-fs (loop8): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  639.527023][T12222] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  639.865170][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  639.879037][T12227] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  640.367466][T12236] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1427'.
[  640.791079][T12239] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1428'.
[  642.683052][T12261] tipc: Started in network mode
[  642.730293][T12261] tipc: Node identity c62335ed13be, cluster identity 4711
[  642.776579][T12261] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  642.832152][T12263] syzkaller0: entered promiscuous mode
[  642.863731][T12263] syzkaller0: entered allmulticast mode
[  642.954765][T12261] tipc: Resetting bearer <eth:syzkaller0>
[  643.540944][T12260] tipc: Resetting bearer <eth:syzkaller0>
[  643.734018][T12260] tipc: Disabling bearer <eth:syzkaller0>
[  644.451945][T12283] 9p: Bad value for 'rfdno'
[  644.764546][T12289] loop8: detected capacity change from 0 to 512
[  644.791483][T12287] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  644.945470][T12289] EXT4-fs (loop8): 1 orphan inode deleted
[  644.973137][T12289] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  644.987292][ T7965] Quota error (device loop8): do_check_range: Getting dqdh_entries 15 out of range 0-14
[  645.014548][ T7965] EXT4-fs error (device loop8): ext4_release_dquot:7075: comm kworker/u8:17: Failed to release dquot type 1
[  645.027555][T12289] ext4 filesystem being mounted at /144/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  645.125618][T12304] loop7: detected capacity change from 0 to 256
[  646.172441][T12304] FAT-fs (loop7): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  647.198897][ T8222] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  649.408259][T12345] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1457'.
[  650.497250][T12352] tipc: Started in network mode
[  650.538325][T12352] tipc: Node identity 7ecac426424d, cluster identity 4711
[  650.566203][T12352] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  650.983949][T12363] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  650.999909][T12356] syzkaller0: entered promiscuous mode
[  651.012530][T12356] syzkaller0: entered allmulticast mode
[  651.699778][T12360] tipc: Resetting bearer <eth:syzkaller0>
[  652.045241][T12351] tipc: Resetting bearer <eth:syzkaller0>
[  652.057745][T12371] trusted_key: encrypted_key: keyword '·‚ã$default' not recognized
[  652.197383][T12351] tipc: Disabling bearer <eth:syzkaller0>
[  652.292864][   T24] tipc: Node number set to 1015530534
[  652.778570][T12382] loop9: detected capacity change from 0 to 512
[  652.828759][T12382] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  652.841447][T12382] ext4 filesystem being mounted at /132/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  653.050190][T12397] loop5: detected capacity change from 0 to 512
[  653.121714][T12397] EXT4-fs: Ignoring removed bh option
[  653.192176][   T30] audit: type=1800 audit(1785590460.670:22): pid=12378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1464" name="/" dev="fuse" ino=6 res=0 errno=0
[  653.483425][T12397] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  653.581329][T12397] ext4 filesystem being mounted at /158/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  654.539249][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  654.690270][   T30] audit: type=1800 audit(1785590462.064:23): pid=12397 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1469" name="file1" dev="loop5" ino=15 res=0 errno=0
[  654.852142][T12419] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1472'.
[  655.020978][ T8292] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  657.013715][   T29] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[  657.177163][   T29] usb 6-1: device descriptor read/64, error -71
[  657.490706][   T29] usb 6-1: new high-speed USB device number 4 using dummy_hcd
[  657.730737][   T29] usb 6-1: device descriptor read/64, error -71
[  657.862666][   T29] usb usb6-port1: attempt power cycle
[  658.259308][   T29] usb 6-1: new high-speed USB device number 5 using dummy_hcd
[  658.307774][   T29] usb 6-1: device descriptor read/8, error -71
[  658.597759][   T29] usb 6-1: new high-speed USB device number 6 using dummy_hcd
[  658.634115][   T29] usb 6-1: device descriptor read/8, error -71
[  658.772270][   T29] usb usb6-port1: unable to enumerate USB device
[  659.112123][T12453] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  659.268398][T12486] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3)
[  659.275138][T12486] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless)
[  659.319352][T12486] vhci_hcd vhci_hcd.0: Device attached
[  659.372687][T12487] vhci_hcd: connection closed
[  659.392069][ T7965] vhci_hcd vhci_hcd.6: stop threads
[  659.529630][  T989] vhci_hcd vhci_hcd.6: vhci_device speed not set
[  659.653130][ T7965] vhci_hcd vhci_hcd.6: release socket
[  659.662269][ T7965] vhci_hcd vhci_hcd.6: disconnect device
[  659.710191][  T989] usb 45-1: new full-speed USB device number 2 using vhci_hcd
[  660.095713][  T989] usb 45-1: enqueue for inactive port 0
[  660.567307][  T989] vhci_hcd vhci_hcd.6: vhci_device speed not set
[  661.382908][T12513] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1489'.
[  661.776337][T12524] loop2: detected capacity change from 0 to 512
[  661.877969][T12524] EXT4-fs error (device loop2): ext4_orphan_get:1399: inode #15: comm syz.2.1491: iget: bad extended attribute block 1
[  661.925215][T12524] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117
[  661.927692][T12524] EXT4-fs error (device loop2): ext4_orphan_get:1402: comm syz.2.1491: couldn't read orphan inode 15 (err -117)
[  661.936932][    C1] EXT4-fs (loop2): error count since last fsck: 1
[  661.936963][    C1] EXT4-fs (loop2): initial error at time 1785590468: ext4_orphan_get:1399: inode 15
[  661.937017][    C1] EXT4-fs (loop2): last error at time 1785590468: ext4_orphan_get:1399: inode 15
[  662.040402][T12524] loop2: lost filesystem error report for type 5 error -117
[  662.267831][T12524] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  662.367586][T12532] EXT4-fs error (device loop2): ext4_validate_block_bitmap:431: comm ext4lazyinit: bg 0: block 13: invalid block bitmap
[  662.444330][T12524] EXT4-fs error (device loop2): ext4_map_blocks:791: inode #2: block 13: comm syz.2.1491: lblock 0 mapped to illegal pblock 13 (length 1)
[  662.510789][T12524] EXT4-fs warning (device loop2): htree_dirblock_to_tree:1051: inode #2: lblock 0: comm syz.2.1491: error -EUCLEAN reading directory block
[  662.852564][ T8308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  663.602531][ T5790] usb 7-1: new high-speed USB device number 4 using dummy_hcd
[  664.319590][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[  664.327664][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[  664.806277][ T5790] usb 7-1: device descriptor read/64, error -71
[  665.158673][ T5790] usb 7-1: new high-speed USB device number 5 using dummy_hcd
[  665.429560][ T5790] usb 7-1: device descriptor read/64, error -71
[  665.619093][ T5790] usb usb7-port1: attempt power cycle
[  665.905542][T12568] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  666.447708][ T5790] usb 7-1: new high-speed USB device number 6 using dummy_hcd
[  667.088171][T12584] syzkaller0: entered promiscuous mode
[  667.105220][ T5790] usb 7-1: device descriptor read/8, error -71
[  667.127569][T12584] syzkaller0: entered allmulticast mode
[  667.377267][T12590] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  667.413468][T12590] Bluetooth: hci4: Opcode 0x0406 failed: -4
[  667.789591][T12590] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  667.808904][T12590] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  668.722544][T12609] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  668.943835][T12590] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  668.982081][T12590] Bluetooth: hci2: Opcode 0x0406 failed: -4
[  670.317079][ T5632] Bluetooth: hci4: command 0x0406 tx timeout
[  670.323958][ T5632] Bluetooth: hci1: command 0x0406 tx timeout
[  670.801449][T12590] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  670.823722][T12590] Bluetooth: hci3: Opcode 0x0406 failed: -4
[  670.931416][T12590] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  670.988201][T12590] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  671.085621][T12590] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  671.116274][T12590] Bluetooth: hci0: Opcode 0x0406 failed: -4
[  671.137990][ T5632] Bluetooth: hci2: command 0x0406 tx timeout
[  671.963866][T12657] loop8: detected capacity change from 0 to 256
[  672.141235][T12655] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  672.514422][ T5632] Bluetooth: hci4: command 0x0406 tx timeout
[  672.514985][   T50] Bluetooth: hci1: command 0x0406 tx timeout
[  673.040692][   T50] Bluetooth: hci3: command 0x0406 tx timeout
[  673.773603][ T5632] Bluetooth: hci0: command 0x0406 tx timeout
[  673.779676][   T50] Bluetooth: hci5: command 0x0406 tx timeout
[  673.785745][ T5632] Bluetooth: hci2: command 0x0406 tx timeout
[  675.289011][ T5627] Bluetooth: hci3: command 0x0406 tx timeout
[  675.980040][ T5627] Bluetooth: hci5: command 0x0406 tx timeout
[  675.986257][ T5632] Bluetooth: hci0: command 0x0406 tx timeout
[  676.943364][T12711] rdma_rxe: rxe_newlink: failed to add bond_slave_0
[  679.024346][T12753] loop2: detected capacity change from 0 to 256
[  680.543427][T12764] block nbd0: server does not support multiple connections per device.
[  680.552873][T12764] block nbd0: shutting down sockets
[  682.212721][T12793] loop8: detected capacity change from 0 to 1024
[  682.259809][T12793] EXT4-fs: Ignoring removed oldalloc option
[  682.283546][T12793] EXT4-fs: Ignoring removed oldalloc option
[  682.323099][T12793] EXT4-fs (loop8): stripe (4) is not aligned with cluster size (16), stripe is disabled
[  682.423294][T12793] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  682.453299][T12800] loop5: detected capacity change from 0 to 256
[  682.479384][T12793] EXT4-fs (loop8): shut down requested (1)
[  682.565527][T12793] overlayfs: failed to create directory ./bus/work (errno: 5); mounting read-only
[  682.616235][T12793] overlayfs: failed to get uuid (/file0, err=-5); falling back to uuid=null.
[  686.297400][ T8222] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  686.424769][T12839] block nbd0: server does not support multiple connections per device.
[  686.482293][T12839] block nbd0: shutting down sockets
[  687.298482][ T1110] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  687.656850][T12862] input: syz0 as /devices/virtual/input/input7
[  687.697417][ T1110] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  690.236133][ T1110] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  690.901697][ T5627] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  690.914767][ T5627] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  690.922788][ T5627] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  690.931561][ T5627] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  690.942275][ T5627] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  692.464044][ T1110] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  693.224258][ T5627] Bluetooth: hci4: command tx timeout
[  693.266730][T12921] loop9: detected capacity change from 0 to 512
[  693.731625][T12921] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  693.764714][T12930] loop7: detected capacity change from 0 to 256
[  693.823842][T12921] ext4 filesystem being mounted at /154/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  695.361577][   T30] audit: type=1800 audit(1785590499.629:24): pid=12918 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.1602" name="file1" dev="loop9" ino=15 res=0 errno=0
[  695.509003][ T5627] Bluetooth: hci4: command tx timeout
[  697.180893][T12955] bridge0: port 2(bridge_slave_1) entered disabled state
[  697.188479][T12955] bridge0: port 1(bridge_slave_0) entered disabled state
[  697.695636][T12955] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  697.730216][ T5627] Bluetooth: hci4: command tx timeout
[  697.798209][T12955] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  698.181212][ T1110] bridge_slave_1: left allmulticast mode
[  698.218488][ T1110] bridge_slave_1: left promiscuous mode
[  698.253547][ T1110] bridge0: port 2(bridge_slave_1) entered disabled state
[  698.302573][ T1110] bridge_slave_0: left allmulticast mode
[  698.333956][ T1110] bridge_slave_0: left promiscuous mode
[  698.621296][ T1110] bridge0: port 1(bridge_slave_0) entered disabled state
[  699.760382][ T1110] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  699.772799][ T1110] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  699.784092][ T1110] bond0 (unregistering): Released all slaves
[  699.830921][ T1110] bond1 (unregistering): Released all slaves
[  699.888554][ T1110] bond2 (unregistering): Released all slaves
[  699.981786][ T1110] bond3 (unregistering): Released all slaves
[  700.004771][ T5627] Bluetooth: hci4: command tx timeout
[  700.034459][ T1110] bond4 (unregistering): Released all slaves
[  700.118917][ T1110] bond5 (unregistering): (slave veth0_to_bond): Releasing active interface
[  700.138911][ T1110] veth0_to_bond: left promiscuous mode
[  700.150340][ T1110] veth0_to_bond: left allmulticast mode
[  700.178844][ T1110] bond5 (unregistering): Released all slaves
[  700.374556][ T1118] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  700.446715][ T1118] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  700.511823][T12507] syz2: Port: 1 Link DOWN
[  700.630695][ T1110] tipc: Left network mode
[  700.632607][   T79] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  701.308295][T12997] fuse: Unknown parameter '017777777777777777777770xffffffffffffffff00000000000000000000'
[  701.378134][T12997] loop7: detected capacity change from 0 to 256
[  701.393164][T12999] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  701.415138][ T7965] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  706.950951][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  706.993510][ T1110] hsr_slave_0: left promiscuous mode
[  707.063064][ T1110] hsr_slave_1: left promiscuous mode
[  707.097115][ T1110] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  707.137222][ T1110] batman_adv: batadv0: Removing interface: batadv_slave_0
[  707.172243][ T1110] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  707.204115][ T1110] batman_adv: batadv0: Removing interface: batadv_slave_1
[  707.239994][ T1110] veth1_macvtap: left promiscuous mode
[  707.270386][ T1110] veth0_macvtap: left promiscuous mode
[  707.298013][ T1110] veth1_vlan: left promiscuous mode
[  707.323739][ T1110] veth0_vlan: left promiscuous mode
[  707.881069][T13056] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(3)
[  707.887621][T13056] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[  708.483950][T13056] vhci_hcd vhci_hcd.0: Device attached
[  708.934846][T13059] vhci_hcd: connection closed
[  709.759363][   T36] vhci_hcd vhci_hcd.7: stop threads
[  709.847230][   T36] vhci_hcd vhci_hcd.7: release socket
[  709.887958][   T36] vhci_hcd vhci_hcd.7: disconnect device
[  709.948723][ T5790] usb 47-1: new low-speed USB device number 2 using vhci_hcd
[  709.961810][T13069] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1643'.
[  709.993581][ T5790] usb 47-1: enqueue for inactive port 0
[  710.123152][ T5790] vhci_hcd vhci_hcd.7: vhci_device speed not set
[  711.128228][ T1110] team0 (unregistering): Port device team_slave_1 removed
[  711.139648][ T5768] kernel write not supported for file /bluetooth/6lowpan_control (pid: 5768 comm: kworker/0:5)
[  711.209115][ T1110] team0 (unregistering): Port device team_slave_0 removed
[  711.332689][ T7965] smc: removing ib device syz2
[  713.648758][ T7965] smbdirect: ib_dev[syz2] removed
[  715.669319][T13126] tipc: Started in network mode
[  715.688917][T13126] tipc: Node identity ca01d6083084, cluster identity 4711
[  715.725797][T13126] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  715.758849][T13133] sch_tbf: burst 19872 is lower than device lo mtu (65550) !
[  715.788327][T13143] loop9: detected capacity change from 0 to 4096
[  715.836329][T13143] EXT4-fs (loop9): Test dummy encryption mode enabled
[  715.853232][T13143] EXT4-fs (loop9): DAX unsupported by block device.
[  715.881318][T13130] syzkaller0: entered promiscuous mode
[  715.887388][T13130] syzkaller0: entered allmulticast mode
[  716.664259][T13119] tipc: Resetting bearer <eth:syzkaller0>
[  716.809858][T13119] tipc: Disabling bearer <eth:syzkaller0>
[  717.429328][T12892] bridge0: port 1(bridge_slave_0) entered blocking state
[  717.476125][T12892] bridge0: port 1(bridge_slave_0) entered disabled state
[  717.518295][T12892] bridge_slave_0: entered allmulticast mode
[  717.653499][T12892] bridge_slave_0: entered promiscuous mode
[  717.682904][T12892] bridge0: port 2(bridge_slave_1) entered blocking state
[  717.685341][T13180] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1669'.
[  717.708538][T12892] bridge0: port 2(bridge_slave_1) entered disabled state
[  717.752424][T12892] bridge_slave_1: entered allmulticast mode
[  717.810312][T12892] bridge_slave_1: entered promiscuous mode
[  719.154333][ T5285] 8021q: adding VLAN 0 to HW filter on device eth16
[  719.586718][T12892] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  720.950804][T12892] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  722.418908][T13215] loop6: detected capacity change from 0 to 256
[  722.498142][T13215] FAT-fs (loop6): Directory bread(block 1285) failed
[  722.514259][T13215] FAT-fs (loop6): Directory bread(block 1286) failed
[  722.553872][T13215] FAT-fs (loop6): Directory bread(block 1287) failed
[  722.562593][T13215] FAT-fs (loop6): Directory bread(block 1288) failed
[  722.650231][T12892] team0: Port device team_slave_0 added
[  722.667397][ T5768] kernel read not supported for file / (pid: 5768 comm: kworker/0:5)
[  722.690465][T12892] team0: Port device team_slave_1 added
[  722.719063][T13231] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  723.094965][T12892] batman_adv: batadv0: Adding interface: batadv_slave_0
[  723.108799][T12892] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  723.147512][T12892] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  723.219729][T12892] batman_adv: batadv0: Adding interface: batadv_slave_1
[  723.259115][T12892] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  723.347893][T12892] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  723.469300][T13245] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1688'.
[  723.947894][T12892] hsr_slave_0: entered promiscuous mode
[  723.969910][T13233] loop9: detected capacity change from 0 to 32768
[  723.980290][T12892] hsr_slave_1: entered promiscuous mode
[  724.121646][T13233] XFS (loop9): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  724.299140][T13239] block nbd6: shutting down sockets
[  724.855144][T13233] XFS (loop9): Ending clean mount
[  725.230452][T13233] XFS (loop9): Quotacheck needed: Please wait.
[  725.757752][T13233] XFS (loop9): Quotacheck: Done.
[  726.798725][ T8637] XFS (loop9): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  727.898333][T13292] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  729.942484][ T5285] 8021q: adding VLAN 0 to HW filter on device eth15
[  730.029680][T13318] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  730.062363][T13312] syzkaller0: entered promiscuous mode
[  730.079111][T13312] syzkaller0: entered allmulticast mode
[  730.202067][T13316] tipc: Resetting bearer <eth:syzkaller0>
[  730.202088][T13321] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1700'.
[  730.536726][T13311] tipc: Resetting bearer <eth:syzkaller0>
[  730.545151][ T1110] IPVS: stop unused estimator thread 0...
[  730.622831][T13311] tipc: Disabling bearer <eth:syzkaller0>
[  730.762362][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[  730.771454][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[  731.207362][T13337] loop9: detected capacity change from 0 to 32768
[  731.491987][T13337] XFS (loop9): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  732.545616][T13361] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  732.665362][T13337] XFS (loop9): Ending clean mount
[  732.677700][T13337] XFS (loop9): Quotacheck needed: Please wait.
[  732.983260][T13337] XFS (loop9): Quotacheck: Done.
[  733.844347][   T30] audit: type=1800 audit(1785590535.062:25): pid=13371 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.1705" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop9" ino=4428 res=0 errno=0
[  735.019122][T13368] block nbd6: shutting down sockets
[  735.440527][T13393] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1716'.
[  735.602933][T12892] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  735.635123][T12892] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  735.646753][T12892] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  736.406300][T12892] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  736.463995][T12892] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  736.515143][T12892] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  736.544352][T12892] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  736.584783][T12892] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  736.988065][ T5285] 8021q: adding VLAN 0 to HW filter on device eth19
[  737.323559][T12892] 8021q: adding VLAN 0 to HW filter on device bond0
[  737.668155][T12892] 8021q: adding VLAN 0 to HW filter on device team0
[  737.700886][ T1118] bridge0: port 1(bridge_slave_0) entered blocking state
[  737.708062][ T1118] bridge0: port 1(bridge_slave_0) entered forwarding state
[  737.727431][ T1118] bridge0: port 2(bridge_slave_1) entered blocking state
[  737.734604][ T1118] bridge0: port 2(bridge_slave_1) entered forwarding state
[  738.362346][ T8637] XFS (loop9): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  738.798548][T13431] loop7: detected capacity change from 0 to 4096
[  739.718209][T13431] EXT4-fs (loop7): Test dummy encryption mode enabled
[  739.828663][T13431] EXT4-fs (loop7): DAX unsupported by block device.
[  743.660960][T13487] loop5: detected capacity change from 0 to 2048
[  744.574103][T13487] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  744.609301][T13487] ext4 filesystem being mounted at /205/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  745.198332][ T8292] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  745.484283][ T5285] 8021q: adding VLAN 0 to HW filter on device eth20
[  746.085744][T13507] block nbd9: shutting down sockets
[  746.927103][T12892] 8021q: adding VLAN 0 to HW filter on device batadv0
[  746.943930][T13535] loop6: detected capacity change from 0 to 128
[  747.104779][T12892] veth0_vlan: entered promiscuous mode
[  747.139556][T13539] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  747.195017][T12892] veth1_vlan: entered promiscuous mode
[  747.375545][T12892] veth0_macvtap: entered promiscuous mode
[  747.437438][T12892] veth1_macvtap: entered promiscuous mode
[  747.572971][T12892] batman_adv: batadv0: Interface activated: batadv_slave_0
[  747.655924][T12892] batman_adv: batadv0: Interface activated: batadv_slave_1
[  747.762899][   T79] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  747.826503][   T79] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  748.821700][ T3300] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  749.117637][ T6001] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  749.471815][ T1118] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  749.520011][ T1118] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  750.522564][T13579] loop9: detected capacity change from 0 to 4096
[  750.577322][T13579] EXT4-fs (loop9): Test dummy encryption mode enabled
[  750.633077][T13579] EXT4-fs (loop9): DAX unsupported by block device.
[  750.669324][T13575] 8021q: adding VLAN 0 to HW filter on device bond1
[  750.733080][T13575] 8021q: adding VLAN 0 to HW filter on device bond2
[  750.783401][T13575] 8021q: adding VLAN 0 to HW filter on device bond3
[  750.910796][ T3328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  750.956644][ T3328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  751.669417][T13593] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  752.017086][T13601] loop7: detected capacity change from 0 to 256
[  752.484317][T13618] loop9: detected capacity change from 0 to 512
[  752.569675][T13618] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e002e019, mo2=0002]
[  752.604543][T13618] System zones: 0-2, 18-18, 34-34
[  752.639826][T13618] EXT4-fs (loop9): 1 orphan inode deleted
[  752.684684][T13618] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  752.746558][T13618] ext4 filesystem being mounted at /176/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  752.768531][T13594] block nbd5: shutting down sockets
[  754.119185][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  754.672407][T13650] 8021q: adding VLAN 0 to HW filter on device bond0
[  754.693208][T13658] netlink: 60 bytes leftover after parsing attributes in process `syz.6.1777'.
[  754.722069][T13650] 8021q: adding VLAN 0 to HW filter on device team0
[  754.774618][T13650] 8021q: adding VLAN 0 to HW filter on device batadv0
[  754.799278][T12570] IPVS: starting estimator thread 0...
[  754.806095][T13662] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  754.912563][T13663] IPVS: using max 29 ests per chain, 69600 per kthread
[  754.934542][T13650] batman_adv: batadv0: Interface activated: batadv_slave_0
[  754.965032][T13650] batman_adv: batadv0: Interface activated: batadv_slave_1
[  754.996543][T13650] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  755.045452][T13650] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  755.132202][T13650] veth1_vlan: left promiscuous mode
[  755.163604][T13650] veth0_vlan: left promiscuous mode
[  755.200649][T13650] veth0_vlan: entered promiscuous mode
[  755.246299][T13650] veth1_vlan: entered promiscuous mode
[  755.295898][T13650] veth1_macvtap: left promiscuous mode
[  755.325475][T13650] veth0_macvtap: left promiscuous mode
[  755.357620][T13650] veth0_macvtap: entered promiscuous mode
[  755.402350][T13650] veth1_macvtap: entered promiscuous mode
[  755.471914][T13650] 8021q: adding VLAN 0 to HW filter on device bond1
[  755.508766][T13650] 8021q: adding VLAN 0 to HW filter on device eth0
[  755.548089][T13650] 8021q: adding VLAN 0 to HW filter on device eth1
[  755.573137][T13650] 8021q: adding VLAN 0 to HW filter on device eth2
[  755.599532][T13650] 8021q: adding VLAN 0 to HW filter on device eth3
[  755.636475][ T7968] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  755.671854][ T6001] bridge0: port 1(bridge_slave_0) entered blocking state
[  755.679093][ T6001] bridge0: port 1(bridge_slave_0) entered forwarding state
[  755.783651][ T6001] bridge0: port 2(bridge_slave_1) entered blocking state
[  755.790928][ T6001] bridge0: port 2(bridge_slave_1) entered forwarding state
[  756.807832][ T3300] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  756.849445][ T3300] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  756.884961][ T3300] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  756.990764][   T79] bond1: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex
[  757.429398][   T79] bond1: (slave veth0_to_bond): making interface the new active one
[  757.605740][   T79] veth0_to_bond: entered promiscuous mode
[  757.659927][   T79] veth0_to_bond: entered allmulticast mode
[  757.743453][   T79] bond1: active interface up!
[  758.077814][T13712] binder: 13710:13712 ioctl c0306201 200000000080 returned -14
[  758.156749][T13712] binder: 13710:13712 ioctl c0306201 2000000003c0 returned -14
[  758.566455][T13717] loop7: detected capacity change from 0 to 512
[  758.633062][T13717] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  758.710054][T13717] System zones: 1-12
[  758.752089][T13717] EXT4-fs error (device loop7): ext4_xattr_inode_iget:441: inode #12: comm syz.7.1790: missing EA_INODE flag
[  758.778875][T13727] 9p: Bad value for 'rfdno'
[  758.848902][T13717] loop7: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  758.854341][    C0] EXT4-fs (loop7): error count since last fsck: 1
[  758.869992][    C0] EXT4-fs (loop7): initial error at time 1785590558: ext4_xattr_inode_iget:441: inode 12
[  758.879900][    C0] EXT4-fs (loop7): last error at time 1785590558: ext4_xattr_inode_iget:441: inode 12
[  758.950142][T13717] EXT4-fs error (device loop7): ext4_xattr_inode_iget:444: comm syz.7.1790: error while reading EA inode 12 err=-117
[  758.986945][T13717] loop7: lost filesystem error report for type 5 error -117
[  758.991098][T13717] EXT4-fs (loop7): 1 orphan inode deleted
[  759.075264][T13717] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  759.756813][ T8395] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  760.160882][T13738] block nbd6: shutting down sockets
[  761.506719][T13772] loop5: detected capacity change from 0 to 2048
[  761.632137][T13772] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  761.749090][T13772] ext4 filesystem being mounted at /217/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff)
[  763.778956][T13784] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only
[  763.818419][T13784] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index.
[  763.829885][T13784] overlayfs: NFS export requires an index dir, falling back to nfs_export=off.
[  764.100699][T13800] 9p: Bad value for 'rfdno'
[  764.191423][ T8292] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  764.690476][T13813] loop5: detected capacity change from 0 to 4096
[  764.732970][T13813] EXT4-fs (loop5): Test dummy encryption mode enabled
[  764.775027][T13818] block nbd0: server does not support multiple connections per device.
[  764.791149][T13813] EXT4-fs (loop5): DAX unsupported by block device.
[  764.832244][T13818] block nbd0: shutting down sockets
[  766.149840][T13836] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1817'.
[  772.275816][T13902] block nbd0: server does not support multiple connections per device.
[  772.325715][T13902] block nbd0: shutting down sockets
[  772.858986][T13917] sctp: [Deprecated]: syz.7.1838 (pid 13917) Use of struct sctp_assoc_value in delayed_ack socket option.
[  772.858986][T13917] Use struct sctp_sack_info instead
[  772.956500][T13882] block nbd5: shutting down sockets
[  778.761829][T14001] loop7: detected capacity change from 0 to 512
[  779.530614][T14001] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  779.543754][T14001] ext4 filesystem being mounted at /201/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  780.638298][T14015] loop6: detected capacity change from 0 to 512
[  780.786022][T14015] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  780.909200][T14015] ext4 filesystem being mounted at /213/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  781.141598][T14015] EXT4-fs error (device loop6): ext4_validate_inode_bitmap:106: comm syz.6.1864: Corrupt inode bitmap - block_group = 0, inode_bitmap = 20
[  781.272756][T14015] EXT4-fs error (device loop6) in ext4_free_inode:363: Filesystem failed CRC
[  781.378243][ T8395] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  781.502364][ T8413] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  781.763516][T14030] syzkaller0: entered promiscuous mode
[  781.810224][T14030] syzkaller0: entered allmulticast mode
[  783.781787][T14065] 9p: Bad value for 'rfdno'
[  785.572679][T14096] syzkaller0: entered promiscuous mode
[  785.620350][T14096] syzkaller0: entered allmulticast mode
[  788.697772][T14133] loop3: detected capacity change from 0 to 512
[  788.919440][T14139] fuse: Bad value for 'fd'
[  789.757332][T14133] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  789.812088][T14133] ext4 filesystem being mounted at /21/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  790.188483][T12892] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  790.311796][ T5627] Bluetooth: hci5: unexpected event for opcode 0x0000
[  790.594384][T14171] 9p: Bad value for 'rfdno'
[  790.594720][T14169] binder_alloc: 14167: binder_alloc_buf, no vma
[  791.856006][T14188] syzkaller0: entered promiscuous mode
[  791.874457][T14188] syzkaller0: entered allmulticast mode
[  791.911311][T14195] io-wq is not configured for unbound workers
[  791.971472][T14199] loop7: detected capacity change from 0 to 256
[  793.382145][T14212] loop6: detected capacity change from 0 to 256
[  793.450084][T14212] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  793.500734][T14212] FAT-fs (loop6): error, corrupted directory (invalid entries)
[  793.669134][T14217] loop9: detected capacity change from 0 to 512
[  793.752475][T14217] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  793.808606][T14224] 9p: Bad value for 'wfdno'
[  793.833930][T14217] System zones: 1-12
[  793.858410][T14217] EXT4-fs error (device loop9): ext4_xattr_inode_iget:441: inode #12: comm syz.9.1918: missing EA_INODE flag
[  793.891049][T14217] loop9: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  793.895869][    C1] EXT4-fs (loop9): error count since last fsck: 1
[  793.911631][    C1] EXT4-fs (loop9): initial error at time 1785590590: ext4_xattr_inode_iget:441: inode 12
[  793.921541][    C1] EXT4-fs (loop9): last error at time 1785590590: ext4_xattr_inode_iget:441: inode 12
[  793.933364][T14217] EXT4-fs error (device loop9): ext4_xattr_inode_iget:444: comm syz.9.1918: error while reading EA inode 12 err=-117
[  793.947313][T14217] loop9: lost filesystem error report for type 5 error -117
[  793.948669][T14217] EXT4-fs (loop9): 1 orphan inode deleted
[  794.002795][T14217] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  794.151421][T14233] binder_alloc: 14231: binder_alloc_buf, no vma
[  794.339807][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  795.131256][ T5627] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0
[  795.144628][ T5627] Bluetooth: hci5: Injecting HCI hardware error event
[  795.596946][ T5627] Bluetooth: hci5: hardware error 0x00
[  797.307234][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[  797.314878][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[  797.386404][T14278] syzkaller0: entered promiscuous mode
[  797.403734][T14278] syzkaller0: entered allmulticast mode
[  797.904008][ T5627] Bluetooth: hci5: Opcode 0x0c03 failed: -110
[  798.019238][T14294] loop3: detected capacity change from 0 to 512
[  798.047507][T14295] 9p: Bad value for 'wfdno'
[  798.064487][T14294] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  798.104959][T14294] System zones: 1-12
[  798.123764][T14294] EXT4-fs error (device loop3): ext4_xattr_inode_iget:441: inode #12: comm syz.3.1939: missing EA_INODE flag
[  798.182819][T14294] loop3: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  798.183659][T14294] EXT4-fs error (device loop3): ext4_xattr_inode_iget:444: comm syz.3.1939: error while reading EA inode 12 err=-117
[  798.192869][    C0] EXT4-fs (loop3): error count since last fsck: 1
[  798.192905][    C0] EXT4-fs (loop3): initial error at time 1785590594: ext4_xattr_inode_iget:441: inode 12
[  798.192961][    C0] EXT4-fs (loop3): last error at time 1785590594: ext4_xattr_inode_iget:441: inode 12
[  798.245135][T14294] loop3: lost filesystem error report for type 5 error -117
[  798.245542][T14294] EXT4-fs (loop3): 1 orphan inode deleted
[  798.269218][T14294] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  799.273412][T12892] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  801.069571][T14342] syzkaller0: entered promiscuous mode
[  801.096538][T14342] syzkaller0: entered allmulticast mode
[  801.376409][T14352] loop6: detected capacity change from 0 to 512
[  801.441177][T14352] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled
[  801.505889][T14352] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  801.553885][T14352] ext4 filesystem being mounted at /229/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  801.769042][T14365] loop3: detected capacity change from 0 to 512
[  801.776142][T14363] 9p: Bad value for 'wfdno'
[  801.825991][T14365] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  801.877851][ T8413] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  801.895856][T14365] System zones: 1-12
[  801.951758][T14365] EXT4-fs error (device loop3): ext4_xattr_inode_iget:441: inode #12: comm syz.3.1958: missing EA_INODE flag
[  802.068569][T14365] loop3: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  802.073562][    C1] EXT4-fs (loop3): error count since last fsck: 1
[  802.090605][    C1] EXT4-fs (loop3): initial error at time 1785590598: ext4_xattr_inode_iget:441: inode 12
[  802.100483][    C1] EXT4-fs (loop3): last error at time 1785590598: ext4_xattr_inode_iget:441: inode 12
[  802.127925][T14365] EXT4-fs error (device loop3): ext4_xattr_inode_iget:444: comm syz.3.1958: error while reading EA inode 12 err=-117
[  802.196653][T14365] loop3: lost filesystem error report for type 5 error -117
[  802.208947][T14365] EXT4-fs (loop3): 1 orphan inode deleted
[  802.330764][T14374] input: syz1 as /devices/virtual/input/input8
[  802.903193][T14365] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  803.267176][ T5627] Bluetooth: hci2: unexpected event for opcode 0x0012
[  803.314456][T12892] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  803.708234][T14391] syzkaller0: entered promiscuous mode
[  803.736703][T14391] syzkaller0: entered allmulticast mode
[  803.820380][T14391] 0: reclassify loop, rule prio 0, protocol 800
[  804.192539][T14400] syzkaller0: entered promiscuous mode
[  804.218171][T14400] syzkaller0: entered allmulticast mode
[  804.246338][T14404] loop6: detected capacity change from 0 to 128
[  808.155044][T14463] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  808.405288][T14457] tipc: Disabling bearer <eth:syzkaller0>
[  809.133414][T14498] loop3: detected capacity change from 0 to 512
[  809.156119][T14498] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  809.193046][T14498] System zones: 1-12
[  809.199514][T14499] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  809.222977][T14498] EXT4-fs error (device loop3): ext4_xattr_inode_iget:441: inode #12: comm syz.3.1995: missing EA_INODE flag
[  809.251554][T14498] loop3: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  809.251954][T14498] EXT4-fs error (device loop3): ext4_xattr_inode_iget:444: comm syz.3.1995: error while reading EA inode 12 err=-117
[  809.261273][    C1] EXT4-fs (loop3): error count since last fsck: 1
[  809.261303][    C1] EXT4-fs (loop3): initial error at time 1785590604: ext4_xattr_inode_iget:441: inode 12
[  809.261357][    C1] EXT4-fs (loop3): last error at time 1785590604: ext4_xattr_inode_iget:441: inode 12
[  809.307183][T14498] loop3: lost filesystem error report for type 5 error -117
[  809.307580][T14498] EXT4-fs (loop3): 1 orphan inode deleted
[  809.324898][T14498] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  809.367913][T12507] kernel read not supported for file /video7 (pid: 12507 comm: kworker/0:7)
[  809.698912][T12892] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  810.157354][T14523] tipc: Started in network mode
[  810.196344][T14523] tipc: Node identity 32e41a660d78, cluster identity 4711
[  810.248045][T14523] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  810.972332][T14521] tipc: Disabling bearer <eth:syzkaller0>
[  811.659553][T14546] syzkaller0: entered promiscuous mode
[  811.690593][T14546] syzkaller0: entered allmulticast mode
[  811.772388][T14553] loop9: detected capacity change from 0 to 512
[  811.811603][T14553] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  811.819913][T14553] System zones: 1-12
[  811.829993][T14553] EXT4-fs error (device loop9): ext4_xattr_inode_iget:441: inode #12: comm syz.9.2013: missing EA_INODE flag
[  811.842116][T14553] loop9: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  811.842480][T14553] EXT4-fs error (device loop9): ext4_xattr_inode_iget:444: comm syz.9.2013: error while reading EA inode 12 err=-117
[  811.851682][    C0] EXT4-fs (loop9): error count since last fsck: 1
[  811.851714][    C0] EXT4-fs (loop9): initial error at time 1785590607: ext4_xattr_inode_iget:441: inode 12
[  811.851768][    C0] EXT4-fs (loop9): last error at time 1785590607: ext4_xattr_inode_iget:441: inode 12
[  811.898222][T14553] loop9: lost filesystem error report for type 5 error -117
[  811.901388][T14553] EXT4-fs (loop9): 1 orphan inode deleted
[  811.977962][T14553] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  812.057821][T14560] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  812.185781][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  812.445382][T14570] trusted_key: syz.2.2019 sent an empty control message without MSG_MORE.
[  813.770195][T14585] 9p: Bad value for 'rfdno'
[  814.159023][T14587] loop7: detected capacity change from 0 to 32768
[  814.205457][T14587] XFS (loop7): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  814.311833][T14587] XFS (loop7): Ending clean mount
[  814.321876][T14587] XFS (loop7): Quotacheck needed: Please wait.
[  814.451747][T14587] XFS (loop7): Quotacheck: Done.
[  814.778776][   T30] audit: type=1800 audit(1785590609.869:26): pid=14603 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2024" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop7" ino=4428 res=0 errno=0
[  815.076081][ T8395] XFS (loop7): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  818.450156][T14684] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check.
[  818.509816][T14685] loop6: detected capacity change from 0 to 512
[  818.560670][T14685] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  818.605305][T14685] System zones: 1-12
[  818.638890][T14685] EXT4-fs error (device loop6): ext4_xattr_inode_iget:441: inode #12: comm syz.6.2045: missing EA_INODE flag
[  818.674170][T14685] loop6: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  818.674629][T14685] EXT4-fs error (device loop6): ext4_xattr_inode_iget:444: comm syz.6.2045: error while reading EA inode 12 err=-117
[  818.683867][    C0] EXT4-fs (loop6): error count since last fsck: 1
[  818.683901][    C0] EXT4-fs (loop6): initial error at time 1785590613: ext4_xattr_inode_iget:441: inode 12
[  818.683956][    C0] EXT4-fs (loop6): last error at time 1785590613: ext4_xattr_inode_iget:441: inode 12
[  818.739065][T14685] loop6: lost filesystem error report for type 5 error -117
[  818.739500][T14685] EXT4-fs (loop6): 1 orphan inode deleted
[  818.822279][T14685] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  819.290071][T14706] lo speed is unknown, defaulting to 1000
[  820.002428][ T8413] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  820.223834][T14706] lo speed is unknown, defaulting to 1000
[  820.291762][T14706] lo speed is unknown, defaulting to 1000
[  821.922010][T14744] loop7: detected capacity change from 0 to 4096
[  822.115931][T14744] EXT4-fs (loop7): Test dummy encryption mode enabled
[  822.160833][T14744] EXT4-fs (loop7): DAX unsupported by block device.
[  823.985668][T14777] loop6: detected capacity change from 0 to 512
[  824.705882][T14777] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  824.780612][T14777] System zones: 1-12
[  824.834879][T14777] EXT4-fs error (device loop6): ext4_xattr_inode_iget:441: inode #12: comm syz.6.2067: missing EA_INODE flag
[  824.878808][T14777] loop6: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  824.879227][T14777] EXT4-fs error (device loop6): ext4_xattr_inode_iget:444: comm syz.6.2067: error while reading EA inode 12 err=-117
[  824.881938][T14706] infiniband syz0: set active
[  824.888446][    C1] EXT4-fs (loop6): error count since last fsck: 1
[  824.888477][    C1] EXT4-fs (loop6): initial error at time 1785590619: ext4_xattr_inode_iget:441: inode 12
[  824.888545][    C1] EXT4-fs (loop6): last error at time 1785590619: ext4_xattr_inode_iget:441: inode 12
[  824.976907][T14777] loop6: lost filesystem error report for type 5 error -117
[  824.990547][T14706] infiniband syz0: added lo
[  825.005550][T14777] EXT4-fs (loop6): 1 orphan inode deleted
[  825.054960][T14777] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  825.059825][T14706] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR
[  825.088022][T14797] 9p: Bad value for 'rfdno'
[  825.214435][T14706] infiniband syz0: Couldn't open port 1
[  825.228207][T14780] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  825.239291][ T5748] lo speed is unknown, defaulting to 1000
[  825.244080][T14706] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000
[  825.294962][ T8413] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  825.307429][T14706] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32
[  825.343404][T14706] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005
[  825.526450][T14779] tipc: Disabling bearer <eth:syzkaller0>
[  825.677634][T14808] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check.
[  826.696629][T14706] RDS/IB: syz0: added
[  826.721977][T14811] loop7: detected capacity change from 0 to 4096
[  826.730946][T14706] smc: adding ib device syz0 with port count 1
[  826.746417][T14811] EXT4-fs (loop7): Test dummy encryption mode enabled
[  826.770656][T14706] smc:    ib device syz0 port 1 has no pnetid
[  826.778306][T14706] lo speed is unknown, defaulting to 1000
[  826.789636][T14811] EXT4-fs (loop7): DAX unsupported by block device.
[  826.831675][  T989] lo speed is unknown, defaulting to 1000
[  827.145656][T14823] loop9: detected capacity change from 0 to 8
[  827.182009][T14823] squashfs: Bad value for 'errors'
[  829.644917][T14706] lo speed is unknown, defaulting to 1000
[  829.828008][T14864] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  830.085273][T14879] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  830.788796][T14896] loop5: detected capacity change from 0 to 8
[  830.828790][T14896] squashfs: Bad value for 'errors'
[  831.215383][T14706] lo speed is unknown, defaulting to 1000
[  831.386897][T14916] loop5: detected capacity change from 0 to 512
[  831.477259][T14916] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  831.499707][T14916] ext4 filesystem being mounted at /270/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  832.182492][T14706] lo speed is unknown, defaulting to 1000
[  832.245478][T14937] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  832.295625][ T8292] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  832.301812][T14939] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  833.302457][T14706] lo speed is unknown, defaulting to 1000
[  834.709106][T14706] lo speed is unknown, defaulting to 1000
[  834.849730][T14981] syzkaller0: entered promiscuous mode
[  834.857123][T14981] syzkaller0: entered allmulticast mode
[  834.874303][T14984] syzkaller0: tun_net_xmit 1500
[  836.461043][   T50] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  836.477781][   T50] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  836.487369][   T50] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  836.495693][   T50] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  836.503652][   T50] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  838.723653][   T50] Bluetooth: hci6: command tx timeout
[  838.881519][T14970] lo speed is unknown, defaulting to 1000
[  839.213047][T15018] syzkaller0: entered promiscuous mode
[  839.219073][T15018] syzkaller0: entered allmulticast mode
[  840.973055][   T50] Bluetooth: hci6: command tx timeout
[  841.141825][ T7968] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  841.495013][ T7968] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  841.810096][T15059] syzkaller0: entered promiscuous mode
[  841.822133][T15059] syzkaller0: entered allmulticast mode
[  841.918406][T15062] bridge0: port 2(bridge_slave_1) entered disabled state
[  841.926164][T15062] bridge0: port 1(bridge_slave_0) entered disabled state
[  841.970592][T15001] lo speed is unknown, defaulting to 1000
[  842.106760][ T7968] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  842.756082][T14884] infiniband syz2: set active
[  842.761086][T14884] infiniband syz2: added bond_slave_0
[  842.795200][T14884] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000
[  842.821936][T14884] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32
[  842.871323][T14884] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005
[  842.976382][T14884] RDS/IB: syz2: added
[  842.980446][T14884] smc: adding ib device syz2 with port count 1
[  843.012307][T14884] smc:    ib device syz2 port 1 has no pnetid
[  843.026896][ T7968] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  843.235241][   T50] Bluetooth: hci6: command tx timeout
[  843.317053][T15087] syzkaller0: entered promiscuous mode
[  843.325270][T15087] syzkaller0: entered allmulticast mode
[  845.176209][ T7968] bridge_slave_1: left allmulticast mode
[  845.191000][ T7968] bridge_slave_1: left promiscuous mode
[  845.212150][ T7968] bridge0: port 2(bridge_slave_1) entered disabled state
[  845.248714][ T7968] bridge_slave_0: left allmulticast mode
[  845.260609][ T7968] bridge_slave_0: left promiscuous mode
[  845.271944][ T7968] bridge0: port 1(bridge_slave_0) entered disabled state
[  845.509471][   T50] Bluetooth: hci6: command tx timeout
[  845.749025][ T7968] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  845.761889][ T7968] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  845.783394][ T7968] bond0 (unregistering): Released all slaves
[  845.867231][T15113] syzkaller0: entered promiscuous mode
[  845.880098][T15113] syzkaller0: entered allmulticast mode
[  846.822372][T15156] loop6: detected capacity change from 0 to 256
[  847.098678][ T5627] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  847.112659][ T5627] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  847.122861][ T5627] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  847.600989][ T5627] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  847.619172][ T5627] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  848.218084][T15001] bridge0: port 1(bridge_slave_0) entered blocking state
[  848.254804][T15001] bridge0: port 1(bridge_slave_0) entered disabled state
[  848.284107][T15001] bridge_slave_0: entered allmulticast mode
[  848.316798][T15001] bridge_slave_0: entered promiscuous mode
[  848.363108][T15001] bridge0: port 2(bridge_slave_1) entered blocking state
[  848.398937][T15001] bridge0: port 2(bridge_slave_1) entered disabled state
[  848.433313][T15001] bridge_slave_1: entered allmulticast mode
[  848.473701][T15001] bridge_slave_1: entered promiscuous mode
[  848.682255][T15001] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  848.754917][T15001] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  848.958741][T15001] team0: Port device team_slave_0 added
[  849.113956][T15001] team0: Port device team_slave_1 added
[  849.291152][T15193] Illegal XDP return value 158 on prog  (id 139) dev syz_tun, expect packet loss!
[  849.311922][T15001] batman_adv: batadv0: Adding interface: batadv_slave_0
[  849.348176][T15001] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  849.434561][T15001] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  849.445545][T15196] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  849.480961][T15001] batman_adv: batadv0: Adding interface: batadv_slave_1
[  849.512833][T15001] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  849.635407][T15001] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  849.697129][ T5285] 8021q: adding VLAN 0 to HW filter on device eth1
[  849.899658][   T50] Bluetooth: hci4: command tx timeout
[  850.067912][T15001] hsr_slave_0: entered promiscuous mode
[  850.096017][T15001] hsr_slave_1: entered promiscuous mode
[  850.111918][T15001] debugfs: 'hsr0' already exists in 'hsr'
[  850.133530][T15001] Cannot create hsr debugfs directory
[  850.246578][T15203] syzkaller0: entered promiscuous mode
[  850.267341][T15203] syzkaller0: entered allmulticast mode
[  852.149484][   T50] Bluetooth: hci4: command tx timeout
[  853.248423][T15260] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  853.583574][ T5285] 8021q: adding VLAN 0 to HW filter on device eth2
[  854.445915][   T50] Bluetooth: hci4: command tx timeout
[  854.494753][T15001] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  855.178697][T15001] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  855.232868][T15001] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  855.294272][T15001] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  855.341146][T15001] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  855.430099][T15001] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  855.476515][T15001] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  855.533892][T15001] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  855.747772][T15314] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  855.763375][T15311] syzkaller0: entered promiscuous mode
[  855.783960][T15311] syzkaller0: entered allmulticast mode
[  856.680560][   T50] Bluetooth: hci4: command tx timeout
[  856.928603][T15326] 9p: Bad value for 'rfdno'
[  857.085721][T15001] 8021q: adding VLAN 0 to HW filter on device bond0
[  857.120331][T15238] lo speed is unknown, defaulting to 1000
[  857.173456][T15001] 8021q: adding VLAN 0 to HW filter on device team0
[  857.248370][ T3328] bridge0: port 1(bridge_slave_0) entered blocking state
[  857.255597][ T3328] bridge0: port 1(bridge_slave_0) entered forwarding state
[  857.354406][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[  857.361631][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[  857.384273][T15332] netlink: 44 bytes leftover after parsing attributes in process `syz.9.2206'.
[  857.597582][ T5285] 8021q: adding VLAN 0 to HW filter on device eth3
[  857.761618][T15154] lo speed is unknown, defaulting to 1000
[  858.453011][T15364] loop9: detected capacity change from 0 to 256
[  859.431040][T15384] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  861.249935][T15407] netlink: 76 bytes leftover after parsing attributes in process `syz.9.2217'.
[  861.290119][ T7968] hsr_slave_0: left promiscuous mode
[  861.346323][ T7968] hsr_slave_1: left promiscuous mode
[  861.370351][ T7968] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  861.397714][ T7968] batman_adv: batadv0: Removing interface: batadv_slave_0
[  861.437013][T15415] fuse: Bad value for 'fd'
[  861.448862][ T7968] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  861.470090][ T7968] batman_adv: batadv0: Removing interface: batadv_slave_1
[  861.560148][ T7968] veth1_macvtap: left promiscuous mode
[  861.599342][ T7968] veth0_macvtap: left promiscuous mode
[  861.621072][ T7968] veth1_vlan: left promiscuous mode
[  861.634510][ T7968] veth0_vlan: left promiscuous mode
[  862.532399][ T7968] team0 (unregistering): Port device team_slave_1 removed
[  862.553087][ T7968] team0 (unregistering): Port device team_slave_0 removed
[  862.726893][T15001] 8021q: adding VLAN 0 to HW filter on device batadv0
[  862.844810][T15418] syzkaller0: entered promiscuous mode
[  862.852981][T15418] syzkaller0: entered allmulticast mode
[  862.876463][ T5285] 8021q: adding VLAN 0 to HW filter on device eth4
[  862.898834][ T5628] lo speed is unknown, defaulting to 1000
[  862.926067][ T5628] syz0: Port: 1 Link DOWN
[  863.423337][ T1118] smc: removing ib device syz0
[  863.853144][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[  863.859768][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[  865.001590][  T802] lo speed is unknown, defaulting to 1000
[  865.062857][ T1118] smbdirect: ib_dev[syz0] removed
[  866.688539][T15484] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2233'.
[  866.893803][T15493] block nbd0: server does not support multiple connections per device.
[  867.000351][T15493] block nbd0: shutting down sockets
[  868.230369][T15001] veth0_vlan: entered promiscuous mode
[  868.758706][T15508] syzkaller0: entered promiscuous mode
[  868.769013][T15508] syzkaller0: entered allmulticast mode
[  868.828389][T15001] veth1_vlan: entered promiscuous mode
[  872.216106][T15154] bridge0: port 1(bridge_slave_0) entered blocking state
[  872.237547][T15154] bridge0: port 1(bridge_slave_0) entered disabled state
[  872.253881][T15154] bridge_slave_0: entered allmulticast mode
[  872.293474][T15154] bridge_slave_0: entered promiscuous mode
[  872.334816][T15154] bridge0: port 2(bridge_slave_1) entered blocking state
[  872.357384][T15154] bridge0: port 2(bridge_slave_1) entered disabled state
[  872.708576][T15154] bridge_slave_1: entered allmulticast mode
[  872.752961][T15154] bridge_slave_1: entered promiscuous mode
[  873.440313][T15154] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  873.529188][T15154] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  873.636982][T15001] veth0_macvtap: entered promiscuous mode
[  873.776372][T15001] veth1_macvtap: entered promiscuous mode
[  873.787534][T15581] Bluetooth: hci0: invalid len left 7, exp >= 50
[  873.802641][T15584] 9p: Bad value for 'rfdno'
[  873.828789][T15154] team0: Port device team_slave_0 added
[  873.859465][T15154] team0: Port device team_slave_1 added
[  874.353869][T15154] batman_adv: batadv0: Adding interface: batadv_slave_0
[  874.417031][T15154] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  874.523117][T15154] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  874.612435][T15154] batman_adv: batadv0: Adding interface: batadv_slave_1
[  874.643494][T15154] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  874.785615][T15154] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  874.867761][T15611] fuse: Bad value for 'fd'
[  874.887245][T15001] batman_adv: batadv0: Interface activated: batadv_slave_0
[  875.007639][T15001] batman_adv: batadv0: Interface activated: batadv_slave_1
[  876.149365][T15625] binder: 15621:15625 ioctl 400c620e 200000000100 returned -22
[  876.166830][T15154] hsr_slave_0: entered promiscuous mode
[  876.191448][T15154] hsr_slave_1: entered promiscuous mode
[  876.521606][ T1125] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  877.098533][T15647] 9p: Bad value for 'rfdno'
[  877.205016][   T48] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  877.256030][ T1118] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  877.305180][ T1118] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  877.493189][ T7968] IPVS: stop unused estimator thread 0...
[  877.638699][T15643] syzkaller0: entered promiscuous mode
[  877.648415][T15643] syzkaller0: entered allmulticast mode
[  878.945971][T15678] binder: 15677:15678 ioctl 400c620e 200000000100 returned -22
[  879.757198][T15694] 9p: Bad value for 'rfdno'
[  880.034121][T15704] loop9: detected capacity change from 0 to 8
[  880.056587][T15704] squashfs: Bad value for 'errors'
[  882.249649][ T7968] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  882.515613][ T1110] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  882.587915][ T1110] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  883.612572][T15719] binder: 15718:15719 ioctl 400c620e 200000000100 returned -22
[  883.624346][ T7968] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  884.359561][ T1118] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  884.368694][ T1118] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  885.115343][ T7968] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  885.500501][T15741] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  887.295741][T15780] loop6: detected capacity change from 0 to 8
[  887.351217][T15780] squashfs: Bad value for 'errors'
[  887.358226][ T7968] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  888.072457][T15791] binder: 15790:15791 ioctl 400c620e 200000000100 returned -22
[  890.453458][T15825] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  890.534572][ T7968] bridge_slave_1: left allmulticast mode
[  890.560482][ T7968] bridge_slave_1: left promiscuous mode
[  890.584263][ T7968] bridge0: port 2(bridge_slave_1) entered disabled state
[  891.142400][T15838] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2308'.
[  891.889914][ T7968] bridge_slave_0: left allmulticast mode
[  891.949729][ T7968] bridge_slave_0: left promiscuous mode
[  891.973620][ T7968] bridge0: port 1(bridge_slave_0) entered disabled state
[  892.177381][T15853] binder: 15852:15853 ioctl 400c620e 200000000100 returned -22
[  892.205605][T15854] loop6: detected capacity change from 0 to 8
[  892.240597][T15854] squashfs: Bad value for 'errors'
[  892.731417][ T7968] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  892.777273][ T7968] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  892.800610][ T7968] bond0 (unregistering): Released all slaves
[  892.833860][ T7968] bond1 (unregistering): (slave veth0_to_bond): Releasing active interface
[  892.850031][ T7968] veth0_to_bond: left promiscuous mode
[  892.857686][ T7968] veth0_to_bond: left allmulticast mode
[  892.874160][ T7968] bond1 (unregistering): Released all slaves
[  893.102015][ T5748] syz2: Port: 1 Link DOWN
[  893.330403][ T7968] tipc: Left network mode
[  894.307499][T15890] loop6: detected capacity change from 0 to 512
[  894.397446][T15890] EXT4-fs (loop6): 1 truncate cleaned up
[  894.446639][T15897] binder: 15895:15897 ioctl 400c620e 200000000100 returned -22
[  894.546401][T15890] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  894.671585][   T30] audit: type=1800 audit(1785590683.632:27): pid=15890 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.2320" name="file0" dev="loop6" ino=13 res=0 errno=0
[  894.715740][T15890] EXT4-fs error (device loop6): ext4_free_branches:1020: inode #13: comm syz.6.2320: invalid indirect mapped block 234881024 (level 0)
[  894.837674][T15907] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2322'.
[  895.511834][ T8413] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  895.578470][T15910] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  896.267195][T15154] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  896.349288][T15154] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  896.403366][T15154] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  896.476143][T15154] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  896.563225][T15154] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  897.551766][T15949] binder: 15948:15949 ioctl 400c620e 200000000100 returned -22
[  897.719672][T15154] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  897.904211][T15154] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  897.974116][T15154] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  898.462143][T15980] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2342'.
[  900.518834][T15995] 9p: Could not find request transport: fd0x0000000000000003
[  900.659750][T15986] gtp0: entered allmulticast mode
[  900.761821][T16008] binder: 16007:16008 ioctl 400c620e 200000000100 returned -22
[  902.295134][T15154] 8021q: adding VLAN 0 to HW filter on device bond0
[  902.520910][ T7968] hsr_slave_0: left promiscuous mode
[  902.569476][ T7968] hsr_slave_1: left promiscuous mode
[  902.618311][ T7968] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  902.749833][ T7968] batman_adv: batadv0: Removing interface: batadv_slave_0
[  903.204209][ T7968] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  903.275224][ T7968] batman_adv: batadv0: Removing interface: batadv_slave_1
[  903.411454][T16039] 9p: Could not find request transport: fd0x0000000000000003
[  903.449757][ T7968] veth1_macvtap: left promiscuous mode
[  903.455355][ T7968] veth0_macvtap: left promiscuous mode
[  903.466235][ T7968] veth1_vlan: left promiscuous mode
[  903.475175][ T7968] veth0_vlan: left promiscuous mode
[  904.401280][T16078] 9pnet_fd: Insufficient options for proto=fd
[  904.752615][ T7968] team0 (unregistering): Port device team_slave_1 removed
[  904.814659][ T7968] team0 (unregistering): Port device team_slave_0 removed
[  904.945129][ T3328] smc: removing ib device syz2
[  906.587055][ T3328] smbdirect: ib_dev[syz2] removed
[  906.762815][T15154] 8021q: adding VLAN 0 to HW filter on device team0
[  906.809977][T15154] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  906.820362][T15154] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  906.918992][ T6001] bridge0: port 1(bridge_slave_0) entered blocking state
[  906.927907][ T6001] bridge0: port 1(bridge_slave_0) entered forwarding state
[  907.050608][ T6001] bridge0: port 2(bridge_slave_1) entered blocking state
[  907.057879][ T6001] bridge0: port 2(bridge_slave_1) entered forwarding state
[  908.779746][T16125] 9p: Could not find request transport: fd0x0000000000000003
[  910.243474][T16162] loop6: detected capacity change from 0 to 2048
[  910.331668][T16162]  loop6: p1 < > p3 p4 < >
[  910.371272][T15154] 8021q: adding VLAN 0 to HW filter on device batadv0
[  910.409103][T16162] loop6: p3 start 4284289 is beyond EOD, truncated
[  910.826661][T16175] loop6: detected capacity change from 0 to 256
[  914.148149][ T5627] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  914.160274][ T5627] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  914.172358][ T5627] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  914.188845][ T5627] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  914.199041][ T5627] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  915.044492][ T7968] IPVS: stop unused estimator thread 0...
[  915.468276][   T30] audit: type=1326 audit(1785590702.816:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16218 comm="syz.5.2397" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd51039e019 code=0x0
[  916.459852][   T50] Bluetooth: hci3: command tx timeout
[  916.692046][T16236] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  919.058035][   T50] Bluetooth: hci3: command tx timeout
[  921.301848][   T50] Bluetooth: hci3: command tx timeout
[  921.783125][T16295] 9pnet_fd: Insufficient options for proto=fd
[  923.553462][   T50] Bluetooth: hci3: command tx timeout
[  923.724408][T16323] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  925.048509][T16359] block nbd0: server does not support multiple connections per device.
[  925.075920][T16359] block nbd0: shutting down sockets
[  925.081573][ T1118] bridge_slave_1: left allmulticast mode
[  925.094076][ T1118] bridge_slave_1: left promiscuous mode
[  925.124219][ T1118] bridge0: port 2(bridge_slave_1) entered disabled state
[  925.170820][ T1118] bridge_slave_0: left allmulticast mode
[  925.188783][ T1118] bridge_slave_0: left promiscuous mode
[  925.196521][ T1118] bridge0: port 1(bridge_slave_0) entered disabled state
[  925.552358][    T9] kernel read not supported for file /92/schedstat (pid: 9 comm: kworker/0:0)
[  925.701029][ T1118] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  925.719413][ T1118] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  925.738016][ T1118] bond0 (unregistering): Released all slaves
[  925.766447][T16378] dvmrp0: entered allmulticast mode
[  926.136580][ T1118] hsr_slave_0: left promiscuous mode
[  926.159699][ T1118] hsr_slave_1: left promiscuous mode
[  926.171424][ T1118] batman_adv: batadv0: Removing interface: batadv_slave_0
[  926.193004][ T1118] batman_adv: batadv0: Removing interface: batadv_slave_1
[  927.066282][T16437] 9p: Bad value for 'wfdno'
[  928.251641][ T1118] team0 (unregistering): Port device team_slave_1 removed
[  928.318233][ T1118] team0 (unregistering): Port device team_slave_0 removed
[  929.164788][T16414] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  929.724353][T16203] bridge0: port 1(bridge_slave_0) entered blocking state
[  929.746096][T16203] bridge0: port 1(bridge_slave_0) entered disabled state
[  929.753996][T16203] bridge_slave_0: entered allmulticast mode
[  929.825414][T16203] bridge_slave_0: entered promiscuous mode
[  929.859886][T16203] bridge0: port 2(bridge_slave_1) entered blocking state
[  929.906383][T16203] bridge0: port 2(bridge_slave_1) entered disabled state
[  929.934689][T16203] bridge_slave_1: entered allmulticast mode
[  929.965496][T16203] bridge_slave_1: entered promiscuous mode
[  930.039641][T16507] hsr_slave_0: hsr_addr_subst_dest: Unknown node
[  930.047280][T16507] hsr_slave_1: hsr_addr_subst_dest: Unknown node
[  930.407353][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[  930.414527][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[  931.165652][T16203] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  931.252701][T16203] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  931.458039][T16203] team0: Port device team_slave_0 added
[  931.490841][T16203] team0: Port device team_slave_1 added
[  932.089882][T16545] block nbd0: server does not support multiple connections per device.
[  932.118932][T16545] block nbd0: shutting down sockets
[  932.921914][T16203] batman_adv: batadv0: Adding interface: batadv_slave_0
[  932.933716][T16203] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  932.959989][T16203] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  933.061509][T16203] batman_adv: batadv0: Adding interface: batadv_slave_1
[  933.083092][T16203] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  933.173754][T16203] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  933.675704][T16203] hsr_slave_0: entered promiscuous mode
[  933.682414][T16203] hsr_slave_1: entered promiscuous mode
[  934.589390][T16605] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2478'.
[  936.129433][T16633] ima: policy update failed
[  936.142517][   T30] audit: type=1802 audit(1785590721.917:29): pid=16633 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.6.2487" res=0 errno=0
[  936.173517][T16627] syzkaller0: entered promiscuous mode
[  936.184588][T16627] syzkaller0: entered allmulticast mode
[  937.025312][T16663] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2496'.
[  937.419805][T16672] loop6: detected capacity change from 0 to 1024
[  937.442540][T16672] EXT4-fs (loop6): stripe (4) is not aligned with cluster size (4096), stripe is disabled
[  937.494897][T16672] EXT4-fs error (device loop6): ext4_map_blocks:791: inode #3: block 2: comm syz.6.2500: lblock 2 mapped to illegal pblock 2 (length 1)
[  937.509813][T16672] loop6: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117
[  937.523714][T16672] Quota error (device loop6): qtree_write_dquot: dquota write failed
[  937.532894][    C1] EXT4-fs (loop6): error count since last fsck: 1
[  937.532929][    C1] EXT4-fs (loop6): initial error at time 1785590723: ext4_map_blocks:791: inode 3: block 2
[  937.532997][    C1] EXT4-fs (loop6): last error at time 1785590723: ext4_map_blocks:791: inode 3: block 2
[  937.573378][T16672] EXT4-fs error (device loop6): ext4_map_blocks:791: inode #3: block 48: comm syz.6.2500: lblock 0 mapped to illegal pblock 48 (length 1)
[  937.588308][T16672] loop6: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117
[  937.588667][T16672] Quota error (device loop6): v2_write_file_info: Can't write info structure
[  937.610577][T16672] EXT4-fs error (device loop6): ext4_acquire_dquot:7039: comm syz.6.2500: Failed to acquire dquot type 0
[  937.622631][T16672] loop6: lost filesystem error report for type 5 error -117
[  937.623366][T16672] EXT4-fs error (device loop6) in ext4_reserve_inode_write:6435: Corrupt filesystem
[  937.641813][T16672] loop6: lost filesystem error report for type 5 error -117
[  937.642621][T16672] EXT4-fs error (device loop6): ext4_evict_inode:267: inode #11: comm syz.6.2500: mark_inode_dirty error
[  937.661867][T16672] loop6: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117
[  937.662337][T16672] EXT4-fs warning (device loop6): ext4_evict_inode:269: couldn't mark inode dirty (err -117)
[  937.682343][T16672] EXT4-fs (loop6): 1 orphan inode deleted
[  937.691537][T16672] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  937.745092][  T454] EXT4-fs error (device loop6): ext4_map_blocks:791: inode #3: block 1: comm kworker/u8:6: lblock 1 mapped to illegal pblock 1 (length 1)
[  937.789725][  T454] Quota error (device loop6): remove_tree: Can't read quota data block 1
[  937.799118][  T454] EXT4-fs error (device loop6): ext4_release_dquot:7075: comm kworker/u8:6: Failed to release dquot type 0
[  937.836071][ T8413] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  937.856807][ T8413] EXT4-fs error (device loop6): __ext4_get_inode_loc:4885: comm syz-executor: Invalid inode table block 1 in block_group 0
[  937.870927][ T8413] loop6: lost filesystem error report for type 5 error -117
[  937.886973][ T8413] EXT4-fs error (device loop6) in ext4_reserve_inode_write:6435: Corrupt filesystem
[  937.911386][ T8413] loop6: lost filesystem error report for type 5 error -117
[  937.912020][ T8413] EXT4-fs error (device loop6): ext4_quota_off:7325: inode #3: comm syz-executor: mark_inode_dirty error
[  937.931047][ T8413] loop6: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117
[  938.228923][T16679] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  939.214314][T16686] bridge1: entered promiscuous mode
[  939.525353][T16703] binder: BINDER_SET_CONTEXT_MGR already set
[  939.542302][T16703] binder: 16702:16703 ioctl 4018620d 200000004a80 returned -16
[  940.553244][T16730] hub 1-0:1.0: USB hub found
[  940.563171][T16730] hub 1-0:1.0: 1 port detected
[  941.143358][T16718] syzkaller0: entered promiscuous mode
[  941.150705][T16726] block nbd1: shutting down sockets
[  941.175861][T16718] syzkaller0: entered allmulticast mode
[  942.211900][T16774] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  944.030536][T16732] syzkaller0: entered promiscuous mode
[  944.037403][T16732] syzkaller0: entered allmulticast mode
[  944.504666][T16203] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  944.545766][T16203] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  944.570221][T16203] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  944.586510][T16203] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  944.612316][T16203] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  944.653059][T16203] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  944.671305][T16203] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  944.699696][T16203] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  944.726074][T16819] binder: BINDER_SET_CONTEXT_MGR already set
[  944.762224][T16819] binder: 16818:16819 ioctl 4018620d 200000004a80 returned -16
[  945.179062][T16203] 8021q: adding VLAN 0 to HW filter on device bond0
[  945.335216][T16203] 8021q: adding VLAN 0 to HW filter on device team0
[  945.355281][ T7965] bridge0: port 1(bridge_slave_0) entered blocking state
[  945.362490][ T7965] bridge0: port 1(bridge_slave_0) entered forwarding state
[  945.420975][ T7939] bridge0: port 2(bridge_slave_1) entered blocking state
[  945.428229][ T7939] bridge0: port 2(bridge_slave_1) entered forwarding state
[  945.724813][T16845] binder: 16843:16845 ioctl c0306201 0 returned -14
[  945.930264][T16832] block nbd2: shutting down sockets
[  946.048995][T16848] syzkaller0: entered promiscuous mode
[  946.074989][T16848] syzkaller0: entered allmulticast mode
[  946.124278][T16855] IPVS: wrr: FWM 3 0x00000003 - no destination available
[  949.307558][T16914] loop6: detected capacity change from 0 to 8
[  949.353214][T16914] squashfs: Bad value for 'errors'
[  950.923281][T16203] 8021q: adding VLAN 0 to HW filter on device batadv0
[  951.861234][T16980] syzkaller0: entered promiscuous mode
[  951.971623][T16980] syzkaller0: entered allmulticast mode
[  952.348513][T16996] loop6: detected capacity change from 0 to 8
[  952.395138][T16996] squashfs: Bad value for 'errors'
[  953.759414][T17034] fuse: Bad value for 'fd'
[  954.702551][T17053] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2573'.
[  955.748897][T17061] syzkaller0: entered promiscuous mode
[  955.864313][T17061] syzkaller0: entered allmulticast mode
[  956.394533][T16203] veth0_vlan: entered promiscuous mode
[  956.479416][T16203] veth1_vlan: entered promiscuous mode
[  956.556680][T17080] syzkaller0: entered promiscuous mode
[  956.579700][T17080] syzkaller0: entered allmulticast mode
[  956.754851][T16203] veth0_macvtap: entered promiscuous mode
[  956.799869][T16203] veth1_macvtap: entered promiscuous mode
[  957.184366][T16203] batman_adv: batadv0: Interface activated: batadv_slave_0
[  957.286711][T17110] fuse: Bad value for 'fd'
[  958.008163][T16203] batman_adv: batadv0: Interface activated: batadv_slave_1
[  958.097063][ T7965] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  958.271823][   T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  958.324810][   T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  958.362835][   T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  958.586368][   T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  958.605382][   T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  959.366983][T17141] netlink: 76 bytes leftover after parsing attributes in process `syz.5.2592'.
[  959.469659][T17133] syzkaller0: entered promiscuous mode
[  959.504402][T17133] syzkaller0: entered allmulticast mode
[  959.706538][ T7965] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  959.746121][ T7965] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  959.782576][T17148] syzkaller0: entered promiscuous mode
[  959.803408][T17148] syzkaller0: entered allmulticast mode
[  959.874914][T17150] loop6: detected capacity change from 0 to 8
[  959.887986][T17150] squashfs: Bad value for 'errors'
[  961.113924][T17164] fuse: Bad value for 'fd'
[  962.438492][T17187] syzkaller0: entered promiscuous mode
[  962.467766][T17187] syzkaller0: entered allmulticast mode
[  962.960556][T17225] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2611'.
[  962.978034][T17225] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2611'.
[  964.467693][ T5285] 8021q: adding VLAN 0 to HW filter on device eth6
[  965.096552][T17250] loop6: detected capacity change from 0 to 4096
[  965.146561][T17250] EXT4-fs (loop6): Test dummy encryption mode enabled
[  965.184762][T17250] EXT4-fs (loop6): DAX unsupported by block device.
[  966.121999][T17267] syzkaller0: entered promiscuous mode
[  966.163024][T17267] syzkaller0: entered allmulticast mode
[  966.923059][T17288] overlayfs: failed to clone upperpath
[  967.034188][T17290] syzkaller0: entered promiscuous mode
[  967.055816][T17290] syzkaller0: entered allmulticast mode
[  967.484655][T17303] fuse: Bad value for 'fd'
[  968.622430][T17321] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2633'.
[  968.686119][ T5285] 8021q: adding VLAN 0 to HW filter on device eth7
[  971.706939][T17353] syzkaller0: entered promiscuous mode
[  971.721769][T17353] syzkaller0: entered allmulticast mode
[  972.409468][T17373] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2648'.
[  972.439587][T17373] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2648'.
[  972.759522][T17372] syzkaller0: entered promiscuous mode
[  972.785788][T17372] syzkaller0: entered allmulticast mode
[  972.861262][T17385] 9p: Bad value for 'rfdno'
[  976.016213][T17433] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2664'.
[  976.039960][T17433] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2664'.
[  977.600515][ T5285] 8021q: adding VLAN 0 to HW filter on device eth5
[  978.868030][T17456] block nbd9: shutting down sockets
[  979.637805][T17477] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2674'.
[  980.519858][T17495] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2677'.
[  980.617491][T17495] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2677'.
[  982.176262][T17515] syzkaller0: entered promiscuous mode
[  982.206328][T17515] syzkaller0: entered allmulticast mode
[  982.566643][   T50] Bluetooth: hci6: command 0x0406 tx timeout
[  983.363222][T17522] syzkaller0: entered promiscuous mode
[  983.382331][T17522] syzkaller0: entered allmulticast mode
[  983.625887][ T5285] 8021q: adding VLAN 0 to HW filter on device eth8
[  985.613148][T17578] fuse: Bad value for 'fd'
[  986.384324][T17559] syzkaller0: entered promiscuous mode
[  986.429394][T17559] syzkaller0: entered allmulticast mode
[  988.187834][T17600] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2700'.
[  990.812565][T17626] syzkaller0: entered promiscuous mode
[  990.846174][T17626] syzkaller0: entered allmulticast mode
[  991.877790][T17662] netlink: 12 bytes leftover after parsing attributes in process `syz.9.2713'.
[  993.261503][T17690] loop9: detected capacity change from 0 to 512
[  993.351916][T17690] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  993.393906][T17690] System zones: 1-12
[  993.426515][T17690] EXT4-fs error (device loop9): ext4_xattr_inode_iget:441: inode #12: comm syz.9.2719: missing EA_INODE flag
[  993.501476][T17690] loop9: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  993.501874][T17690] EXT4-fs error (device loop9): ext4_xattr_inode_iget:444: comm syz.9.2719: error while reading EA inode 12 err=-117
[  993.511576][    C0] EXT4-fs (loop9): error count since last fsck: 1
[  993.511609][    C0] EXT4-fs (loop9): initial error at time 1785590774: ext4_xattr_inode_iget:441: inode 12
[  993.511666][    C0] EXT4-fs (loop9): last error at time 1785590774: ext4_xattr_inode_iget:441: inode 12
[  993.604323][T17690] loop9: lost filesystem error report for type 5 error -117
[  993.618397][T17690] EXT4-fs (loop9): 1 orphan inode deleted
[  993.651812][T17690] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  993.826855][T17697] syzkaller0: entered promiscuous mode
[  993.832774][T17697] syzkaller0: entered allmulticast mode
[  994.248507][ T8637] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  994.702551][T17717] syzkaller0: entered promiscuous mode
[  994.722033][T17717] syzkaller0: entered allmulticast mode
[  995.285125][T17736] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2728'.
[  996.166284][T17743] syzkaller0: entered promiscuous mode
[  996.188128][T17743] syzkaller0: entered allmulticast mode
[  996.253824][T17752] loop4: detected capacity change from 0 to 512
[  996.292415][T17752] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002]
[  996.346531][T17752] System zones: 1-12
[  996.379579][T17752] EXT4-fs error (device loop4): ext4_xattr_inode_iget:441: inode #12: comm syz.4.2736: missing EA_INODE flag
[  996.431817][T17752] loop4: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117
[  996.432309][T17752] EXT4-fs error (device loop4): ext4_xattr_inode_iget:444: comm syz.4.2736: error while reading EA inode 12 err=-117
[  996.441579][    C1] EXT4-fs (loop4): error count since last fsck: 1
[  996.441610][    C1] EXT4-fs (loop4): initial error at time 1785590777: ext4_xattr_inode_iget:441: inode 12
[  996.441663][    C1] EXT4-fs (loop4): last error at time 1785590777: ext4_xattr_inode_iget:441: inode 12
[  996.510394][T17752] loop4: lost filesystem error report for type 5 error -117
[  996.513032][T17752] EXT4-fs (loop4): 1 orphan inode deleted
[  996.550757][T17752] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  996.683722][T16203] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  996.956688][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[  996.963308][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[ 1000.149193][T17821] fuse: Bad value for 'fd'
[ 1002.016906][T17851] syzkaller0: entered promiscuous mode
[ 1002.041127][T17851] syzkaller0: entered allmulticast mode
[ 1003.536402][T17897] syzkaller0: entered promiscuous mode
[ 1003.542182][T17897] syzkaller0: entered allmulticast mode
[ 1005.010843][T17922] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1005.046795][ T5628] IPVS: starting estimator thread 0...
[ 1005.289676][T17927] syzkaller0: entered promiscuous mode
[ 1005.324437][T17927] syzkaller0: entered allmulticast mode
[ 1005.344952][T17925] IPVS: using max 25 ests per chain, 60000 per kthread
[ 1006.144331][T17956] syzkaller0: entered promiscuous mode
[ 1006.167857][T17956] syzkaller0: entered allmulticast mode
[ 1008.280569][T12507] IPVS: starting estimator thread 0...
[ 1008.293181][T18001] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1008.399403][T18003] IPVS: using max 24 ests per chain, 57600 per kthread
[ 1008.688252][T18010] loop4: detected capacity change from 0 to 256
[ 1011.611636][T18047] block nbd1: shutting down sockets
[ 1011.727805][T18053] syzkaller0: entered promiscuous mode
[ 1011.764748][T18053] syzkaller0: entered allmulticast mode
[ 1012.339231][T18070] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1013.505314][T18087] syzkaller0: entered promiscuous mode
[ 1013.518853][T18087] syzkaller0: entered allmulticast mode
[ 1014.380421][T18116] binder: 18115:18116 ioctl 4018620d 0 returned -22
[ 1015.169788][T18118] block nbd6: shutting down sockets
[ 1016.758300][T18129] syzkaller0: entered promiscuous mode
[ 1016.773270][T18129] syzkaller0: entered allmulticast mode
[ 1016.825431][T18143] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1017.030576][T18153] overlayfs: failed to clone upperpath
[ 1018.947616][T18181] block nbd1: shutting down sockets
[ 1019.090864][T18191] binder: 18187:18191 ioctl 4018620d 0 returned -22
[ 1019.692128][T18199] fuse: Bad value for 'fd'
[ 1020.748503][T18212] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1020.768891][T18209] syzkaller0: entered promiscuous mode
[ 1020.814698][T18209] syzkaller0: entered allmulticast mode
[ 1022.574026][T18249] binder: 18248:18249 ioctl c0306201 0 returned -14
[ 1025.079391][T18279] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1025.130888][T18280] loop9: detected capacity change from 0 to 256
[ 1025.583223][T18282] syzkaller0: entered promiscuous mode
[ 1025.720699][T18282] syzkaller0: entered allmulticast mode
[ 1026.001828][T18301] overlayfs: failed to resolve './bus': -2
[ 1027.314727][T18321] binder: 18320:18321 ioctl c0306201 0 returned -14
[ 1028.201486][T18324] block nbd9: shutting down sockets
[ 1028.907100][T18333] fuse: Bad value for 'fd'
[ 1029.766021][T18341] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1031.456316][T18359] loop4: detected capacity change from 0 to 256
[ 1031.763211][T18366] overlayfs: failed to resolve './bus': -2
[ 1033.463844][T18369] block nbd2: shutting down sockets
[ 1034.016478][T18390] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1035.123143][T18402] syzkaller0: entered promiscuous mode
[ 1035.420369][T18402] syzkaller0: entered allmulticast mode
[ 1036.091978][T18428] overlayfs: failed to resolve './bus': -2
[ 1036.626938][T18427] binder: 18426:18427 ioctl 4018620d 0 returned -22
[ 1038.365936][T18449] loop4: detected capacity change from 0 to 256
[ 1040.414587][T18475] fuse: Bad value for 'fd'
[ 1043.851620][T18507] binder: 18506:18507 ioctl 4018620d 0 returned -22
[ 1045.179819][T18530] loop6: detected capacity change from 0 to 256
[ 1047.561247][T18556] binder: 18555:18556 ioctl c0306201 0 returned -14
[ 1051.373143][T18599] syzkaller0: entered promiscuous mode
[ 1051.400416][T18599] syzkaller0: entered allmulticast mode
[ 1056.271726][T18653] binder: 18650:18653 ioctl c0306201 0 returned -14
[ 1056.291146][T18652] netlink: 76 bytes leftover after parsing attributes in process `syz.5.2957'.
[ 1059.369320][T18690] loop6: detected capacity change from 0 to 256
[ 1059.381680][T18684] loop4: detected capacity change from 0 to 8
[ 1059.453353][T18684] squashfs: Bad value for 'errors'
[ 1062.992628][T18747] netlink: 76 bytes leftover after parsing attributes in process `syz.9.2980'.
[ 1063.534783][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[ 1063.541234][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[ 1063.576705][T18760] loop4: detected capacity change from 0 to 4096
[ 1063.632165][T18760] EXT4-fs (loop4): Test dummy encryption mode enabled
[ 1063.692846][T18760] EXT4-fs (loop4): DAX unsupported by block device.
[ 1065.363819][T18775] overlayfs: failed to clone upperpath
[ 1067.807105][T18803] fuse: Bad value for 'fd'
[ 1069.609385][T18818] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3001'.
[ 1070.461806][T18831] overlayfs: failed to clone upperpath
[ 1073.403794][T18881] fuse: Bad value for 'fd'
[ 1075.231141][T18894] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3022'.
[ 1077.881440][T18922] dvmrp0: entered allmulticast mode
[ 1079.097980][T18939] loop4: detected capacity change from 0 to 8
[ 1079.133029][T18939] squashfs: Bad value for 'errors'
[ 1079.410342][T18946] loop9: detected capacity change from 0 to 256
[ 1081.002768][T18961] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3040'.
[ 1084.856052][T18996] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1086.911237][T19028] netlink: 76 bytes leftover after parsing attributes in process `syz.9.3060'.
[ 1087.839595][T19040] fuse: Bad value for 'fd'
[ 1090.614672][T19074] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1093.205305][T19095] fuse: Bad value for 'fd'
[ 1094.306888][T19107] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3078'.
[ 1097.115187][T19141] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[ 1098.522833][T19180] fuse: Bad value for 'fd'
[ 1101.994190][T19210] syzkaller0: entered promiscuous mode
[ 1102.075861][T19210] syzkaller0: entered allmulticast mode
[ 1102.204154][T19219] loop9: detected capacity change from 0 to 256
[ 1103.621221][T19231] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1105.552101][T19245] nbd: socks must be embedded in a SOCK_ITEM attr
[ 1105.565123][T19245] block nbd0: shutting down sockets
[ 1109.602039][T19298] binder: BINDER_SET_CONTEXT_MGR already set
[ 1109.731914][T19298] binder: 19296:19298 ioctl 4018620d 200000004a80 returned -16
[ 1111.718463][T19321] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1112.228961][T19323] syzkaller0: entered promiscuous mode
[ 1112.263812][T19323] syzkaller0: entered allmulticast mode
[ 1112.421337][T19328] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3125'.
[ 1112.465959][T19328] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3125'.
[ 1114.132254][T19349] fuse: Bad value for 'fd'
[ 1118.276069][T19379] tipc: Enabling of bearer <eth:syzk> rejected, failed to enable media
[ 1119.998998][T19405] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3141'.
[ 1120.208808][T19406] syzkaller0: entered promiscuous mode
[ 1120.258740][T19406] syzkaller0: entered allmulticast mode
[ 1120.682515][T19409] fuse: Bad value for 'fd'
[ 1122.825642][T19440] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1123.343509][T19454] tipc: Enabling of bearer <eth:syzk> rejected, failed to enable media
[ 1123.764542][T19457] fuse: Bad value for 'fd'
[ 1124.648277][T19477] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3161'.
[ 1125.701990][T19495] loop9: detected capacity change from 0 to 512
[ 1125.793578][T19495] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 1125.839046][T19495] ext4 filesystem being mounted at /436/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[ 1125.946101][T19503] IPVS: wrr: FWM 3 0x00000003 - no destination available
[ 1125.954783][T19495] vhci_hcd vhci_hcd.0: remove, state 4
[ 1125.963587][T19495] usb usb34: USB disconnect, device number 1
[ 1125.980542][T19501] nbd: socks must be embedded in a SOCK_ITEM attr
[ 1125.991701][T19501] block nbd0: shutting down sockets
[ 1126.602381][   T12] vhci_hcd vhci_hcd.0: stop threads
[ 1126.610312][T19509] fuse: Bad value for 'fd'
[ 1126.624423][T19495] vhci_hcd vhci_hcd.0: USB bus 34 deregistered
[ 1126.645522][   T12] vhci_hcd vhci_hcd.0: release socket
[ 1127.440918][   T12] vhci_hcd vhci_hcd.0: disconnect device
[ 1127.447712][   T12] vhci_hcd vhci_hcd.0: stop threads
[ 1127.453210][   T12] vhci_hcd vhci_hcd.0: release socket
[ 1127.458619][   T12] vhci_hcd vhci_hcd.0: disconnect device
[ 1127.464686][   T12] vhci_hcd vhci_hcd.0: stop threads
[ 1127.469916][   T12] vhci_hcd vhci_hcd.0: release socket
[ 1127.489431][   T12] vhci_hcd vhci_hcd.0: disconnect device
[ 1127.520933][   T12] vhci_hcd vhci_hcd.0: stop threads
[ 1127.558509][T19495] vhci_hcd vhci_hcd.0: remove, state 4
[ 1127.576799][   T12] ==================================================================
[ 1127.584869][   T12] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection.cold+0x2f1/0x37c
[ 1127.590589][T19495] usb usb33: USB disconnect, device number 1
[ 1127.593843][   T12] Read of size 8 at addr ffff88802a3f4c20 by task kworker/u8:0/12
[ 1127.593875][   T12] 
[ 1127.593896][   T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1127.593950][   T12] Tainted: [L]=SOFTLOCKUP
[ 1127.593962][   T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 1127.593988][   T12] Workqueue: usbip_event event_handler
[ 1127.594037][   T12] Call Trace:
[ 1127.594049][   T12]  <TASK>
[ 1127.594062][   T12]  dump_stack_lvl+0x100/0x190
[ 1127.594105][   T12]  print_report+0x13d/0x4b0
[ 1127.594160][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1127.594206][   T12]  ? __virt_addr_valid+0x239/0x430
[ 1127.594252][   T12]  ? vhci_shutdown_connection.cold+0x2f1/0x37c
[ 1127.594308][   T12]  kasan_report+0xdf/0x1c0
[ 1127.594349][   T12]  ? vhci_shutdown_connection.cold+0x2f1/0x37c
[ 1127.594412][   T12]  vhci_shutdown_connection.cold+0x2f1/0x37c
[ 1127.594472][   T12]  event_handler+0x216/0x570
[ 1127.594515][   T12]  process_one_work+0xa23/0x1940
[ 1127.594562][   T12]  ? __pfx_process_one_work+0x10/0x10
[ 1127.594598][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1127.594651][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1127.594701][   T12]  worker_thread+0x5ef/0xe50
[ 1127.594745][   T12]  ? kthread+0x13a/0x450
[ 1127.594801][   T12]  ? __pfx_worker_thread+0x10/0x10
[ 1127.594836][   T12]  kthread+0x370/0x450
[ 1127.594892][   T12]  ? __pfx_kthread+0x10/0x10
[ 1127.594951][   T12]  ret_from_fork+0x72b/0xd50
[ 1127.595006][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[ 1127.595055][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1127.595100][   T12]  ? __switch_to+0x800/0x10f0
[ 1127.595159][   T12]  ? __switch_to_asm+0x39/0x70
[ 1127.595209][   T12]  ? __pfx_kthread+0x10/0x10
[ 1127.595287][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1127.595352][   T12]  </TASK>
[ 1127.595364][   T12] 
[ 1127.645317][T19495] vhci_hcd vhci_hcd.0: USB bus 33 deregistered
[ 1127.646712][   T12] Allocated by task 1:
[ 1127.646732][   T12]  kasan_save_stack+0x30/0x50
[ 1127.791480][   T12]  kasan_save_track+0x14/0x30
[ 1127.796188][   T12]  __kasan_kmalloc+0xaa/0xb0
[ 1127.800801][   T12]  __kmalloc_noprof+0x322/0x820
[ 1127.805674][   T12]  __usb_create_hcd+0x5e/0xac0
[ 1127.810460][   T12]  vhci_hcd_probe+0x1a5/0x4e0
[ 1127.815147][   T12]  platform_probe+0x106/0x1d0
[ 1127.819829][   T12]  really_probe+0x241/0xa60
[ 1127.824344][   T12]  __driver_probe_device+0x20e/0x450
[ 1127.829658][   T12]  driver_probe_device+0x4a/0x140
[ 1127.834698][   T12]  __device_attach_driver+0x1df/0x320
[ 1127.840089][   T12]  bus_for_each_drv+0x159/0x1e0
[ 1127.844944][   T12]  __device_attach+0x1e4/0x4d0
[ 1127.849730][   T12]  device_initial_probe+0xaf/0xd0
[ 1127.854770][   T12]  bus_probe_device+0x64/0x160
[ 1127.859548][   T12]  device_add+0x121d/0x1970
[ 1127.864077][   T12]  platform_device_add+0x35a/0x800
[ 1127.869200][   T12]  platform_device_register_full+0x5cf/0x830
[ 1127.875194][   T12]  vhci_hcd_init+0x1a1/0x2f0
[ 1127.879809][   T12]  do_one_initcall+0x11d/0x700
[ 1127.884588][   T12]  kernel_init_freeable+0x6ea/0x7b0
[ 1127.889808][   T12]  kernel_init+0x1f/0x1e0
[ 1127.894160][   T12]  ret_from_fork+0x72b/0xd50
[ 1127.898764][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1127.903544][   T12] 
[ 1127.905853][   T12] Freed by task 19495:
[ 1127.909906][   T12]  kasan_save_stack+0x30/0x50
[ 1127.914608][   T12]  kasan_save_track+0x14/0x30
[ 1127.919308][   T12]  kasan_save_free_info+0x3b/0x70
[ 1127.924344][   T12]  __kasan_slab_free+0x5f/0x80
[ 1127.929107][   T12]  kfree+0x22b/0x6c0
[ 1127.933011][   T12]  usb_put_hcd+0x149/0x1f0
[ 1127.937447][   T12]  vhci_hcd_remove+0xb5/0x1b0
[ 1127.942131][   T12]  platform_remove+0x5f/0x80
[ 1127.946721][   T12]  device_remove+0xcb/0x180
[ 1127.951235][   T12]  device_release_driver_internal+0x44e/0x620
[ 1127.957321][   T12]  unbind_store+0xf8/0x110
[ 1127.961745][   T12]  drv_attr_store+0x74/0xb0
[ 1127.966279][   T12]  sysfs_kf_write+0xf2/0x150
[ 1127.970880][   T12]  kernfs_fop_write_iter+0x3e0/0x5f0
[ 1127.976169][   T12]  vfs_write+0x6ac/0x1050
[ 1127.980510][   T12]  ksys_write+0x12a/0x250
[ 1127.984848][   T12]  do_syscall_64+0x115/0x870
[ 1127.989450][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1127.995347][   T12] 
[ 1127.997659][   T12] Last potentially related work creation:
[ 1128.003358][   T12]  kasan_save_stack+0x30/0x50
[ 1128.008056][   T12]  kasan_record_aux_stack+0xa7/0xc0
[ 1128.013266][   T12]  insert_work+0x36/0x230
[ 1128.017618][   T12]  __queue_work+0x9bc/0x12b0
[ 1128.022208][   T12]  queue_work_on+0x1a9/0x1e0
[ 1128.026797][   T12]  usb_hcd_giveback_urb+0x330/0x4a0
[ 1128.032020][   T12]  unlink1+0x418/0x510
[ 1128.036111][   T12]  usb_hcd_unlink_urb+0x131/0x210
[ 1128.041132][   T12]  usb_kill_urb+0x121/0x320
[ 1128.045635][   T12]  hub_quiesce+0x1e9/0x320
[ 1128.050062][   T12]  hub_suspend+0x4ab/0x9e0
[ 1128.054489][   T12]  usb_suspend_both+0x288/0x950
[ 1128.059363][   T12]  usb_runtime_suspend+0x49/0x120
[ 1128.064411][   T12]  __rpm_callback+0xc8/0x620
[ 1128.069015][   T12]  rpm_callback+0x16a/0x1b0
[ 1128.073532][   T12]  rpm_suspend+0x2f4/0x11a0
[ 1128.078051][   T12]  __pm_runtime_suspend+0xba/0x1a0
[ 1128.083183][   T12]  usb_new_device.cold+0xd61/0x115c
[ 1128.088393][   T12]  register_root_hub+0x4e6/0x639
[ 1128.093340][   T12]  usb_add_hcd.cold+0xccd/0x1158
[ 1128.098285][   T12]  vhci_hcd_probe+0x1c2/0x4e0
[ 1128.102971][   T12]  platform_probe+0x106/0x1d0
[ 1128.107657][   T12]  really_probe+0x241/0xa60
[ 1128.112173][   T12]  __driver_probe_device+0x20e/0x450
[ 1128.117473][   T12]  driver_probe_device+0x4a/0x140
[ 1128.122534][   T12]  __device_attach_driver+0x1df/0x320
[ 1128.127921][   T12]  bus_for_each_drv+0x159/0x1e0
[ 1128.132775][   T12]  __device_attach+0x1e4/0x4d0
[ 1128.137552][   T12]  device_initial_probe+0xaf/0xd0
[ 1128.142595][   T12]  bus_probe_device+0x64/0x160
[ 1128.147367][   T12]  device_add+0x121d/0x1970
[ 1128.151894][   T12]  platform_device_add+0x35a/0x800
[ 1128.157012][   T12]  platform_device_register_full+0x5cf/0x830
[ 1128.163011][   T12]  vhci_hcd_init+0x1a1/0x2f0
[ 1128.167609][   T12]  do_one_initcall+0x11d/0x700
[ 1128.172387][   T12]  kernel_init_freeable+0x6ea/0x7b0
[ 1128.177603][   T12]  kernel_init+0x1f/0x1e0
[ 1128.181956][   T12]  ret_from_fork+0x72b/0xd50
[ 1128.186564][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1128.191347][   T12] 
[ 1128.193659][   T12] Second to last potentially related work creation:
[ 1128.200229][   T12]  kasan_save_stack+0x30/0x50
[ 1128.204931][   T12]  kasan_record_aux_stack+0xa7/0xc0
[ 1128.210144][   T12]  insert_work+0x36/0x230
[ 1128.214496][   T12]  __queue_work+0x9bc/0x12b0
[ 1128.219088][   T12]  queue_work_on+0x1a9/0x1e0
[ 1128.223676][   T12]  usb_hcd_giveback_urb+0x3b8/0x4a0
[ 1128.228899][   T12]  usb_hcd_submit_urb+0xab7/0x2150
[ 1128.234012][   T12]  usb_submit_urb+0x827/0x19b0
[ 1128.238780][   T12]  usb_start_wait_urb+0x10e/0x580
[ 1128.243811][   T12]  usb_control_msg+0x328/0x4b0
[ 1128.248581][   T12]  hub_suspend+0x826/0x9e0
[ 1128.253011][   T12]  usb_suspend_both+0x288/0x950
[ 1128.257877][   T12]  usb_runtime_suspend+0x49/0x120
[ 1128.262925][   T12]  __rpm_callback+0xc8/0x620
[ 1128.267533][   T12]  rpm_callback+0x16a/0x1b0
[ 1128.272051][   T12]  rpm_suspend+0x2f4/0x11a0
[ 1128.276568][   T12]  __pm_runtime_suspend+0xba/0x1a0
[ 1128.281695][   T12]  usb_new_device.cold+0xd61/0x115c
[ 1128.286902][   T12]  register_root_hub+0x4e6/0x639
[ 1128.291849][   T12]  usb_add_hcd.cold+0xccd/0x1158
[ 1128.296795][   T12]  vhci_hcd_probe+0x1c2/0x4e0
[ 1128.301483][   T12]  platform_probe+0x106/0x1d0
[ 1128.306166][   T12]  really_probe+0x241/0xa60
[ 1128.310683][   T12]  __driver_probe_device+0x20e/0x450
[ 1128.315989][   T12]  driver_probe_device+0x4a/0x140
[ 1128.321030][   T12]  __device_attach_driver+0x1df/0x320
[ 1128.326415][   T12]  bus_for_each_drv+0x159/0x1e0
[ 1128.331270][   T12]  __device_attach+0x1e4/0x4d0
[ 1128.336050][   T12]  device_initial_probe+0xaf/0xd0
[ 1128.341090][   T12]  bus_probe_device+0x64/0x160
[ 1128.345863][   T12]  device_add+0x121d/0x1970
[ 1128.350385][   T12]  platform_device_add+0x35a/0x800
[ 1128.355502][   T12]  platform_device_register_full+0x5cf/0x830
[ 1128.361498][   T12]  vhci_hcd_init+0x1a1/0x2f0
[ 1128.366097][   T12]  do_one_initcall+0x11d/0x700
[ 1128.370875][   T12]  kernel_init_freeable+0x6ea/0x7b0
[ 1128.376091][   T12]  kernel_init+0x1f/0x1e0
[ 1128.380443][   T12]  ret_from_fork+0x72b/0xd50
[ 1128.385043][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1128.389821][   T12] 
[ 1128.392132][   T12] The buggy address belongs to the object at ffff88802a3f4000
[ 1128.392132][   T12]  which belongs to the cache kmalloc-8k of size 8192
[ 1128.406182][   T12] The buggy address is located 3104 bytes inside of
[ 1128.406182][   T12]  freed 8192-byte region [ffff88802a3f4000, ffff88802a3f6000)
[ 1128.420155][   T12] 
[ 1128.422466][   T12] The buggy address belongs to the physical page:
[ 1128.428862][   T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a3f0
[ 1128.437617][   T12] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 1128.446109][   T12] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 1128.453652][   T12] page_type: f5(slab)
[ 1128.457633][   T12] raw: 00fff00000000040 ffff88813fe22280 dead000000000122 0000000000000000
[ 1128.466218][   T12] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 1128.474802][   T12] head: 00fff00000000040 ffff88813fe22280 dead000000000122 0000000000000000
[ 1128.483472][   T12] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 1128.492144][   T12] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 1128.500814][   T12] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 1128.509474][   T12] page dumped because: kasan: bad access detected
[ 1128.515877][   T12] page_owner tracks the page as allocated
[ 1128.521577][   T12] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8693436832, free_ts 8379496279
[ 1128.542001][   T12]  post_alloc_hook+0xfd/0x120
[ 1128.546698][   T12]  get_page_from_freelist+0xf48/0x3530
[ 1128.552173][   T12]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 1128.558083][   T12]  new_slab+0xa2/0x640
[ 1128.562165][   T12]  refill_objects+0xe3/0x410
[ 1128.566766][   T12]  __pcs_replace_empty_main+0x376/0x680
[ 1128.572323][   T12]  __kmalloc_cache_noprof+0x479/0x6c0
[ 1128.577708][   T12]  dummy_hcd_init+0x3ce/0xc00
[ 1128.582387][   T12]  do_one_initcall+0x11d/0x700
[ 1128.587165][   T12]  kernel_init_freeable+0x6ea/0x7b0
[ 1128.592383][   T12]  kernel_init+0x1f/0x1e0
[ 1128.596734][   T12]  ret_from_fork+0x72b/0xd50
[ 1128.601338][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1128.606119][   T12] page last free pid 989 tgid 989 stack trace:
[ 1128.612264][   T12]  free_pages_prepare+0x586/0xd80
[ 1128.617300][   T12]  __free_contig_range_common+0x14f/0x250
[ 1128.623031][   T12]  free_pages_bulk+0x12a/0x200
[ 1128.627810][   T12]  vm_area_free_pages+0xad/0x2b0
[ 1128.632765][   T12]  vfree+0x107/0x750
[ 1128.636668][   T12]  delayed_vfree_work+0x56/0x80
[ 1128.641530][   T12]  process_one_work+0xa23/0x1940
[ 1128.646469][   T12]  worker_thread+0x5ef/0xe50
[ 1128.651062][   T12]  kthread+0x370/0x450
[ 1128.655150][   T12]  ret_from_fork+0x72b/0xd50
[ 1128.659753][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1128.664534][   T12] 
[ 1128.666844][   T12] Memory state around the buggy address:
[ 1128.672461][   T12]  ffff88802a3f4b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1128.680520][   T12]  ffff88802a3f4b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1128.688575][   T12] >ffff88802a3f4c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1128.696626][   T12]                                ^
[ 1128.701722][   T12]  ffff88802a3f4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1128.709778][   T12]  ffff88802a3f4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1128.717830][   T12] ==================================================================
[ 1128.783031][   T12] Disabling lock debugging due to kernel taint
[ 1128.793545][   T12] ==================================================================
[ 1128.801613][   T12] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection.cold+0x143/0x37c
[ 1128.810587][   T12] Read of size 8 at addr ffff88802a3f4000 by task kworker/u8:0/12
[ 1128.818397][   T12] 
[ 1128.820729][   T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G    B        L      syzkaller #0 PREEMPT(full) 
[ 1128.820789][   T12] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
[ 1128.820805][   T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 1128.820831][   T12] Workqueue: usbip_event event_handler
[ 1128.820876][   T12] Call Trace:
[ 1128.820888][   T12]  <TASK>
[ 1128.820902][   T12]  dump_stack_lvl+0x100/0x190
[ 1128.820945][   T12]  print_report+0x13d/0x4b0
[ 1128.821002][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1128.821050][   T12]  ? __virt_addr_valid+0x239/0x430
[ 1128.821098][   T12]  ? vhci_shutdown_connection.cold+0x143/0x37c
[ 1128.821157][   T12]  kasan_report+0xdf/0x1c0
[ 1128.821198][   T12]  ? vhci_shutdown_connection.cold+0x143/0x37c
[ 1128.821264][   T12]  vhci_shutdown_connection.cold+0x143/0x37c
[ 1128.821327][   T12]  event_handler+0x216/0x570
[ 1128.821371][   T12]  process_one_work+0xa23/0x1940
[ 1128.821419][   T12]  ? __pfx_process_one_work+0x10/0x10
[ 1128.821454][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1128.821513][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1128.821562][   T12]  worker_thread+0x5ef/0xe50
[ 1128.821606][   T12]  ? kthread+0x13a/0x450
[ 1128.821665][   T12]  ? __pfx_worker_thread+0x10/0x10
[ 1128.821700][   T12]  kthread+0x370/0x450
[ 1128.821759][   T12]  ? __pfx_kthread+0x10/0x10
[ 1128.821821][   T12]  ret_from_fork+0x72b/0xd50
[ 1128.821873][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[ 1128.821924][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1128.821972][   T12]  ? __switch_to+0x800/0x10f0
[ 1128.822032][   T12]  ? __switch_to_asm+0x39/0x70
[ 1128.822086][   T12]  ? __pfx_kthread+0x10/0x10
[ 1128.822147][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1128.822213][   T12]  </TASK>
[ 1128.822225][   T12] 
[ 1128.990154][   T12] Allocated by task 1:
[ 1128.994211][   T12]  kasan_save_stack+0x30/0x50
[ 1128.998919][   T12]  kasan_save_track+0x14/0x30
[ 1129.003620][   T12]  __kasan_kmalloc+0xaa/0xb0
[ 1129.008234][   T12]  __kmalloc_noprof+0x322/0x820
[ 1129.013106][   T12]  __usb_create_hcd+0x5e/0xac0
[ 1129.017893][   T12]  vhci_hcd_probe+0x1a5/0x4e0
[ 1129.022578][   T12]  platform_probe+0x106/0x1d0
[ 1129.027260][   T12]  really_probe+0x241/0xa60
[ 1129.031778][   T12]  __driver_probe_device+0x20e/0x450
[ 1129.037079][   T12]  driver_probe_device+0x4a/0x140
[ 1129.042120][   T12]  __device_attach_driver+0x1df/0x320
[ 1129.047512][   T12]  bus_for_each_drv+0x159/0x1e0
[ 1129.052370][   T12]  __device_attach+0x1e4/0x4d0
[ 1129.057159][   T12]  device_initial_probe+0xaf/0xd0
[ 1129.062199][   T12]  bus_probe_device+0x64/0x160
[ 1129.066967][   T12]  device_add+0x121d/0x1970
[ 1129.071490][   T12]  platform_device_add+0x35a/0x800
[ 1129.076609][   T12]  platform_device_register_full+0x5cf/0x830
[ 1129.082611][   T12]  vhci_hcd_init+0x1a1/0x2f0
[ 1129.087209][   T12]  do_one_initcall+0x11d/0x700
[ 1129.091988][   T12]  kernel_init_freeable+0x6ea/0x7b0
[ 1129.097207][   T12]  kernel_init+0x1f/0x1e0
[ 1129.101561][   T12]  ret_from_fork+0x72b/0xd50
[ 1129.106164][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1129.110941][   T12] 
[ 1129.113250][   T12] Freed by task 19495:
[ 1129.117301][   T12]  kasan_save_stack+0x30/0x50
[ 1129.122000][   T12]  kasan_save_track+0x14/0x30
[ 1129.126700][   T12]  kasan_save_free_info+0x3b/0x70
[ 1129.131736][   T12]  __kasan_slab_free+0x5f/0x80
[ 1129.136501][   T12]  kfree+0x22b/0x6c0
[ 1129.140432][   T12]  usb_put_hcd+0x149/0x1f0
[ 1129.144877][   T12]  vhci_hcd_remove+0xb5/0x1b0
[ 1129.149563][   T12]  platform_remove+0x5f/0x80
[ 1129.154154][   T12]  device_remove+0xcb/0x180
[ 1129.158667][   T12]  device_release_driver_internal+0x44e/0x620
[ 1129.164753][   T12]  unbind_store+0xf8/0x110
[ 1129.169174][   T12]  drv_attr_store+0x74/0xb0
[ 1129.173673][   T12]  sysfs_kf_write+0xf2/0x150
[ 1129.178273][   T12]  kernfs_fop_write_iter+0x3e0/0x5f0
[ 1129.183560][   T12]  vfs_write+0x6ac/0x1050
[ 1129.187899][   T12]  ksys_write+0x12a/0x250
[ 1129.192245][   T12]  do_syscall_64+0x115/0x870
[ 1129.196850][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1129.202748][   T12] 
[ 1129.205058][   T12] Last potentially related work creation:
[ 1129.210758][   T12]  kasan_save_stack+0x30/0x50
[ 1129.215458][   T12]  kasan_record_aux_stack+0xa7/0xc0
[ 1129.220670][   T12]  insert_work+0x36/0x230
[ 1129.225021][   T12]  __queue_work+0x9bc/0x12b0
[ 1129.229611][   T12]  queue_work_on+0x1a9/0x1e0
[ 1129.234200][   T12]  usb_hcd_giveback_urb+0x330/0x4a0
[ 1129.239422][   T12]  unlink1+0x418/0x510
[ 1129.243516][   T12]  usb_hcd_unlink_urb+0x131/0x210
[ 1129.248542][   T12]  usb_kill_urb+0x121/0x320
[ 1129.253045][   T12]  hub_quiesce+0x1e9/0x320
[ 1129.257476][   T12]  hub_suspend+0x4ab/0x9e0
[ 1129.261907][   T12]  usb_suspend_both+0x288/0x950
[ 1129.266773][   T12]  usb_runtime_suspend+0x49/0x120
[ 1129.271819][   T12]  __rpm_callback+0xc8/0x620
[ 1129.276422][   T12]  rpm_callback+0x16a/0x1b0
[ 1129.280938][   T12]  rpm_suspend+0x2f4/0x11a0
[ 1129.285454][   T12]  __pm_runtime_suspend+0xba/0x1a0
[ 1129.290586][   T12]  usb_new_device.cold+0xd61/0x115c
[ 1129.295792][   T12]  register_root_hub+0x4e6/0x639
[ 1129.300740][   T12]  usb_add_hcd.cold+0xccd/0x1158
[ 1129.305688][   T12]  vhci_hcd_probe+0x1c2/0x4e0
[ 1129.310374][   T12]  platform_probe+0x106/0x1d0
[ 1129.315053][   T12]  really_probe+0x241/0xa60
[ 1129.319570][   T12]  __driver_probe_device+0x20e/0x450
[ 1129.324869][   T12]  driver_probe_device+0x4a/0x140
[ 1129.329907][   T12]  __device_attach_driver+0x1df/0x320
[ 1129.335293][   T12]  bus_for_each_drv+0x159/0x1e0
[ 1129.340147][   T12]  __device_attach+0x1e4/0x4d0
[ 1129.344923][   T12]  device_initial_probe+0xaf/0xd0
[ 1129.349962][   T12]  bus_probe_device+0x64/0x160
[ 1129.354736][   T12]  device_add+0x121d/0x1970
[ 1129.359263][   T12]  platform_device_add+0x35a/0x800
[ 1129.364380][   T12]  platform_device_register_full+0x5cf/0x830
[ 1129.370375][   T12]  vhci_hcd_init+0x1a1/0x2f0
[ 1129.374973][   T12]  do_one_initcall+0x11d/0x700
[ 1129.379749][   T12]  kernel_init_freeable+0x6ea/0x7b0
[ 1129.384966][   T12]  kernel_init+0x1f/0x1e0
[ 1129.389317][   T12]  ret_from_fork+0x72b/0xd50
[ 1129.393921][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1129.398702][   T12] 
[ 1129.401011][   T12] Second to last potentially related work creation:
[ 1129.407580][   T12]  kasan_save_stack+0x30/0x50
[ 1129.412280][   T12]  kasan_record_aux_stack+0xa7/0xc0
[ 1129.417492][   T12]  insert_work+0x36/0x230
[ 1129.421850][   T12]  __queue_work+0x9bc/0x12b0
[ 1129.426438][   T12]  queue_work_on+0x1a9/0x1e0
[ 1129.431029][   T12]  usb_hcd_giveback_urb+0x3b8/0x4a0
[ 1129.436250][   T12]  usb_hcd_submit_urb+0xab7/0x2150
[ 1129.441361][   T12]  usb_submit_urb+0x827/0x19b0
[ 1129.446130][   T12]  usb_start_wait_urb+0x10e/0x580
[ 1129.451159][   T12]  usb_control_msg+0x328/0x4b0
[ 1129.455925][   T12]  hub_suspend+0x826/0x9e0
[ 1129.460352][   T12]  usb_suspend_both+0x288/0x950
[ 1129.465221][   T12]  usb_runtime_suspend+0x49/0x120
[ 1129.470269][   T12]  __rpm_callback+0xc8/0x620
[ 1129.474876][   T12]  rpm_callback+0x16a/0x1b0
[ 1129.479393][   T12]  rpm_suspend+0x2f4/0x11a0
[ 1129.483909][   T12]  __pm_runtime_suspend+0xba/0x1a0
[ 1129.489035][   T12]  usb_new_device.cold+0xd61/0x115c
[ 1129.494241][   T12]  register_root_hub+0x4e6/0x639
[ 1129.499186][   T12]  usb_add_hcd.cold+0xccd/0x1158
[ 1129.504132][   T12]  vhci_hcd_probe+0x1c2/0x4e0
[ 1129.508819][   T12]  platform_probe+0x106/0x1d0
[ 1129.513511][   T12]  really_probe+0x241/0xa60
[ 1129.518029][   T12]  __driver_probe_device+0x20e/0x450
[ 1129.523334][   T12]  driver_probe_device+0x4a/0x140
[ 1129.528376][   T12]  __device_attach_driver+0x1df/0x320
[ 1129.533765][   T12]  bus_for_each_drv+0x159/0x1e0
[ 1129.538617][   T12]  __device_attach+0x1e4/0x4d0
[ 1129.543394][   T12]  device_initial_probe+0xaf/0xd0
[ 1129.548437][   T12]  bus_probe_device+0x64/0x160
[ 1129.553208][   T12]  device_add+0x121d/0x1970
[ 1129.557738][   T12]  platform_device_add+0x35a/0x800
[ 1129.562851][   T12]  platform_device_register_full+0x5cf/0x830
[ 1129.568843][   T12]  vhci_hcd_init+0x1a1/0x2f0
[ 1129.573444][   T12]  do_one_initcall+0x11d/0x700
[ 1129.578231][   T12]  kernel_init_freeable+0x6ea/0x7b0
[ 1129.583451][   T12]  kernel_init+0x1f/0x1e0
[ 1129.587809][   T12]  ret_from_fork+0x72b/0xd50
[ 1129.592417][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1129.597198][   T12] 
[ 1129.599513][   T12] The buggy address belongs to the object at ffff88802a3f4000
[ 1129.599513][   T12]  which belongs to the cache kmalloc-8k of size 8192
[ 1129.613562][   T12] The buggy address is located 0 bytes inside of
[ 1129.613562][   T12]  freed 8192-byte region [ffff88802a3f4000, ffff88802a3f6000)
[ 1129.627270][   T12] 
[ 1129.629582][   T12] The buggy address belongs to the physical page:
[ 1129.635981][   T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a3f0
[ 1129.644740][   T12] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 1129.653235][   T12] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 1129.660778][   T12] page_type: f5(slab)
[ 1129.664756][   T12] raw: 00fff00000000040 ffff88813fe22280 dead000000000122 0000000000000000
[ 1129.673341][   T12] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 1129.681924][   T12] head: 00fff00000000040 ffff88813fe22280 dead000000000122 0000000000000000
[ 1129.690593][   T12] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 1129.699265][   T12] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 1129.707938][   T12] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 1129.716595][   T12] page dumped because: kasan: bad access detected
[ 1129.722993][   T12] page_owner tracks the page as allocated
[ 1129.728689][   T12] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8693436832, free_ts 8379496279
[ 1129.749115][   T12]  post_alloc_hook+0xfd/0x120
[ 1129.753817][   T12]  get_page_from_freelist+0xf48/0x3530
[ 1129.759299][   T12]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 1129.765214][   T12]  new_slab+0xa2/0x640
[ 1129.769298][   T12]  refill_objects+0xe3/0x410
[ 1129.773903][   T12]  __pcs_replace_empty_main+0x376/0x680
[ 1129.779461][   T12]  __kmalloc_cache_noprof+0x479/0x6c0
[ 1129.784852][   T12]  dummy_hcd_init+0x3ce/0xc00
[ 1129.789537][   T12]  do_one_initcall+0x11d/0x700
[ 1129.794332][   T12]  kernel_init_freeable+0x6ea/0x7b0
[ 1129.799560][   T12]  kernel_init+0x1f/0x1e0
[ 1129.803920][   T12]  ret_from_fork+0x72b/0xd50
[ 1129.808525][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1129.813311][   T12] page last free pid 989 tgid 989 stack trace:
[ 1129.819455][   T12]  free_pages_prepare+0x586/0xd80
[ 1129.824499][   T12]  __free_contig_range_common+0x14f/0x250
[ 1129.830229][   T12]  free_pages_bulk+0x12a/0x200
[ 1129.835012][   T12]  vm_area_free_pages+0xad/0x2b0
[ 1129.839973][   T12]  vfree+0x107/0x750
[ 1129.843873][   T12]  delayed_vfree_work+0x56/0x80
[ 1129.848726][   T12]  process_one_work+0xa23/0x1940
[ 1129.853669][   T12]  worker_thread+0x5ef/0xe50
[ 1129.858263][   T12]  kthread+0x370/0x450
[ 1129.862360][   T12]  ret_from_fork+0x72b/0xd50
[ 1129.866963][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1129.871749][   T12] 
[ 1129.874060][   T12] Memory state around the buggy address:
[ 1129.879707][   T12]  ffff88802a3f3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1129.887775][   T12]  ffff88802a3f3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1129.895836][   T12] >ffff88802a3f4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1129.903890][   T12]                    ^
[ 1129.907947][   T12]  ffff88802a3f4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1129.916005][   T12]  ffff88802a3f4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1129.924059][   T12] ==================================================================
[ 1129.943018][   T12] ==================================================================
[ 1129.951089][   T12] BUG: KASAN: slab-use-after-free in __dev_printk+0x43/0x100
[ 1129.958491][   T12] Read of size 8 at addr ffff88807a6d82d0 by task kworker/u8:0/12
[ 1129.966310][   T12] 
[ 1129.968646][   T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G    B        L      syzkaller #0 PREEMPT(full) 
[ 1129.968707][   T12] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
[ 1129.968723][   T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 1129.968752][   T12] Workqueue: usbip_event event_handler
[ 1129.968800][   T12] Call Trace:
[ 1129.968812][   T12]  <TASK>
[ 1129.968826][   T12]  dump_stack_lvl+0x100/0x190
[ 1129.968871][   T12]  print_report+0x13d/0x4b0
[ 1129.968931][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1129.968980][   T12]  ? __virt_addr_valid+0x239/0x430
[ 1129.969030][   T12]  ? __dev_printk+0x43/0x100
[ 1129.969071][   T12]  kasan_report+0xdf/0x1c0
[ 1129.969113][   T12]  ? __dev_printk+0x43/0x100
[ 1129.969161][   T12]  __dev_printk+0x43/0x100
[ 1129.969205][   T12]  _dev_info+0xef/0x127
[ 1129.969249][   T12]  ? __pfx__dev_info+0x10/0x10
[ 1129.969289][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1129.969335][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1129.969380][   T12]  ? end_report.part.0+0x77/0x90
[ 1129.969439][   T12]  ? vhci_shutdown_connection.cold+0x143/0x37c
[ 1129.969507][   T12]  ? add_taint+0x5f/0xb0
[ 1129.969574][   T12]  vhci_shutdown_connection.cold+0x156/0x37c
[ 1129.969634][   T12]  event_handler+0x216/0x570
[ 1129.969676][   T12]  process_one_work+0xa23/0x1940
[ 1129.969725][   T12]  ? __pfx_process_one_work+0x10/0x10
[ 1129.969760][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1129.969815][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1129.969871][   T12]  worker_thread+0x5ef/0xe50
[ 1129.969915][   T12]  ? kthread+0x13a/0x450
[ 1129.969977][   T12]  ? __pfx_worker_thread+0x10/0x10
[ 1129.970012][   T12]  kthread+0x370/0x450
[ 1129.970068][   T12]  ? __pfx_kthread+0x10/0x10
[ 1129.970128][   T12]  ret_from_fork+0x72b/0xd50
[ 1129.970183][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[ 1129.970229][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1129.970271][   T12]  ? __switch_to+0x800/0x10f0
[ 1129.970332][   T12]  ? __switch_to_asm+0x39/0x70
[ 1129.970380][   T12]  ? __pfx_kthread+0x10/0x10
[ 1129.970436][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1129.970501][   T12]  </TASK>
[ 1129.970513][   T12] 
[ 1130.175017][   T12] Allocated by task 19521:
[ 1130.179429][   T12]  kasan_save_stack+0x30/0x50
[ 1130.184141][   T12]  kasan_save_track+0x14/0x30
[ 1130.188843][   T12]  __kasan_slab_alloc+0x89/0x90
[ 1130.193699][   T12]  kmem_cache_alloc_node_noprof+0x27d/0x6b0
[ 1130.199621][   T12]  __alloc_skb+0x140/0x710
[ 1130.204053][   T12]  inet6_ifinfo_notify+0x77/0x140
[ 1130.209096][   T12]  addrconf_notify+0xb54/0x1ba0
[ 1130.213963][   T12]  notifier_call_chain+0x99/0x3f0
[ 1130.219010][   T12]  call_netdevice_notifiers_info+0xbe/0x110
[ 1130.224936][   T12]  __dev_notify_flags+0x12c/0x2e0
[ 1130.229976][   T12]  netif_change_flags+0x108/0x160
[ 1130.235013][   T12]  dev_change_flags+0xba/0x260
[ 1130.239798][   T12]  devinet_ioctl+0x110b/0x1f10
[ 1130.244571][   T12]  inet_ioctl+0x3aa/0x3f0
[ 1130.248916][   T12]  packet_ioctl+0xb9/0x260
[ 1130.253345][   T12]  sock_do_ioctl+0x118/0x280
[ 1130.257934][   T12]  sock_ioctl+0x599/0x6b0
[ 1130.262274][   T12]  __x64_sys_ioctl+0x18e/0x210
[ 1130.267045][   T12]  do_syscall_64+0x115/0x870
[ 1130.271653][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1130.277551][   T12] 
[ 1130.279863][   T12] Freed by task 19521:
[ 1130.283918][   T12]  kasan_save_stack+0x30/0x50
[ 1130.288617][   T12]  kasan_save_track+0x14/0x30
[ 1130.293317][   T12]  kasan_save_free_info+0x3b/0x70
[ 1130.298364][   T12]  __kasan_slab_free+0x5f/0x80
[ 1130.303133][   T12]  kmem_cache_free+0x127/0x6b0
[ 1130.307916][   T12]  kfree_skbmem+0x19a/0x210
[ 1130.312424][   T12]  consume_skb+0xd1/0x110
[ 1130.316782][   T12]  netlink_broadcast_filtered+0x368/0xf20
[ 1130.322512][   T12]  nlmsg_notify+0xb1/0x290
[ 1130.326935][   T12]  inet6_ifinfo_notify+0xcc/0x140
[ 1130.331982][   T12]  addrconf_notify+0xb54/0x1ba0
[ 1130.336853][   T12]  notifier_call_chain+0x99/0x3f0
[ 1130.341905][   T12]  call_netdevice_notifiers_info+0xbe/0x110
[ 1130.347825][   T12]  __dev_notify_flags+0x12c/0x2e0
[ 1130.352862][   T12]  netif_change_flags+0x108/0x160
[ 1130.357901][   T12]  dev_change_flags+0xba/0x260
[ 1130.362689][   T12]  devinet_ioctl+0x110b/0x1f10
[ 1130.367466][   T12]  inet_ioctl+0x3aa/0x3f0
[ 1130.371811][   T12]  packet_ioctl+0xb9/0x260
[ 1130.376229][   T12]  sock_do_ioctl+0x118/0x280
[ 1130.380821][   T12]  sock_ioctl+0x599/0x6b0
[ 1130.385154][   T12]  __x64_sys_ioctl+0x18e/0x210
[ 1130.389928][   T12]  do_syscall_64+0x115/0x870
[ 1130.394542][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1130.400440][   T12] 
[ 1130.402756][   T12] The buggy address belongs to the object at ffff88807a6d8280
[ 1130.402756][   T12]  which belongs to the cache skbuff_head_cache of size 240
[ 1130.417330][   T12] The buggy address is located 80 bytes inside of
[ 1130.417330][   T12]  freed 240-byte region [ffff88807a6d8280, ffff88807a6d8370)
[ 1130.431130][   T12] 
[ 1130.433442][   T12] The buggy address belongs to the physical page:
[ 1130.439850][   T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a6d8
[ 1130.448607][   T12] memcg:ffff8880359b3901
[ 1130.452833][   T12] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 1130.459944][   T12] page_type: f5(slab)
[ 1130.463927][   T12] raw: 00fff00000000000 ffff8881404878c0 dead000000000100 dead000000000122
[ 1130.472601][   T12] raw: 0000000000000000 00000008000c000c 00000000f5000000 ffff8880359b3901
[ 1130.481176][   T12] page dumped because: kasan: bad access detected
[ 1130.487579][   T12] page_owner tracks the page as allocated
[ 1130.493281][   T12] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6170, tgid 6166 (syz.0.88), ts 127435497440, free_ts 126706844432
[ 1130.513878][   T12]  post_alloc_hook+0xfd/0x120
[ 1130.518581][   T12]  get_page_from_freelist+0xf48/0x3530
[ 1130.524070][   T12]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 1130.529986][   T12]  new_slab+0xa2/0x640
[ 1130.534071][   T12]  refill_objects+0xe3/0x410
[ 1130.538679][   T12]  __pcs_replace_empty_main+0x376/0x680
[ 1130.544242][   T12]  kmem_cache_alloc_noprof+0x46e/0x6a0
[ 1130.549723][   T12]  skb_clone+0x190/0x400
[ 1130.553985][   T12]  hsr_create_tagged_frame+0x983/0xf00
[ 1130.559452][   T12]  hsr_forward_skb+0x1396/0x28d0
[ 1130.564403][   T12]  send_hsr_supervision_frame+0x696/0xbc0
[ 1130.570126][   T12]  hsr_announce+0x169/0x3e0
[ 1130.574628][   T12]  call_timer_fn+0x19a/0x610
[ 1130.579221][   T12]  __run_timers+0x757/0xb00
[ 1130.583730][   T12]  run_timer_base+0x114/0x190
[ 1130.588414][   T12]  run_timer_softirq+0x1a/0x50
[ 1130.593182][   T12] page last free pid 15 tgid 15 stack trace:
[ 1130.599151][   T12]  __free_frozen_pages+0x79f/0x1090
[ 1130.604365][   T12]  tlb_remove_table_rcu+0x2cf/0x380
[ 1130.609578][   T12]  rcu_core+0x5a2/0x10d0
[ 1130.613835][   T12]  handle_softirqs+0x1ea/0x9b0
[ 1130.618608][   T12]  run_ksoftirqd+0x38/0x60
[ 1130.623035][   T12]  smpboot_thread_fn+0x3d3/0xaa0
[ 1130.627991][   T12]  kthread+0x370/0x450
[ 1130.632085][   T12]  ret_from_fork+0x72b/0xd50
[ 1130.636693][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1130.641485][   T12] 
[ 1130.643799][   T12] Memory state around the buggy address:
[ 1130.649418][   T12]  ffff88807a6d8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1130.657475][   T12]  ffff88807a6d8200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 1130.665537][   T12] >ffff88807a6d8280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1130.673590][   T12]                                                  ^
[ 1130.680256][   T12]  ffff88807a6d8300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 1130.688317][   T12]  ffff88807a6d8380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 1130.696369][   T12] ==================================================================
[ 1130.707813][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[ 1130.714160][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[ 1130.759984][ T8637] EXT4-fs error (device loop9): ext4_lookup:1785: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816
[ 1130.778542][   T12] ==================================================================
[ 1130.786612][   T12] BUG: KASAN: slab-use-after-free in __dev_printk+0x6f/0x100
[ 1130.794012][   T12] Read of size 8 at addr ffff88807a6d8280 by task kworker/u8:0/12
[ 1130.801826][   T12] 
[ 1130.804161][   T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G    B        L      syzkaller #0 PREEMPT(full) 
[ 1130.804222][   T12] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
[ 1130.804238][   T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 1130.804265][   T12] Workqueue: usbip_event event_handler
[ 1130.804308][   T12] Call Trace:
[ 1130.804321][   T12]  <TASK>
[ 1130.804334][   T12]  dump_stack_lvl+0x100/0x190
[ 1130.804378][   T12]  print_report+0x13d/0x4b0
[ 1130.804434][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1130.804481][   T12]  ? __virt_addr_valid+0x239/0x430
[ 1130.804535][   T12]  ? __dev_printk+0x6f/0x100
[ 1130.804575][   T12]  kasan_report+0xdf/0x1c0
[ 1130.804616][   T12]  ? __dev_printk+0x6f/0x100
[ 1130.804665][   T12]  __dev_printk+0x6f/0x100
[ 1130.804709][   T12]  _dev_info+0xef/0x127
[ 1130.804753][   T12]  ? __pfx__dev_info+0x10/0x10
[ 1130.804796][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1130.804845][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1130.804891][   T12]  ? end_report.part.0+0x77/0x90
[ 1130.804949][   T12]  ? vhci_shutdown_connection.cold+0x143/0x37c
[ 1130.805011][   T12]  ? add_taint+0x5f/0xb0
[ 1130.805073][   T12]  vhci_shutdown_connection.cold+0x156/0x37c
[ 1130.805135][   T12]  event_handler+0x216/0x570
[ 1130.805178][   T12]  process_one_work+0xa23/0x1940
[ 1130.805226][   T12]  ? __pfx_process_one_work+0x10/0x10
[ 1130.805262][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1130.805316][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1130.805368][   T12]  worker_thread+0x5ef/0xe50
[ 1130.805413][   T12]  ? kthread+0x13a/0x450
[ 1130.805471][   T12]  ? __pfx_worker_thread+0x10/0x10
[ 1130.805515][   T12]  kthread+0x370/0x450
[ 1130.805572][   T12]  ? __pfx_kthread+0x10/0x10
[ 1130.805635][   T12]  ret_from_fork+0x72b/0xd50
[ 1130.805687][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[ 1130.805737][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1130.805787][   T12]  ? __switch_to+0x800/0x10f0
[ 1130.805847][   T12]  ? __switch_to_asm+0x39/0x70
[ 1130.805900][   T12]  ? __pfx_kthread+0x10/0x10
[ 1130.805962][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1130.806028][   T12]  </TASK>
[ 1130.806041][   T12] 
[ 1131.010872][   T12] Allocated by task 19521:
[ 1131.015299][   T12]  kasan_save_stack+0x30/0x50
[ 1131.020029][   T12]  kasan_save_track+0x14/0x30
[ 1131.024750][   T12]  __kasan_slab_alloc+0x89/0x90
[ 1131.029127][ T8637] EXT4-fs error (device loop9): ext4_lookup:1785: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816
[ 1131.029617][   T12]  kmem_cache_alloc_node_noprof+0x27d/0x6b0
[ 1131.048065][   T12]  __alloc_skb+0x140/0x710
[ 1131.052518][   T12]  inet6_ifinfo_notify+0x77/0x140
[ 1131.057582][   T12]  addrconf_notify+0xb54/0x1ba0
[ 1131.062469][   T12]  notifier_call_chain+0x99/0x3f0
[ 1131.067544][   T12]  call_netdevice_notifiers_info+0xbe/0x110
[ 1131.073479][   T12]  __dev_notify_flags+0x12c/0x2e0
[ 1131.078541][   T12]  netif_change_flags+0x108/0x160
[ 1131.083592][   T12]  dev_change_flags+0xba/0x260
[ 1131.088384][   T12]  devinet_ioctl+0x110b/0x1f10
[ 1131.093160][   T12]  inet_ioctl+0x3aa/0x3f0
[ 1131.097507][   T12]  packet_ioctl+0xb9/0x260
[ 1131.101927][   T12]  sock_do_ioctl+0x118/0x280
[ 1131.106518][   T12]  sock_ioctl+0x599/0x6b0
[ 1131.110851][   T12]  __x64_sys_ioctl+0x18e/0x210
[ 1131.115625][   T12]  do_syscall_64+0x115/0x870
[ 1131.120232][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1131.126130][   T12] 
[ 1131.128440][   T12] Freed by task 19521:
[ 1131.132494][   T12]  kasan_save_stack+0x30/0x50
[ 1131.137198][   T12]  kasan_save_track+0x14/0x30
[ 1131.141899][   T12]  kasan_save_free_info+0x3b/0x70
[ 1131.146962][   T12]  __kasan_slab_free+0x5f/0x80
[ 1131.151726][   T12]  kmem_cache_free+0x127/0x6b0
[ 1131.156507][   T12]  kfree_skbmem+0x19a/0x210
[ 1131.161016][   T12]  consume_skb+0xd1/0x110
[ 1131.165368][   T12]  netlink_broadcast_filtered+0x368/0xf20
[ 1131.171095][   T12]  nlmsg_notify+0xb1/0x290
[ 1131.175519][   T12]  inet6_ifinfo_notify+0xcc/0x140
[ 1131.180564][   T12]  addrconf_notify+0xb54/0x1ba0
[ 1131.185435][   T12]  notifier_call_chain+0x99/0x3f0
[ 1131.190488][   T12]  call_netdevice_notifiers_info+0xbe/0x110
[ 1131.196418][   T12]  __dev_notify_flags+0x12c/0x2e0
[ 1131.201455][   T12]  netif_change_flags+0x108/0x160
[ 1131.206521][   T12]  dev_change_flags+0xba/0x260
[ 1131.211307][   T12]  devinet_ioctl+0x110b/0x1f10
[ 1131.216080][   T12]  inet_ioctl+0x3aa/0x3f0
[ 1131.220422][   T12]  packet_ioctl+0xb9/0x260
[ 1131.224842][   T12]  sock_do_ioctl+0x118/0x280
[ 1131.229433][   T12]  sock_ioctl+0x599/0x6b0
[ 1131.233766][   T12]  __x64_sys_ioctl+0x18e/0x210
[ 1131.238540][   T12]  do_syscall_64+0x115/0x870
[ 1131.243143][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1131.249060][   T12] 
[ 1131.251371][   T12] The buggy address belongs to the object at ffff88807a6d8280
[ 1131.251371][   T12]  which belongs to the cache skbuff_head_cache of size 240
[ 1131.265944][   T12] The buggy address is located 0 bytes inside of
[ 1131.265944][   T12]  freed 240-byte region [ffff88807a6d8280, ffff88807a6d8370)
[ 1131.279570][   T12] 
[ 1131.281882][   T12] The buggy address belongs to the physical page:
[ 1131.288281][   T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a6d8
[ 1131.297039][   T12] memcg:ffff8880359b3901
[ 1131.301268][   T12] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 1131.308375][   T12] page_type: f5(slab)
[ 1131.312362][   T12] raw: 00fff00000000000 ffff8881404878c0 dead000000000100 dead000000000122
[ 1131.320950][   T12] raw: 0000000000000000 00000008000c000c 00000000f5000000 ffff8880359b3901
[ 1131.329523][   T12] page dumped because: kasan: bad access detected
[ 1131.335924][   T12] page_owner tracks the page as allocated
[ 1131.341626][   T12] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6170, tgid 6166 (syz.0.88), ts 127435497440, free_ts 126706844432
[ 1131.362222][   T12]  post_alloc_hook+0xfd/0x120
[ 1131.366921][   T12]  get_page_from_freelist+0xf48/0x3530
[ 1131.372401][   T12]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 1131.378312][   T12]  new_slab+0xa2/0x640
[ 1131.382402][   T12]  refill_objects+0xe3/0x410
[ 1131.387009][   T12]  __pcs_replace_empty_main+0x376/0x680
[ 1131.392570][   T12]  kmem_cache_alloc_noprof+0x46e/0x6a0
[ 1131.398051][   T12]  skb_clone+0x190/0x400
[ 1131.402309][   T12]  hsr_create_tagged_frame+0x983/0xf00
[ 1131.407776][   T12]  hsr_forward_skb+0x1396/0x28d0
[ 1131.412722][   T12]  send_hsr_supervision_frame+0x696/0xbc0
[ 1131.418445][   T12]  hsr_announce+0x169/0x3e0
[ 1131.422953][   T12]  call_timer_fn+0x19a/0x610
[ 1131.427545][   T12]  __run_timers+0x757/0xb00
[ 1131.432053][   T12]  run_timer_base+0x114/0x190
[ 1131.436734][   T12]  run_timer_softirq+0x1a/0x50
[ 1131.441505][   T12] page last free pid 15 tgid 15 stack trace:
[ 1131.447474][   T12]  __free_frozen_pages+0x79f/0x1090
[ 1131.452687][   T12]  tlb_remove_table_rcu+0x2cf/0x380
[ 1131.457895][   T12]  rcu_core+0x5a2/0x10d0
[ 1131.462149][   T12]  handle_softirqs+0x1ea/0x9b0
[ 1131.466923][   T12]  run_ksoftirqd+0x38/0x60
[ 1131.471346][   T12]  smpboot_thread_fn+0x3d3/0xaa0
[ 1131.476303][   T12]  kthread+0x370/0x450
[ 1131.480392][   T12]  ret_from_fork+0x72b/0xd50
[ 1131.484995][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1131.489777][   T12] 
[ 1131.492088][   T12] Memory state around the buggy address:
[ 1131.497708][   T12]  ffff88807a6d8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1131.505769][   T12]  ffff88807a6d8200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 1131.513828][   T12] >ffff88807a6d8280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1131.521880][   T12]                    ^
[ 1131.525942][   T12]  ffff88807a6d8300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 1131.534001][   T12]  ffff88807a6d8380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 1131.542052][   T12] ==================================================================
[ 1131.593116][   T12] ==================================================================
[ 1131.601203][   T12] BUG: KASAN: slab-use-after-free in dev_driver_string+0x128/0x150
[ 1131.609127][   T12] Read of size 8 at addr ffff88807a6d82e8 by task kworker/u8:0/12
[ 1131.616937][   T12] 
[ 1131.619270][   T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G    B        L      syzkaller #0 PREEMPT(full) 
[ 1131.619330][   T12] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
[ 1131.619347][   T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 1131.619373][   T12] Workqueue: usbip_event event_handler
[ 1131.619417][   T12] Call Trace:
[ 1131.619430][   T12]  <TASK>
[ 1131.619444][   T12]  dump_stack_lvl+0x100/0x190
[ 1131.619488][   T12]  print_report+0x13d/0x4b0
[ 1131.619548][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1131.619596][   T12]  ? __virt_addr_valid+0x239/0x430
[ 1131.619643][   T12]  ? dev_driver_string+0x128/0x150
[ 1131.619688][   T12]  kasan_report+0xdf/0x1c0
[ 1131.619731][   T12]  ? dev_driver_string+0x128/0x150
[ 1131.619783][   T12]  dev_driver_string+0x128/0x150
[ 1131.619829][   T12]  __dev_printk+0x7f/0x100
[ 1131.619875][   T12]  _dev_info+0xef/0x127
[ 1131.619917][   T12]  ? __pfx__dev_info+0x10/0x10
[ 1131.619960][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1131.620007][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1131.620053][   T12]  ? end_report.part.0+0x77/0x90
[ 1131.620111][   T12]  ? vhci_shutdown_connection.cold+0x143/0x37c
[ 1131.620172][   T12]  ? add_taint+0x5f/0xb0
[ 1131.620232][   T12]  vhci_shutdown_connection.cold+0x156/0x37c
[ 1131.620294][   T12]  event_handler+0x216/0x570
[ 1131.620339][   T12]  process_one_work+0xa23/0x1940
[ 1131.620387][   T12]  ? __pfx_process_one_work+0x10/0x10
[ 1131.620423][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1131.620478][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1131.620534][   T12]  worker_thread+0x5ef/0xe50
[ 1131.620580][   T12]  ? kthread+0x13a/0x450
[ 1131.620639][   T12]  ? __pfx_worker_thread+0x10/0x10
[ 1131.620674][   T12]  kthread+0x370/0x450
[ 1131.620732][   T12]  ? __pfx_kthread+0x10/0x10
[ 1131.620793][   T12]  ret_from_fork+0x72b/0xd50
[ 1131.620843][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[ 1131.620894][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1131.620940][   T12]  ? __switch_to+0x800/0x10f0
[ 1131.621000][   T12]  ? __switch_to_asm+0x39/0x70
[ 1131.621053][   T12]  ? __pfx_kthread+0x10/0x10
[ 1131.621113][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1131.621178][   T12]  </TASK>
[ 1131.621191][   T12] 
[ 1131.831637][   T12] Allocated by task 19521:
[ 1131.836045][   T12]  kasan_save_stack+0x30/0x50
[ 1131.840752][   T12]  kasan_save_track+0x14/0x30
[ 1131.845452][   T12]  __kasan_slab_alloc+0x89/0x90
[ 1131.850310][   T12]  kmem_cache_alloc_node_noprof+0x27d/0x6b0
[ 1131.856240][   T12]  __alloc_skb+0x140/0x710
[ 1131.860671][   T12]  inet6_ifinfo_notify+0x77/0x140
[ 1131.865715][   T12]  addrconf_notify+0xb54/0x1ba0
[ 1131.870590][   T12]  notifier_call_chain+0x99/0x3f0
[ 1131.875640][   T12]  call_netdevice_notifiers_info+0xbe/0x110
[ 1131.881564][   T12]  __dev_notify_flags+0x12c/0x2e0
[ 1131.886602][   T12]  netif_change_flags+0x108/0x160
[ 1131.891643][   T12]  dev_change_flags+0xba/0x260
[ 1131.896440][   T12]  devinet_ioctl+0x110b/0x1f10
[ 1131.901218][   T12]  inet_ioctl+0x3aa/0x3f0
[ 1131.905558][   T12]  packet_ioctl+0xb9/0x260
[ 1131.909977][   T12]  sock_do_ioctl+0x118/0x280
[ 1131.914569][   T12]  sock_ioctl+0x599/0x6b0
[ 1131.918902][   T12]  __x64_sys_ioctl+0x18e/0x210
[ 1131.923675][   T12]  do_syscall_64+0x115/0x870
[ 1131.928280][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1131.934176][   T12] 
[ 1131.936485][   T12] Freed by task 19521:
[ 1131.940544][   T12]  kasan_save_stack+0x30/0x50
[ 1131.945245][   T12]  kasan_save_track+0x14/0x30
[ 1131.949945][   T12]  kasan_save_free_info+0x3b/0x70
[ 1131.954983][   T12]  __kasan_slab_free+0x5f/0x80
[ 1131.959745][   T12]  kmem_cache_free+0x127/0x6b0
[ 1131.964524][   T12]  kfree_skbmem+0x19a/0x210
[ 1131.969032][   T12]  consume_skb+0xd1/0x110
[ 1131.973393][   T12]  netlink_broadcast_filtered+0x368/0xf20
[ 1131.979119][   T12]  nlmsg_notify+0xb1/0x290
[ 1131.983541][   T12]  inet6_ifinfo_notify+0xcc/0x140
[ 1131.988583][   T12]  addrconf_notify+0xb54/0x1ba0
[ 1131.993451][   T12]  notifier_call_chain+0x99/0x3f0
[ 1131.998505][   T12]  call_netdevice_notifiers_info+0xbe/0x110
[ 1132.004426][   T12]  __dev_notify_flags+0x12c/0x2e0
[ 1132.009467][   T12]  netif_change_flags+0x108/0x160
[ 1132.014512][   T12]  dev_change_flags+0xba/0x260
[ 1132.019309][   T12]  devinet_ioctl+0x110b/0x1f10
[ 1132.024081][   T12]  inet_ioctl+0x3aa/0x3f0
[ 1132.028423][   T12]  packet_ioctl+0xb9/0x260
[ 1132.032843][   T12]  sock_do_ioctl+0x118/0x280
[ 1132.037432][   T12]  sock_ioctl+0x599/0x6b0
[ 1132.041765][   T12]  __x64_sys_ioctl+0x18e/0x210
[ 1132.046536][   T12]  do_syscall_64+0x115/0x870
[ 1132.051141][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1132.057036][   T12] 
[ 1132.059347][   T12] The buggy address belongs to the object at ffff88807a6d8280
[ 1132.059347][   T12]  which belongs to the cache skbuff_head_cache of size 240
[ 1132.073920][   T12] The buggy address is located 104 bytes inside of
[ 1132.073920][   T12]  freed 240-byte region [ffff88807a6d8280, ffff88807a6d8370)
[ 1132.087722][   T12] 
[ 1132.090036][   T12] The buggy address belongs to the physical page:
[ 1132.096432][   T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a6d8
[ 1132.105190][   T12] memcg:ffff8880359b3901
[ 1132.109416][   T12] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 1132.116522][   T12] page_type: f5(slab)
[ 1132.120506][   T12] raw: 00fff00000000000 ffff8881404878c0 dead000000000100 dead000000000122
[ 1132.129094][   T12] raw: 0000000000000000 00000008000c000c 00000000f5000000 ffff8880359b3901
[ 1132.137669][   T12] page dumped because: kasan: bad access detected
[ 1132.144072][   T12] page_owner tracks the page as allocated
[ 1132.149772][   T12] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6170, tgid 6166 (syz.0.88), ts 127435497440, free_ts 126706844432
[ 1132.170366][   T12]  post_alloc_hook+0xfd/0x120
[ 1132.175060][   T12]  get_page_from_freelist+0xf48/0x3530
[ 1132.180536][   T12]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 1132.186452][   T12]  new_slab+0xa2/0x640
[ 1132.190541][   T12]  refill_objects+0xe3/0x410
[ 1132.195145][   T12]  __pcs_replace_empty_main+0x376/0x680
[ 1132.200705][   T12]  kmem_cache_alloc_noprof+0x46e/0x6a0
[ 1132.206212][   T12]  skb_clone+0x190/0x400
[ 1132.210470][   T12]  hsr_create_tagged_frame+0x983/0xf00
[ 1132.215940][   T12]  hsr_forward_skb+0x1396/0x28d0
[ 1132.220884][   T12]  send_hsr_supervision_frame+0x696/0xbc0
[ 1132.226605][   T12]  hsr_announce+0x169/0x3e0
[ 1132.231108][   T12]  call_timer_fn+0x19a/0x610
[ 1132.235699][   T12]  __run_timers+0x757/0xb00
[ 1132.240208][   T12]  run_timer_base+0x114/0x190
[ 1132.244890][   T12]  run_timer_softirq+0x1a/0x50
[ 1132.249658][   T12] page last free pid 15 tgid 15 stack trace:
[ 1132.255627][   T12]  __free_frozen_pages+0x79f/0x1090
[ 1132.260841][   T12]  tlb_remove_table_rcu+0x2cf/0x380
[ 1132.266049][   T12]  rcu_core+0x5a2/0x10d0
[ 1132.270309][   T12]  handle_softirqs+0x1ea/0x9b0
[ 1132.275082][   T12]  run_ksoftirqd+0x38/0x60
[ 1132.279512][   T12]  smpboot_thread_fn+0x3d3/0xaa0
[ 1132.284479][   T12]  kthread+0x370/0x450
[ 1132.288579][   T12]  ret_from_fork+0x72b/0xd50
[ 1132.293184][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1132.297976][   T12] 
[ 1132.300325][   T12] Memory state around the buggy address:
[ 1132.305948][   T12]  ffff88807a6d8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1132.314009][   T12]  ffff88807a6d8200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 1132.322065][   T12] >ffff88807a6d8280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1132.330126][   T12]                                                           ^
[ 1132.337571][   T12]  ffff88807a6d8300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 1132.345630][   T12]  ffff88807a6d8380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 1132.353684][   T12] ==================================================================
[ 1132.373251][   T12] ==================================================================
[ 1132.381336][   T12] BUG: KASAN: slab-use-after-free in dev_driver_string+0x13f/0x150
[ 1132.389258][   T12] Read of size 8 at addr ffff88807a6d82e0 by task kworker/u8:0/12
[ 1132.397071][   T12] 
[ 1132.399405][   T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G    B        L      syzkaller #0 PREEMPT(full) 
[ 1132.399465][   T12] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
[ 1132.399481][   T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 1132.399509][   T12] Workqueue: usbip_event event_handler
[ 1132.399554][   T12] Call Trace:
[ 1132.399567][   T12]  <TASK>
[ 1132.399580][   T12]  dump_stack_lvl+0x100/0x190
[ 1132.399624][   T12]  print_report+0x13d/0x4b0
[ 1132.399681][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1132.399729][   T12]  ? __virt_addr_valid+0x239/0x430
[ 1132.399777][   T12]  ? dev_driver_string+0x13f/0x150
[ 1132.399825][   T12]  kasan_report+0xdf/0x1c0
[ 1132.399867][   T12]  ? dev_driver_string+0x13f/0x150
[ 1132.399920][   T12]  dev_driver_string+0x13f/0x150
[ 1132.399967][   T12]  __dev_printk+0x7f/0x100
[ 1132.400017][   T12]  _dev_info+0xef/0x127
[ 1132.400062][   T12]  ? __pfx__dev_info+0x10/0x10
[ 1132.400105][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1132.400153][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1132.400200][   T12]  ? end_report.part.0+0x77/0x90
[ 1132.400259][   T12]  ? vhci_shutdown_connection.cold+0x143/0x37c
[ 1132.400321][   T12]  ? add_taint+0x5f/0xb0
[ 1132.400383][   T12]  vhci_shutdown_connection.cold+0x156/0x37c
[ 1132.400445][   T12]  event_handler+0x216/0x570
[ 1132.400490][   T12]  process_one_work+0xa23/0x1940
[ 1132.400538][   T12]  ? __pfx_process_one_work+0x10/0x10
[ 1132.400575][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1132.400629][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1132.400680][   T12]  worker_thread+0x5ef/0xe50
[ 1132.400727][   T12]  ? kthread+0x13a/0x450
[ 1132.400790][   T12]  ? __pfx_worker_thread+0x10/0x10
[ 1132.400826][   T12]  kthread+0x370/0x450
[ 1132.400884][   T12]  ? __pfx_kthread+0x10/0x10
[ 1132.400946][   T12]  ret_from_fork+0x72b/0xd50
[ 1132.401004][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[ 1132.401056][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1132.401103][   T12]  ? __switch_to+0x800/0x10f0
[ 1132.401164][   T12]  ? __switch_to_asm+0x39/0x70
[ 1132.401217][   T12]  ? __pfx_kthread+0x10/0x10
[ 1132.401279][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1132.401345][   T12]  </TASK>
[ 1132.401358][   T12] 
[ 1132.612009][   T12] Allocated by task 19521:
[ 1132.616429][   T12]  kasan_save_stack+0x30/0x50
[ 1132.621144][   T12]  kasan_save_track+0x14/0x30
[ 1132.625854][   T12]  __kasan_slab_alloc+0x89/0x90
[ 1132.630712][   T12]  kmem_cache_alloc_node_noprof+0x27d/0x6b0
[ 1132.636641][   T12]  __alloc_skb+0x140/0x710
[ 1132.641079][   T12]  inet6_ifinfo_notify+0x77/0x140
[ 1132.646134][   T12]  addrconf_notify+0xb54/0x1ba0
[ 1132.651013][   T12]  notifier_call_chain+0x99/0x3f0
[ 1132.656069][   T12]  call_netdevice_notifiers_info+0xbe/0x110
[ 1132.662002][   T12]  __dev_notify_flags+0x12c/0x2e0
[ 1132.667046][   T12]  netif_change_flags+0x108/0x160
[ 1132.672093][   T12]  dev_change_flags+0xba/0x260
[ 1132.676886][   T12]  devinet_ioctl+0x110b/0x1f10
[ 1132.681666][   T12]  inet_ioctl+0x3aa/0x3f0
[ 1132.686016][   T12]  packet_ioctl+0xb9/0x260
[ 1132.690444][   T12]  sock_do_ioctl+0x118/0x280
[ 1132.695043][   T12]  sock_ioctl+0x599/0x6b0
[ 1132.699387][   T12]  __x64_sys_ioctl+0x18e/0x210
[ 1132.704176][   T12]  do_syscall_64+0x115/0x870
[ 1132.708794][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1132.714703][   T12] 
[ 1132.717017][   T12] Freed by task 19521:
[ 1132.721077][   T12]  kasan_save_stack+0x30/0x50
[ 1132.725787][   T12]  kasan_save_track+0x14/0x30
[ 1132.730493][   T12]  kasan_save_free_info+0x3b/0x70
[ 1132.735540][   T12]  __kasan_slab_free+0x5f/0x80
[ 1132.740313][   T12]  kmem_cache_free+0x127/0x6b0
[ 1132.745101][   T12]  kfree_skbmem+0x19a/0x210
[ 1132.749615][   T12]  consume_skb+0xd1/0x110
[ 1132.753980][   T12]  netlink_broadcast_filtered+0x368/0xf20
[ 1132.759724][   T12]  nlmsg_notify+0xb1/0x290
[ 1132.764160][   T12]  inet6_ifinfo_notify+0xcc/0x140
[ 1132.769215][   T12]  addrconf_notify+0xb54/0x1ba0
[ 1132.774096][   T12]  notifier_call_chain+0x99/0x3f0
[ 1132.779155][   T12]  call_netdevice_notifiers_info+0xbe/0x110
[ 1132.785089][   T12]  __dev_notify_flags+0x12c/0x2e0
[ 1132.790138][   T12]  netif_change_flags+0x108/0x160
[ 1132.795191][   T12]  dev_change_flags+0xba/0x260
[ 1132.800007][   T12]  devinet_ioctl+0x110b/0x1f10
[ 1132.804790][   T12]  inet_ioctl+0x3aa/0x3f0
[ 1132.809141][   T12]  packet_ioctl+0xb9/0x260
[ 1132.813574][   T12]  sock_do_ioctl+0x118/0x280
[ 1132.818175][   T12]  sock_ioctl+0x599/0x6b0
[ 1132.822521][   T12]  __x64_sys_ioctl+0x18e/0x210
[ 1132.827304][   T12]  do_syscall_64+0x115/0x870
[ 1132.831922][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1132.837830][   T12] 
[ 1132.840147][   T12] The buggy address belongs to the object at ffff88807a6d8280
[ 1132.840147][   T12]  which belongs to the cache skbuff_head_cache of size 240
[ 1132.854732][   T12] The buggy address is located 96 bytes inside of
[ 1132.854732][   T12]  freed 240-byte region [ffff88807a6d8280, ffff88807a6d8370)
[ 1132.868456][   T12] 
[ 1132.870779][   T12] The buggy address belongs to the physical page:
[ 1132.877184][   T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a6d8
[ 1132.885954][   T12] memcg:ffff8880359b3901
[ 1132.890193][   T12] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 1132.897311][   T12] page_type: f5(slab)
[ 1132.901307][   T12] raw: 00fff00000000000 ffff8881404878c0 dead000000000100 dead000000000122
[ 1132.909903][   T12] raw: 0000000000000000 00000008000c000c 00000000f5000000 ffff8880359b3901
[ 1132.918488][   T12] page dumped because: kasan: bad access detected
[ 1132.924897][   T12] page_owner tracks the page as allocated
[ 1132.930604][   T12] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6170, tgid 6166 (syz.0.88), ts 127435497440, free_ts 126706844432
[ 1132.951216][   T12]  post_alloc_hook+0xfd/0x120
[ 1132.955923][   T12]  get_page_from_freelist+0xf48/0x3530
[ 1132.961423][   T12]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 1132.967355][   T12]  new_slab+0xa2/0x640
[ 1132.971454][   T12]  refill_objects+0xe3/0x410
[ 1132.976073][   T12]  __pcs_replace_empty_main+0x376/0x680
[ 1132.981646][   T12]  kmem_cache_alloc_noprof+0x46e/0x6a0
[ 1132.987159][   T12]  skb_clone+0x190/0x400
[ 1132.991432][   T12]  hsr_create_tagged_frame+0x983/0xf00
[ 1132.996911][   T12]  hsr_forward_skb+0x1396/0x28d0
[ 1133.001866][   T12]  send_hsr_supervision_frame+0x696/0xbc0
[ 1133.007603][   T12]  hsr_announce+0x169/0x3e0
[ 1133.012115][   T12]  call_timer_fn+0x19a/0x610
[ 1133.016717][   T12]  __run_timers+0x757/0xb00
[ 1133.021236][   T12]  run_timer_base+0x114/0x190
[ 1133.025929][   T12]  run_timer_softirq+0x1a/0x50
[ 1133.030714][   T12] page last free pid 15 tgid 15 stack trace:
[ 1133.036689][   T12]  __free_frozen_pages+0x79f/0x1090
[ 1133.041909][   T12]  tlb_remove_table_rcu+0x2cf/0x380
[ 1133.047130][   T12]  rcu_core+0x5a2/0x10d0
[ 1133.051394][   T12]  handle_softirqs+0x1ea/0x9b0
[ 1133.056180][   T12]  run_ksoftirqd+0x38/0x60
[ 1133.060618][   T12]  smpboot_thread_fn+0x3d3/0xaa0
[ 1133.065588][   T12]  kthread+0x370/0x450
[ 1133.069691][   T12]  ret_from_fork+0x72b/0xd50
[ 1133.074314][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1133.079114][   T12] 
[ 1133.081434][   T12] Memory state around the buggy address:
[ 1133.087064][   T12]  ffff88807a6d8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1133.095134][   T12]  ffff88807a6d8200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 1133.103202][   T12] >ffff88807a6d8280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1133.111266][   T12]                                                        ^
[ 1133.118463][   T12]  ffff88807a6d8300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 1133.126534][   T12]  ffff88807a6d8380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 1133.134601][   T12] ==================================================================
[ 1133.154741][   T12] ==================================================================
[ 1133.162811][   T12] BUG: KASAN: slab-use-after-free in dev_driver_string+0x149/0x150
[ 1133.170725][   T12] Read of size 8 at addr ffff88807a6d8708 by task kworker/u8:0/12
[ 1133.178526][   T12] 
[ 1133.180849][   T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G    B        L      syzkaller #0 PREEMPT(full) 
[ 1133.180904][   T12] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
[ 1133.180919][   T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 1133.180944][   T12] Workqueue: usbip_event event_handler
[ 1133.180983][   T12] Call Trace:
[ 1133.180995][   T12]  <TASK>
[ 1133.181012][   T12]  dump_stack_lvl+0x100/0x190
[ 1133.181051][   T12]  print_report+0x13d/0x4b0
[ 1133.181103][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1133.181146][   T12]  ? __virt_addr_valid+0x239/0x430
[ 1133.181190][   T12]  ? dev_driver_string+0x149/0x150
[ 1133.181232][   T12]  kasan_report+0xdf/0x1c0
[ 1133.181270][   T12]  ? dev_driver_string+0x149/0x150
[ 1133.181319][   T12]  dev_driver_string+0x149/0x150
[ 1133.181361][   T12]  __dev_printk+0x7f/0x100
[ 1133.181402][   T12]  _dev_info+0xef/0x127
[ 1133.181442][   T12]  ? __pfx__dev_info+0x10/0x10
[ 1133.181482][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1133.181526][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1133.181568][   T12]  ? end_report.part.0+0x77/0x90
[ 1133.181622][   T12]  ? vhci_shutdown_connection.cold+0x143/0x37c
[ 1133.181678][   T12]  ? add_taint+0x5f/0xb0
[ 1133.181734][   T12]  vhci_shutdown_connection.cold+0x156/0x37c
[ 1133.181791][   T12]  event_handler+0x216/0x570
[ 1133.181832][   T12]  process_one_work+0xa23/0x1940
[ 1133.181875][   T12]  ? __pfx_process_one_work+0x10/0x10
[ 1133.181908][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1133.181958][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1133.182010][   T12]  worker_thread+0x5ef/0xe50
[ 1133.182052][   T12]  ? kthread+0x13a/0x450
[ 1133.182105][   T12]  ? __pfx_worker_thread+0x10/0x10
[ 1133.182138][   T12]  kthread+0x370/0x450
[ 1133.182191][   T12]  ? __pfx_kthread+0x10/0x10
[ 1133.182247][   T12]  ret_from_fork+0x72b/0xd50
[ 1133.182295][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[ 1133.182342][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1133.182384][   T12]  ? __switch_to+0x800/0x10f0
[ 1133.182445][   T12]  ? __switch_to_asm+0x39/0x70
[ 1133.182498][   T12]  ? __pfx_kthread+0x10/0x10
[ 1133.182561][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1133.182629][   T12]  </TASK>
[ 1133.182642][   T12] 
[ 1133.393034][   T12] Allocated by task 1125:
[ 1133.397356][   T12]  kasan_save_stack+0x30/0x50
[ 1133.402063][   T12]  kasan_save_track+0x14/0x30
[ 1133.406765][   T12]  __kasan_slab_alloc+0x89/0x90
[ 1133.411623][   T12]  kmem_cache_alloc_node_noprof+0x27d/0x6b0
[ 1133.417542][   T12]  __alloc_skb+0x140/0x710
[ 1133.421973][   T12]  nsim_dev_trap_report_work+0x2af/0xd20
[ 1133.427627][   T12]  process_one_work+0xa23/0x1940
[ 1133.432567][   T12]  worker_thread+0x5ef/0xe50
[ 1133.437158][   T12]  kthread+0x370/0x450
[ 1133.441251][   T12]  ret_from_fork+0x72b/0xd50
[ 1133.445855][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1133.450636][   T12] 
[ 1133.452946][   T12] Freed by task 1125:
[ 1133.456917][   T12]  kasan_save_stack+0x30/0x50
[ 1133.461619][   T12]  kasan_save_track+0x14/0x30
[ 1133.466318][   T12]  kasan_save_free_info+0x3b/0x70
[ 1133.471360][   T12]  __kasan_slab_free+0x5f/0x80
[ 1133.476124][   T12]  kmem_cache_free+0x127/0x6b0
[ 1133.480904][   T12]  kfree_skbmem+0x19a/0x210
[ 1133.485408][   T12]  consume_skb+0xd1/0x110
[ 1133.489758][   T12]  nsim_dev_trap_report_work+0x8de/0xd20
[ 1133.495409][   T12]  process_one_work+0xa23/0x1940
[ 1133.500349][   T12]  worker_thread+0x5ef/0xe50
[ 1133.504938][   T12]  kthread+0x370/0x450
[ 1133.509033][   T12]  ret_from_fork+0x72b/0xd50
[ 1133.513637][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1133.518421][   T12] 
[ 1133.520732][   T12] The buggy address belongs to the object at ffff88807a6d8640
[ 1133.520732][   T12]  which belongs to the cache skbuff_head_cache of size 240
[ 1133.535308][   T12] The buggy address is located 200 bytes inside of
[ 1133.535308][   T12]  freed 240-byte region [ffff88807a6d8640, ffff88807a6d8730)
[ 1133.549108][   T12] 
[ 1133.551426][   T12] The buggy address belongs to the physical page:
[ 1133.557823][   T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a6d8
[ 1133.566580][   T12] memcg:ffff8880359b3901
[ 1133.570806][   T12] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 1133.577909][   T12] page_type: f5(slab)
[ 1133.581891][   T12] raw: 00fff00000000000 ffff8881404878c0 dead000000000100 dead000000000122
[ 1133.590477][   T12] raw: 0000000000000000 00000008000c000c 00000000f5000000 ffff8880359b3901
[ 1133.599051][   T12] page dumped because: kasan: bad access detected
[ 1133.605450][   T12] page_owner tracks the page as allocated
[ 1133.611150][   T12] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6170, tgid 6166 (syz.0.88), ts 127435497440, free_ts 126706844432
[ 1133.631742][   T12]  post_alloc_hook+0xfd/0x120
[ 1133.636438][   T12]  get_page_from_freelist+0xf48/0x3530
[ 1133.641914][   T12]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 1133.647828][   T12]  new_slab+0xa2/0x640
[ 1133.651910][   T12]  refill_objects+0xe3/0x410
[ 1133.656514][   T12]  __pcs_replace_empty_main+0x376/0x680
[ 1133.662074][   T12]  kmem_cache_alloc_noprof+0x46e/0x6a0
[ 1133.667555][   T12]  skb_clone+0x190/0x400
[ 1133.671812][   T12]  hsr_create_tagged_frame+0x983/0xf00
[ 1133.677280][   T12]  hsr_forward_skb+0x1396/0x28d0
[ 1133.682224][   T12]  send_hsr_supervision_frame+0x696/0xbc0
[ 1133.687945][   T12]  hsr_announce+0x169/0x3e0
[ 1133.692450][   T12]  call_timer_fn+0x19a/0x610
[ 1133.697043][   T12]  __run_timers+0x757/0xb00
[ 1133.701547][   T12]  run_timer_base+0x114/0x190
[ 1133.706227][   T12]  run_timer_softirq+0x1a/0x50
[ 1133.710995][   T12] page last free pid 15 tgid 15 stack trace:
[ 1133.716968][   T12]  __free_frozen_pages+0x79f/0x1090
[ 1133.722180][   T12]  tlb_remove_table_rcu+0x2cf/0x380
[ 1133.727388][   T12]  rcu_core+0x5a2/0x10d0
[ 1133.731646][   T12]  handle_softirqs+0x1ea/0x9b0
[ 1133.736420][   T12]  run_ksoftirqd+0x38/0x60
[ 1133.740850][   T12]  smpboot_thread_fn+0x3d3/0xaa0
[ 1133.745809][   T12]  kthread+0x370/0x450
[ 1133.749910][   T12]  ret_from_fork+0x72b/0xd50
[ 1133.754515][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1133.759295][   T12] 
[ 1133.761608][   T12] Memory state around the buggy address:
[ 1133.767225][   T12]  ffff88807a6d8600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 1133.775283][   T12]  ffff88807a6d8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1133.783343][   T12] >ffff88807a6d8700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 1133.791395][   T12]                       ^
[ 1133.795716][   T12]  ffff88807a6d8780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1133.803775][   T12]  ffff88807a6d8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 1133.811829][   T12] ==================================================================
[ 1133.832021][   T12] Oops: general protection fault, probably for non-canonical address 0xdffffdd800000011: 0000 [#1] SMP KASAN NOPTI
[ 1133.844103][   T12] KASAN: probably user-memory-access in range [0x00000ec000000088-0x00000ec00000008f]
[ 1133.853658][   T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G    B        L      syzkaller #0 PREEMPT(full) 
[ 1133.864545][   T12] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
[ 1133.870089][   T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 1133.880154][   T12] Workqueue: usbip_event event_handler
[ 1133.885642][   T12] RIP: 0010:dev_driver_string+0x10c/0x150
[ 1133.891393][   T12] Code: 88 04 00 00 48 c7 c3 00 c7 70 8c 48 85 ed 0f 84 64 ff ff ff e8 15 ba ae fb 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 84 40 ff ff ff 48 89 ef e8 72 4b 1e fc e9 33 ff ff
[ 1133.911020][   T12] RSP: 0018:ffffc90000117a70 EFLAGS: 00010217
[ 1133.917101][   T12] RAX: dffffc0000000000 RBX: ffffffff8c70c700 RCX: ffffffff81c6f9af
[ 1133.925080][   T12] RDX: 000001d800000011 RSI: ffffffff865b96ab RDI: ffff88801e6f8000
[ 1133.933059][   T12] RBP: 00000ec00000008e R08: 0000000000000007 R09: 0000000000000000
[ 1133.941039][   T12] R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: ffffc90000117ad8
[ 1133.949018][   T12] R13: ffffffff8cbc1cc0 R14: ffff888053f86700 R15: ffff88802a3f4000
[ 1133.957003][   T12] FS:  0000000000000000(0000) GS:ffff888123eda000(0000) knlGS:0000000000000000
[ 1133.965946][   T12] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1133.972540][   T12] CR2: 0000200000f72030 CR3: 000000000e994000 CR4: 0000000000350ef0
[ 1133.980520][   T12] Call Trace:
[ 1133.983797][   T12]  <TASK>
[ 1133.986728][   T12]  __dev_printk+0x7f/0x100
[ 1133.991170][   T12]  _dev_info+0xef/0x127
[ 1133.995347][   T12]  ? __pfx__dev_info+0x10/0x10
[ 1134.000133][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1134.005796][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1134.011457][   T12]  ? end_report.part.0+0x77/0x90
[ 1134.016437][   T12]  ? vhci_shutdown_connection.cold+0x143/0x37c
[ 1134.022634][   T12]  ? add_taint+0x5f/0xb0
[ 1134.026913][   T12]  vhci_shutdown_connection.cold+0x156/0x37c
[ 1134.032930][   T12]  event_handler+0x216/0x570
[ 1134.037538][   T12]  process_one_work+0xa23/0x1940
[ 1134.042492][   T12]  ? __pfx_process_one_work+0x10/0x10
[ 1134.047875][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1134.053527][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1134.059176][   T12]  worker_thread+0x5ef/0xe50
[ 1134.063786][   T12]  ? kthread+0x13a/0x450
[ 1134.068053][   T12]  ? __pfx_worker_thread+0x10/0x10
[ 1134.073178][   T12]  kthread+0x370/0x450
[ 1134.077275][   T12]  ? __pfx_kthread+0x10/0x10
[ 1134.081892][   T12]  ret_from_fork+0x72b/0xd50
[ 1134.086504][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[ 1134.091631][   T12]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 1134.097279][   T12]  ? __switch_to+0x800/0x10f0
[ 1134.101983][   T12]  ? __switch_to_asm+0x39/0x70
[ 1134.106766][   T12]  ? __pfx_kthread+0x10/0x10
[ 1134.111387][   T12]  ret_from_fork_asm+0x1a/0x30
[ 1134.116181][   T12]  </TASK>
[ 1134.119190][   T12] Modules linked in:
[ 1134.124789][   T12] ---[ end trace 0000000000000000 ]---
[ 1134.145654][   T12] RIP: 0010:dev_driver_string+0x10c/0x150
[ 1134.157247][   T12] Code: 88 04 00 00 48 c7 c3 00 c7 70 8c 48 85 ed 0f 84 64 ff ff ff e8 15 ba ae fb 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 84 40 ff ff ff 48 89 ef e8 72 4b 1e fc e9 33 ff ff
[ 1134.190342][   T12] RSP: 0018:ffffc90000117a70 EFLAGS: 00010217
[ 1134.196531][   T12] RAX: dffffc0000000000 RBX: ffffffff8c70c700 RCX: ffffffff81c6f9af
[ 1134.205648][   T12] RDX: 000001d800000011 RSI: ffffffff865b96ab RDI: ffff88801e6f8000
[ 1134.213841][   T12] RBP: 00000ec00000008e R08: 0000000000000007 R09: 0000000000000000
[ 1134.221947][   T12] R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: ffffc90000117ad8
[ 1134.229995][   T12] R13: ffffffff8cbc1cc0 R14: ffff888053f86700 R15: ffff88802a3f4000
[ 1134.242750][   T12] FS:  0000000000000000(0000) GS:ffff888123eda000(0000) knlGS:0000000000000000
[ 1134.256599][   T12] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1134.263277][   T12] CR2: 00007fe82a7ef2f8 CR3: 000000000e994000 CR4: 0000000000350ef0
[ 1134.272975][   T12] Kernel panic - not syncing: Fatal exception
[ 1134.279270][   T12] Kernel Offset: disabled
[ 1134.283584][   T12] Rebooting in 86400 seconds..