last executing test programs: 1m24.374103807s ago: executing program 0 (id=717): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000380)=""/4090, 0xffa}], 0x1, 0xa, 0x203) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES16=r3], 0x0) r4 = syz_open_dev$audion(&(0x7f00000002c0), 0x3, 0x1) write$P9_RVERSION(r4, 0x0, 0xfffffcd9) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000980), 0x200) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r5, 0xc0505405, &(0x7f0000000580)={{0x3, 0x3, 0x1, 0x1, 0x955}, 0x0, 0x40c, 0x400004}) ioctl$XFS_IOC_FD_TO_HANDLE(r2, 0xc038586a, &(0x7f0000001480)={r5, &(0x7f0000000300)='/dev/audio#\x00', 0x101000, &(0x7f0000001500)={@align, {0x9, 0xc757, 0x7}}, 0x5, &(0x7f0000001400), &(0x7f0000001440)=0x7fffffff}) write$UHID_INPUT2(r6, &(0x7f0000001540)=ANY=[@ANYBLOB="0c00000019000f6798ea939ef6f96f325ad9af88d66f9657b683f5fd469e91179e1507392aa9772c4ca08319924346bc4c02b9433b03540548918f9a0dc3e64ca357d970281b50652498e554fb9c8443c0308b6b868e67b744f3f2a00eac4107e0d7f1e4517cdc100620a4d723264d04be4a51b0827f7b4d38b96fa35d01cd31635bbf446c438e689437d9d714d7f42236408a8720da10e9714ada719ba767ecf38a884d0a1aa738894b6dd5ad3a"], 0x1f) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='net/vlan/config\x00') r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x28}, 0x1, 0x0, 0x0, 0xc090}, 0x84) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r7, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xc001012}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x204c000) preadv(r7, &(0x7f0000000040)=[{&(0x7f0000000180)=""/87, 0x57}], 0x1, 0x8000e, 0x7) 1m18.792093554s ago: executing program 0 (id=730): socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) readlink(&(0x7f0000000180)='./config/usb_gadget/g1/UDC\x00', &(0x7f00000001c0)=""/130, 0x82) listen(0xffffffffffffffff, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0xff32, 0x8fc, &(0x7f0000000480)={0xa, 0x3a, 0x9, @loopback={0xff00000000000000}, 0x2}, 0x1c) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040), 0x4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='dummy_udc.0', 0xb) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0500000040000000060000000800000000000000", @ANYRES32, @ANYBLOB="16005545000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000200"/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0xfffffffc, 0x0, r4, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) 1m16.791865175s ago: executing program 0 (id=732): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r0, &(0x7f0000007880)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000004000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000230c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) 1m15.032320136s ago: executing program 0 (id=739): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r0}, 0x4) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0xe309b000) r1 = socket$inet6(0xa, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') preadv(r1, &(0x7f00000003c0)=[{0x0}], 0x1, 0x4004f, 0x200) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) brk(0xc00000000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000}, 0x6e) tgkill(r3, r3, 0x2e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCOUTQ(r4, 0x5411, &(0x7f0000000180)) socket$nl_route(0x10, 0x3, 0x0) r6 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r7 = epoll_create(0x9) write$UHID_DESTROY(r6, &(0x7f0000000140), 0x4) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000100)={0x4}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) select(0x40, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffff2}, &(0x7f00000000c0)={0x4}, 0x0, &(0x7f0000000100)={0x7fffffffffffffff}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="e8f6ff006c00010029bd7000fcdbdf2500000000", @ANYRES32, @ANYRES16=r1], 0xe8}, 0x1, 0x0, 0x0, 0x1}, 0x0) 1m11.847615813s ago: executing program 1 (id=744): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000007880)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000004000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000230c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f00000001c0)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) 1m11.799518444s ago: executing program 0 (id=746): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f00000001c0)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000007c0)={0x0, &(0x7f0000000280)=""/135, &(0x7f0000000340), &(0x7f0000000400)="e1c265e436668db73ed71843fc09a234a96c4ba30436", 0x8629, r0}, 0x38) 1m11.622849113s ago: executing program 1 (id=749): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f00000001c0)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000007c0)={0x0, &(0x7f0000000280)=""/135, &(0x7f0000000340), &(0x7f0000000400)="e1c265e436668db73ed71843fc09a234a96c4ba30436", 0x8629, r0}, 0x38) 1m10.074015244s ago: executing program 1 (id=751): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='1\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nullb/nullb1/zone_size\x00', 0x20201, 0x12f) write(r2, &(0x7f00000001c0)='4\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0xbebc200}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount(&(0x7f0000000540)=@nullb, &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0)='zonefs\x00', 0x0, 0x0) 1m9.243545902s ago: executing program 1 (id=754): openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) read(r0, &(0x7f0000000300)=""/96, 0x60) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) setfsgid(0xee00) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000540)={0x80000000, &(0x7f0000000440), &(0x7f00000004c0)}) fsopen(&(0x7f00000002c0)='jffs2\x00', 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@multicast1, @in=@multicast2, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x192, 0xffffffffffffff3a, 0x0, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0x9, 0x0, 0x20000001f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0xfff}, 0x70bd2a, 0x3504, 0x2, 0x1}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r5 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r5, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x40047452, &(0x7f0000000380)={'wlan0\x00'}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x448d0}, 0x1000) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c000000120001000000000000000000e0000002000004000000000000000000000004d50200040014000d"], 0x3c}}, 0x0) 1m9.184940385s ago: executing program 0 (id=755): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket(0x10, 0x803, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4894}, 0x2) r5 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r4, 0x42}, 0x80, &(0x7f0000004300)=[{&(0x7f00000001c0)="27030200dc0f14000e00", 0xa}, {&(0x7f00000022c0)="d3732f3f0457e95dfb365a00a2eea9116391ce30d771e4ea54c21182c6b0d0a5fbc390d8", 0x24}], 0x2}, 0x4005) 1m7.951546972s ago: executing program 1 (id=757): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xffffffff, 0x800000088}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @loopback, 0x400014}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x317, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 1m5.513189603s ago: executing program 1 (id=762): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r2 = socket$rds(0x15, 0x5, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)={0x24, r3, 0x1, 0xffffffff, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x5, 0x5b, "12"}]}, 0x24}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r1, @ANYBLOB="05005b"], 0x24}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={0x24, r8, 0x1, 0x4000000, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x5, 0x5b, '\"'}]}, 0x24}}, 0x0) 53.756153743s ago: executing program 32 (id=755): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket(0x10, 0x803, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4894}, 0x2) r5 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r4, 0x42}, 0x80, &(0x7f0000004300)=[{&(0x7f00000001c0)="27030200dc0f14000e00", 0xa}, {&(0x7f00000022c0)="d3732f3f0457e95dfb365a00a2eea9116391ce30d771e4ea54c21182c6b0d0a5fbc390d8", 0x24}], 0x2}, 0x4005) 49.811308074s ago: executing program 33 (id=762): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r2 = socket$rds(0x15, 0x5, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)={0x24, r3, 0x1, 0xffffffff, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x5, 0x5b, "12"}]}, 0x24}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r1, @ANYBLOB="05005b"], 0x24}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={0x24, r8, 0x1, 0x4000000, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x5, 0x5b, '\"'}]}, 0x24}}, 0x0) 17.483753428s ago: executing program 2 (id=854): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket(0x2b, 0x1, 0x1) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$unix(0x1, 0x1, 0x0) listen(r0, 0x5) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) openat(0xffffffffffffff9c, 0x0, 0x2c45, 0x0) flock(0xffffffffffffffff, 0x1) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, 0x0) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, 0x0, 0x0) r8 = dup(r6) syz_ublk_setup_queues(r8, r5, &(0x7f0000000180)={0x0, 0x1, 0x10, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x1, 0x1, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00'], 0x48) 16.12762583s ago: executing program 2 (id=858): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xffffffff, 0x800000088}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @loopback, 0x400014}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc895d8eb00066c2", "c5998c867c22b401046a89606ffcf92e", "2c5be7ad", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r1, &(0x7f00000000c0)=""/3, 0x3, 0x317, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x10000008ebc, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 14.876994208s ago: executing program 5 (id=781): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000004000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000230c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f00000001c0)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000007c0)={0x0, &(0x7f0000000280)=""/135, &(0x7f0000000340), &(0x7f0000000400)="e1c265e436668db73ed71843fc09a234a96c4ba30436", 0x8629, r0}, 0x38) 12.066320877s ago: executing program 5 (id=865): socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 11.937660072s ago: executing program 2 (id=867): socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket(0x2b, 0x80801, 0x1) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r4, 0x0, r5, 0x0, 0x7ffff000, 0x6) 11.635063386s ago: executing program 5 (id=869): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r0}, 0x4) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0xe309b000) r1 = socket$inet6(0xa, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') preadv(r1, &(0x7f00000003c0)=[{0x0}], 0x1, 0x4004f, 0x200) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) brk(0xc00000000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000}, 0x6e) tgkill(r3, r3, 0x2e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCOUTQ(r4, 0x5411, &(0x7f0000000180)) socket$nl_route(0x10, 0x3, 0x0) r6 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r7 = epoll_create(0x9) write$UHID_DESTROY(r6, &(0x7f0000000140), 0x4) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000100)={0x4}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) select(0x40, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffff2}, &(0x7f00000000c0)={0x4}, 0x0, &(0x7f0000000100)={0x7fffffffffffffff}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="e8f6ff006c00010029bd7000fcdbdf2500000000", @ANYRES32, @ANYRES16=r1], 0xe8}, 0x1, 0x0, 0x0, 0x1}, 0x0) 10.674530311s ago: executing program 2 (id=870): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xffffffff, 0x800000088}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @loopback, 0x400014}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x317, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 10.400280803s ago: executing program 5 (id=871): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r3 = socket$rds(0x15, 0x5, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)={0x24, r4, 0x1, 0xffffffff, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x5, 0x5b, "12"}]}, 0x24}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r2], 0x24}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r7) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={0x24, r9, 0x1, 0x4000000, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x5, 0x5b, '\"'}]}, 0x24}}, 0x0) 8.432141423s ago: executing program 3 (id=874): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000004000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000230c00024000000000000000010900010073797a300000"], 0xc0}}, 0x0) 8.334085698s ago: executing program 3 (id=875): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x34, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x5}}}, &(0x7f0000000480)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, 0x0, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x8, 0x0, r2, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 7.602168271s ago: executing program 4 (id=876): syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x2, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x3d, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000540)={0x114, 0x14, 0x1, 0x70bd2d, 0x25dfdbfc, "", [@nested={0x103, 0x4e, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64=0x8}, @typed={0x14, 0x2001, 0x0, 0x0, @ipv6=@empty}, @generic="2a725624d55e18f54ca5798d3fe7955ef9868c011de6a6d4494d7aba163930e7a6d17e0b2db61f06be12a8fe12bf5df24b2807a60c94c81f539deb8a1f987eb7669e1395c2ce8f7c2854902221ce978006451bd593aa73c50e0dfd544fd4fa321cbe1ddd38f2dfb0cec37543dac9e03b4dc38a9d937e23023ab86a8ce5f7a6d9772d2c9b91825cd6f77be8203cbe17d83dbb0590b1ef553211edef00ead1ebbe1b58e5b323435a913a2e5ce557c4ec021c723d2022c694102308a8fb6114ab4d007089b6a2816f689a565d4e70637725b2ff73", @typed={0xc, 0xe9, 0x0, 0x0, @u64=0xd0}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x40004}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) getpid() syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(r4, 0x0, 0xd7) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) 7.602015671s ago: executing program 3 (id=877): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xffffffff, 0x800000088}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @loopback, 0x400014}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc895d8eb00066c2", "c5998c867c22b401046a89606ffcf92e", "2c5be7ad", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r1, &(0x7f00000000c0)=""/3, 0x3, 0x317, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x10000008ebc, 0x0) 7.386433932s ago: executing program 2 (id=878): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000004000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000230c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f00000001c0)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000007c0)={0x0, &(0x7f0000000280)=""/135, &(0x7f0000000340), &(0x7f0000000400)="e1c265e436668db73ed71843fc09a234a96c4ba30436", 0x8629, r0}, 0x38) 6.160192618s ago: executing program 4 (id=879): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) timer_create(0x1, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x21, 0x5, 0xd0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a010400000000000000000200000708000240000000020900010073797a31000000004c000000030a01040000000000000000020000070900010073797a31000000000900030073797a320000000014000480080001000000000308000200000000000b00070066696c746572000084000000060a01040000000000000000020000070900010073797a31000000000900020073797a320000000058000480540001800a0001006d61746368000000440002800b0001006e6661636374000008000200000000002c000300"], 0x120}}, 0x0) 5.260235599s ago: executing program 4 (id=880): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0x104, 0x4, 0x3c8, 0xe8, 0x1d0, 0x1d0, 0x2e0, 0x2e0, 0x2e0, 0x7fffffe, 0x0, {[{{@arp={@remote, @multicast2, 0x0, 0x0, 0x7, 0x0, {@mac=@link_local={0x2, 0x80, 0xc2, 0x7}}, {}, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 'bridge0\x00', 'erspan0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x100}}}, {{@arp={@rand_addr, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0xfc, {@empty, {[0xff, 0x0, 0x0, 0x0, 0x0, 0xff]}}, {@mac=@multicast, {[0xff]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'bond_slave_1\x00', 'ipvlan1\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) clock_gettime(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x40, 0x0, 0x0, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000180), 0x2004000, &(0x7f0000000300)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}, {@dfltgid}, {@cache_fscache}, {@access_client}, {@loose}, {@version_L}], [], 0x6b}}) 5.248268259s ago: executing program 5 (id=881): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000004000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000230c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f00000001c0)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000007c0)={0x0, &(0x7f0000000280)=""/135, &(0x7f0000000340), &(0x7f0000000400)="e1c265e436668db73ed71843fc09a234a96c4ba30436", 0x8629, r0}, 0x38) 5.090024487s ago: executing program 2 (id=882): bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000ccb000)={0x2, 0x4e20, @local}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum={0x2, 0x0, 0x0, 0xf}]}}, 0x0, 0x26}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x4, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x0, 0x1}, 0x48) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f0000000080)='asymmetric\x00', &(0x7f0000000280)=@secondary) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000780)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r3) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) setns(0xc9, 0x0) ioctl$KVM_SMI(r4, 0xaeb7) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) 4.458219136s ago: executing program 3 (id=883): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x42, 0x0) r4 = fanotify_init(0xef0, 0x2) fanotify_mark(r4, 0x105, 0x40009965, r3, 0x0) ioctl$NBD_CLEAR_SOCK(r3, 0xab04) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r5, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) 2.371734371s ago: executing program 6 (id=788): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) 2.370936851s ago: executing program 3 (id=893): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, 0x0, 0xc800) recvmmsg(r1, &(0x7f0000001140), 0x700, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r2, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000200)='0x5678\n', 0x7) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000000), 0x0) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0xffffffffffff8000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') 1.402284236s ago: executing program 4 (id=884): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk_0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/target/core/rd_mcp_0/ramdisk_0/control\x00', 0x1, 0x0) write(r0, &(0x7f00000005c0)='rd_pages=3', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk_0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) symlinkat(0x0, 0xffffffffffffff9c, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000840)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/nexus\x00', 0x1, 0x0) 1.299577641s ago: executing program 6 (id=885): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xffffffff, 0x800000088}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @loopback, 0x400014}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, 0x0, 0x0) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x317, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 1.114795349s ago: executing program 4 (id=886): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xffffffff, 0x800000088}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @loopback, 0x400014}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc895d8eb00066c2", "c5998c867c22b401046a89606ffcf92e", "2c5be7ad", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r1, &(0x7f00000000c0)=""/3, 0x3, 0x317, 0x0, 0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x10000008ebc, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 1.11316044s ago: executing program 3 (id=887): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xffffffff, 0x800000088}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @loopback, 0x400014}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x317, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 262.155278ms ago: executing program 6 (id=888): r0 = memfd_create(&(0x7f0000002340)='[\v\xdbX\xae[5\xa9\x90\xffc\x1f\x1a\xa9\xfd\xfa\xad\xd1md\xe7\xe2\x7f\x9b\xd5R\x10\xf3\xb6\xffT\xbf\xd1\xc8\xee\b\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%eM\xe2\xc2y1q-\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\x9fc\xda\xa9\x83r\xd8\x98\x00\xffHB\xc5F#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9r\xc3E\xf8\x92\xb7-\x0e\xcf|\x89\xc2tc\xc9d\x9eI\xbaVf\xd1fs\xd1w6\x8a\xe9_', 0x3) mkdir(0x0, 0x1fd) mount(0x0, &(0x7f0000000080)='./myproc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x40000, 0x0) write$binfmt_script(r0, &(0x7f00000005c0)={'#! ', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x204) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x9) write(r2, &(0x7f00000000c0)="240000001e005f0214f6fffffffffff80700000000000000000000000800090012000000", 0x24) io_uring_enter(r1, 0x533a, 0x8b46, 0x0, &(0x7f00000001c0)={[0xeb8f]}, 0x8) getpriority(0x0, 0x0) unshare(0x8040480) getsockopt(0xffffffffffffffff, 0x400000000000003a, 0x9, 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e20, 0x4, @loopback={0xfffffffffe5e0000}, 0x7}, 0x1c) 22.169789ms ago: executing program 4 (id=889): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r0}, 0x4) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0xe309b000) r1 = socket$inet6(0xa, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') preadv(r1, &(0x7f00000003c0)=[{0x0}], 0x1, 0x4004f, 0x200) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) brk(0xc00000000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000}, 0x6e) tgkill(r3, r3, 0x2e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCOUTQ(r4, 0x5411, &(0x7f0000000180)) socket$nl_route(0x10, 0x3, 0x0) r6 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r7 = epoll_create(0x9) write$UHID_DESTROY(r6, &(0x7f0000000140), 0x4) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000100)={0x4}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) select(0x40, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffff2}, &(0x7f00000000c0)={0x4}, 0x0, &(0x7f0000000100)={0x7fffffffffffffff}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="e8f6ff006c00010029bd7000fcdbdf2500000000", @ANYRES32, @ANYRES16=r1], 0xe8}, 0x1, 0x0, 0x0, 0x1}, 0x0) 21.548349ms ago: executing program 5 (id=900): syz_usb_connect(0x0, 0x3f, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_procfs(0x0, &(0x7f0000000100)='pagemap\x00') r3 = add_key$user(&(0x7f0000000200), &(0x7f0000000440), &(0x7f00000000c0), 0x14b, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r3, r3, r3}, 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={'streebog256\x00'}}) 0s ago: executing program 6 (id=890): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000004000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000230c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f00000001c0)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000007c0)={0x0, &(0x7f0000000280)=""/135, &(0x7f0000000340), &(0x7f0000000400)="e1c265e436668db73ed71843fc09a234a96c4ba30436", 0x8629, r0}, 0x38) kernel console output (not intermixed with test programs): ly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.303728][ T4284] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.314408][ T4284] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.329046][ T4283] device veth1_vlan entered promiscuous mode [ 69.339239][ T4279] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.347435][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 69.356356][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 69.365737][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.375282][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 69.384139][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.394854][ T4287] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.412168][ T4284] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.425599][ T4284] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.435933][ T4284] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.479854][ T4284] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.504140][ T4275] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.514187][ T4275] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.526102][ T4275] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.537413][ T4275] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.645317][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 69.663689][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 69.676739][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 69.686824][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.709413][ T4283] device veth0_macvtap entered promiscuous mode [ 69.755073][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 69.774630][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 69.783287][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.794253][ T4283] device veth1_macvtap entered promiscuous mode [ 69.820818][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 69.832966][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.841392][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.853773][ T4279] device veth0_vlan entered promiscuous mode [ 69.866160][ T4283] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.878000][ T4283] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.889535][ T4283] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.900962][ T4283] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.913280][ T4283] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.944400][ T4279] device veth1_vlan entered promiscuous mode [ 69.956435][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 69.970505][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 69.979132][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 70.003651][ T4283] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.015070][ T4290] Bluetooth: hci1: command 0x040f tx timeout [ 70.015079][ T4292] Bluetooth: hci0: command 0x040f tx timeout [ 70.023927][ T4283] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.040804][ T4283] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.053260][ T4283] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.064547][ T4283] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.082160][ T76] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.090678][ T4281] Bluetooth: hci4: command 0x040f tx timeout [ 70.090692][ T4290] Bluetooth: hci2: command 0x040f tx timeout [ 70.101460][ T76] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.103197][ T4290] Bluetooth: hci3: command 0x040f tx timeout [ 70.131311][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 70.139263][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 70.155301][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 70.163957][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 70.174591][ T4283] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.184662][ T4283] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.193737][ T4283] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.202499][ T4283] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.237805][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.246826][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.268831][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.277298][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.289127][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 70.298066][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 70.307101][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 70.315715][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 70.348749][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 70.357493][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 70.373737][ T4287] device veth0_vlan entered promiscuous mode [ 70.394353][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 70.405330][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 70.413698][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 70.423335][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 70.435258][ T4279] device veth0_macvtap entered promiscuous mode [ 70.442095][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.451119][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.472688][ T4287] device veth1_vlan entered promiscuous mode [ 70.487594][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 70.533345][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 71.389737][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.399734][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.409734][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.419732][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.429734][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.439734][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.449732][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.459737][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.469739][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.479739][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 71.938534][ T1270] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.960517][ T1270] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.987478][ T4279] device veth1_macvtap entered promiscuous mode [ 72.064538][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.073244][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.090277][ T4281] Bluetooth: hci0: command 0x0419 tx timeout [ 72.090495][ T4290] Bluetooth: hci1: command 0x0419 tx timeout [ 72.130413][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.141284][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.157569][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.170055][ T4281] Bluetooth: hci2: command 0x0419 tx timeout [ 72.170064][ T4290] Bluetooth: hci4: command 0x0419 tx timeout [ 72.174756][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.182074][ T4281] Bluetooth: hci3: command 0x0419 tx timeout [ 72.205224][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.215905][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.227713][ T4279] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.239581][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.247903][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.261761][ T4287] device veth0_macvtap entered promiscuous mode [ 72.272232][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.310590][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.318225][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.341194][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.362769][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.379917][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.390863][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.401465][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.412108][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.422852][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.442202][ T4279] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.486528][ T4287] device veth1_macvtap entered promiscuous mode [ 72.501067][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 72.515048][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 72.617646][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.646799][ T4279] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.676844][ T4279] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.731126][ T4279] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.744885][ T4279] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.471372][ T4374] loop0: detected capacity change from 0 to 256 [ 73.497506][ T4287] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.511314][ T4374] ======================================================= [ 73.511314][ T4374] WARNING: The mand mount option has been deprecated and [ 73.511314][ T4374] and is ignored by this kernel. Remove the mand [ 73.511314][ T4374] option from the mount to silence this warning. [ 73.511314][ T4374] ======================================================= [ 73.548092][ T4287] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.568365][ T4287] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.589886][ T4287] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.604353][ T4287] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.117053][ T4287] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.164779][ T4287] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.204906][ T4287] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.273918][ T4287] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.365157][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.373842][ T4307] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.384398][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.405047][ T4307] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.440963][ T4307] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.452617][ T4307] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.857238][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 74.892020][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 74.954753][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.024051][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 75.091280][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.447092][ T4384] loop1: detected capacity change from 0 to 8192 [ 75.470138][ T4386] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 75.478273][ T4287] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.501579][ T4384] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 75.540149][ T4384] REISERFS (device loop1): found reiserfs format "3.5" with non-standard journal [ 75.549866][ T4384] REISERFS (device loop1): using ordered data mode [ 75.564882][ T4287] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.569806][ T4384] reiserfs: using flush barriers [ 75.581616][ T4384] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 75.598281][ T4384] REISERFS (device loop1): checking transaction log (loop1) [ 75.601721][ T4287] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.628372][ T4287] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.638910][ T4384] REISERFS (device loop1): Using rupasov hash to sort names [ 75.652150][ T4384] REISERFS (device loop1): using 3.5.x disk format [ 75.660125][ T4391] loop0: detected capacity change from 0 to 256 [ 75.662171][ T4287] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.684821][ T4384] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 75.697351][ T4384] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 75.708815][ T4287] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.718870][ T4287] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.731280][ T4384] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 75.743872][ T4287] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.770191][ T4384] REISERFS warning (device loop1): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2) [ 75.795620][ T4287] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.809922][ T4287] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.818634][ T4287] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.842469][ T4384] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 75.880350][ T4287] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.889071][ T4287] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.916523][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 75.961510][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 75.998689][ T4384] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 76.021910][ T4384] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 76.133956][ T4393] loop0: detected capacity change from 0 to 1024 [ 76.194451][ T4307] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.424787][ T4307] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.778043][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 78.988688][ T4303] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.988706][ T4303] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.989014][ T4303] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 79.013858][ T4418] tty tty2: ldisc open failed (-12), clearing slot 1 [ 80.756878][ T4439] netlink: 36 bytes leftover after parsing attributes in process `syz.2.20'. [ 81.374437][ T1172] cfg80211: failed to load regulatory.db [ 81.606221][ T22] libceph: connect (1)[c::]:6789 error -101 [ 81.676251][ T22] libceph: mon0 (1)[c::]:6789 connect error [ 81.799287][ T22] libceph: connect (1)[c::]:6789 error -101 [ 81.849927][ T22] libceph: mon0 (1)[c::]:6789 connect error [ 82.006782][ T4441] ceph: No mds server is up or the cluster is laggy [ 82.429266][ T4325] libceph: connect (1)[c::]:6789 error -101 [ 82.457474][ T4325] libceph: mon0 (1)[c::]:6789 connect error [ 82.713350][ T4431] loop0: detected capacity change from 0 to 32768 [ 82.820721][ T4431] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.19 (4431) [ 82.971201][ T4431] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 83.029954][ T4431] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 83.049008][ T4431] BTRFS info (device loop0): using free space tree [ 83.090867][ T4455] loop3: detected capacity change from 0 to 512 [ 83.144049][ T4455] EXT4-fs: Ignoring removed i_version option [ 83.150855][ T26] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 83.176239][ T4433] loop4: detected capacity change from 0 to 40427 [ 83.467960][ T4455] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 83.480471][ T26] usb 3-1: Using ep0 maxpacket: 32 [ 83.559761][ T26] usb 3-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 83.737106][ T26] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.755057][ T4455] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 83.807513][ T4431] BTRFS error (device loop0): open_ctree failed: -12 [ 83.895007][ T26] usb 3-1: Product: syz [ 83.972169][ T26] usb 3-1: Manufacturer: syz [ 84.012456][ T4455] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 84.022292][ T26] usb 3-1: SerialNumber: syz [ 84.032754][ T4376] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by udevd (4376) [ 84.035007][ T26] usb 3-1: config 0 descriptor?? [ 84.050138][ T4455] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 84.055899][ T26] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 84.068637][ T26] dvb-usb: bulk message failed: -22 (4/0) [ 84.075302][ T26] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 84.087058][ T26] dvb-usb: bulk message failed: -22 (5/0) [ 84.093075][ T26] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 84.117951][ T26] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 84.149193][ T26] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 84.157818][ T26] usb 3-1: media controller created [ 84.184225][ T26] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 84.229936][ T26] usb 3-1: selecting invalid altsetting 3 [ 84.245880][ T26] ttusb2: set interface to alts=3 failed [ 84.412036][ T4283] EXT4-fs (loop3): unmounting filesystem. [ 84.430693][ T4486] Zero length message leads to an empty skb [ 84.503809][ T4491] loop1: detected capacity change from 0 to 1024 [ 84.743200][ T26] DVB: Unable to find symbol tda10086_attach() [ 84.749901][ T26] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 84.766237][ T26] dvb-usb: bulk message failed: -22 (4/0) [ 84.772073][ T26] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 84.795279][ T26] dvb-usb: bulk message failed: -22 (5/0) [ 84.829760][ T26] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 85.531936][ T4501] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 86.067307][ T26] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 86.185800][ T26] usb 3-1: USB disconnect, device number 2 [ 87.370662][ T26] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 88.783978][ T4526] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 89.377456][ T4533] process 'syz.0.37' launched './file2/../file0/file0' with NULL argv: empty string added [ 89.899820][ T4533] netlink: 8 bytes leftover after parsing attributes in process `syz.0.37'. [ 90.482035][ T4529] sched: RT throttling activated [ 90.892593][ T4544] sg_write: data in/out 548864/136 bytes for SCSI command 0x0-- guessing data in; [ 90.892593][ T4544] program syz.4.38 not setting count and/or reply_len properly [ 91.033363][ T4543] loop3: detected capacity change from 0 to 512 [ 91.642351][ T4543] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 91.660155][ T4543] ext4 filesystem being mounted at /6/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 91.709486][ T4543] EXT4-fs error (device loop3): ext4_xattr_block_find:1828: inode #12: comm syz.3.40: corrupted xattr block 6 [ 92.181645][ T4283] EXT4-fs (loop3): unmounting filesystem. [ 94.414938][ T4569] loop1: detected capacity change from 0 to 256 [ 95.624153][ T7] logitech-hidpp-device 0005:046D:B012.0001: Device not connected [ 97.200614][ T4588] loop4: detected capacity change from 0 to 512 [ 97.241826][ T4588] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 97.923056][ T4594] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 98.418563][ T4588] EXT4-fs (loop4): orphan cleanup on readonly fs [ 98.458552][ T4588] Quota error (device loop4): find_block_dqentry: Quota for id 0 referenced but not present [ 98.486801][ T4588] Quota error (device loop4): qtree_read_dquot: Can't read quota structure for id 0 [ 98.497148][ T4484] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 98.561049][ T4588] EXT4-fs error (device loop4): ext4_acquire_dquot:6841: comm syz.4.55: Failed to acquire dquot type 1 [ 98.599962][ T4588] EXT4-fs (loop4): Remounting filesystem read-only [ 98.618962][ T4588] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.55: bg 0: block 40: padding at end of block bitmap is not set [ 98.652619][ T4588] EXT4-fs (loop4): Remounting filesystem read-only [ 98.659156][ T4588] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 98.697887][ T4588] EXT4-fs (loop4): Remounting filesystem read-only [ 98.710603][ T4588] EXT4-fs (loop4): 1 truncate cleaned up [ 98.720499][ T4588] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 98.789773][ T4484] usb 2-1: Using ep0 maxpacket: 8 [ 98.797398][ T4484] usb 2-1: config 0 has an invalid interface number: 143 but max is 0 [ 98.836412][ T4484] usb 2-1: config 0 has no interface number 0 [ 98.857542][ T4287] EXT4-fs (loop4): unmounting filesystem. [ 98.873343][ T4484] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 98.892678][ T4484] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.933108][ T4484] usb 2-1: config 0 descriptor?? [ 99.082195][ T4484] viperboard 2-1:0.143: version 0.00 found at bus 002 address 002 [ 99.140998][ T4484] viperboard-i2c viperboard-i2c.2.auto: failure setting i2c_bus_freq to 100 [ 99.190607][ T4484] viperboard-i2c: probe of viperboard-i2c.2.auto failed with error -5 [ 99.286973][ T4604] loop2: detected capacity change from 0 to 256 [ 99.747195][ T4612] loop4: detected capacity change from 0 to 4096 [ 99.866798][ T4338] usb 2-1: USB disconnect, device number 2 [ 101.574688][ T4618] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input5 [ 103.640862][ T4625] sctp: failed to load transform for md5: -2 [ 105.371024][ T4659] FAULT_INJECTION: forcing a failure. [ 105.371024][ T4659] name failslab, interval 1, probability 0, space 0, times 1 [ 105.383769][ T4659] CPU: 0 PID: 4659 Comm: syz.0.69 Not tainted syzkaller #0 [ 105.390989][ T4659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 105.401071][ T4659] Call Trace: [ 105.404361][ T4659] [ 105.407300][ T4659] dump_stack_lvl+0x188/0x24e [ 105.412024][ T4659] ? show_regs_print_info+0x12/0x12 [ 105.417254][ T4659] ? load_image+0x410/0x410 [ 105.421782][ T4659] ? __might_sleep+0xd0/0xd0 [ 105.426388][ T4659] ? __lock_acquire+0x7c40/0x7c40 [ 105.431441][ T4659] should_fail_ex+0x390/0x4c0 [ 105.436150][ T4659] should_failslab+0x5/0x20 [ 105.440680][ T4659] slab_pre_alloc_hook+0x59/0x300 [ 105.445720][ T4659] kmem_cache_alloc_lru+0x49/0x2e0 [ 105.450829][ T4659] ? __d_alloc+0x2e/0x6e0 [ 105.455169][ T4659] __d_alloc+0x2e/0x6e0 [ 105.459317][ T4659] ? d_alloc_pseudo+0xe/0x70 [ 105.463901][ T4659] d_alloc_pseudo+0x19/0x70 [ 105.468395][ T4659] alloc_file_pseudo+0xe0/0x200 [ 105.473248][ T4659] ? alloc_empty_file_noaccount+0x80/0x80 [ 105.478966][ T4659] ? anon_inode_make_secure_inode+0xf7/0x160 [ 105.484944][ T4659] ? do_compat_epoll_pwait+0x1c0/0x1c0 [ 105.490399][ T4659] ? _raw_spin_unlock+0x24/0x40 [ 105.495256][ T4659] __se_sys_memfd_secret+0x125/0x2f0 [ 105.500543][ T4659] do_syscall_64+0x4c/0xa0 [ 105.504962][ T4659] ? clear_bhb_loop+0x60/0xb0 [ 105.509639][ T4659] ? clear_bhb_loop+0x60/0xb0 [ 105.514319][ T4659] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 105.520213][ T4659] RIP: 0033:0x7fa61339e159 [ 105.524637][ T4659] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.544244][ T4659] RSP: 002b:00007fa61420a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf [ 105.552650][ T4659] RAX: ffffffffffffffda RBX: 00007fa613625fa0 RCX: 00007fa61339e159 [ 105.560616][ T4659] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 105.568575][ T4659] RBP: 00007fa61343503b R08: 0000000000000000 R09: 0000000000000000 [ 105.576536][ T4659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.584496][ T4659] R13: 00007fa613626038 R14: 00007fa613625fa0 R15: 00007ffd8be91d08 [ 105.592469][ T4659] [ 105.654610][ T4659] overlayfs: unrecognized mount option "++-[&*'þ%*})" or missing value [ 108.623190][ T4670] loop1: detected capacity change from 0 to 256 [ 108.724086][ T4670] exfat: Deprecated parameter 'utf8' [ 108.802354][ T4670] exfat: Deprecated parameter 'utf8' [ 108.869367][ T4670] exfat: Deprecated parameter 'utf8' [ 108.964329][ T4670] exfat: Deprecated parameter 'namecase' [ 109.206818][ T4670] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 111.681079][ T4685] gadgetfs: bound to dummy_udc driver [ 112.576505][ T4691] loop3: detected capacity change from 0 to 512 [ 112.583317][ T4691] EXT4-fs: Invalid want_extra_isize 7 [ 116.910207][ T4696] device dummy0 entered promiscuous mode [ 117.925994][ T4706] loop4: detected capacity change from 0 to 32768 [ 117.961943][ T4706] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop4 scanned by syz.4.81 (4706) [ 118.149177][ T4706] BTRFS info (device loop4): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 118.205679][ T4706] BTRFS info (device loop4): using blake2b (blake2b-256-generic) checksum algorithm [ 118.350327][ T4706] BTRFS info (device loop4): enabling auto defrag [ 118.350476][ T4706] BTRFS info (device loop4): ignoring bad roots [ 118.350578][ T4706] BTRFS info (device loop4): enabling ssd optimizations [ 118.350608][ T4706] BTRFS info (device loop4): using spread ssd allocation scheme [ 118.350639][ T4706] BTRFS info (device loop4): using free space tree [ 118.350763][ T4706] workqueue: max_active 2097158 requested for btrfs-worker is out of range, clamping between 1 and 512 [ 118.464049][ T4706] workqueue: max_active 2097158 requested for btrfs-worker-high is out of range, clamping between 1 and 512 [ 118.477736][ T4706] workqueue: max_active 2097158 requested for btrfs-delalloc is out of range, clamping between 1 and 512 [ 118.586865][ T4706] workqueue: max_active 2097158 requested for btrfs-endio is out of range, clamping between 1 and 512 [ 118.633859][ T4706] workqueue: max_active 2097158 requested for btrfs-endio-meta is out of range, clamping between 1 and 512 [ 118.878014][ T4706] workqueue: max_active 2097158 requested for btrfs-endio-raid56 is out of range, clamping between 1 and 512 [ 118.995891][ T4731] loop1: detected capacity change from 0 to 256 [ 119.078930][ T4706] workqueue: max_active 2097158 requested for btrfs-rmw is out of range, clamping between 1 and 512 [ 119.290763][ T4706] workqueue: max_active 2097158 requested for btrfs-endio-write is out of range, clamping between 1 and 512 [ 119.343904][ T4731] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001207b, chksum : 0x1e8dde4d, utbl_chksum : 0xe619d30d) [ 119.492199][ T4706] workqueue: max_active 2097158 requested for btrfs-compressed-write is out of range, clamping between 1 and 512 [ 119.686648][ T4740] loop2: detected capacity change from 0 to 4096 [ 119.970106][ T4287] BTRFS info (device loop4): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 120.075367][ T4740] ntfs: volume version 3.1. [ 120.194652][ T4749] device syzkaller0 entered promiscuous mode [ 122.606463][ T4771] random: crng reseeded on system resumption [ 123.519969][ T4774] syz.0.92 (4774) used greatest stack depth: 17712 bytes left [ 125.015818][ T4790] netlink: 4 bytes leftover after parsing attributes in process `syz.4.87'. [ 125.475860][ T4779] Bluetooth: MGMT ver 1.22 [ 125.597312][ T4794] loop3: detected capacity change from 0 to 256 [ 125.653484][ T4794] exfat: Deprecated parameter 'namecase' [ 125.736369][ T4794] exfat: Deprecated parameter 'namecase' [ 125.809201][ T4794] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 126.252323][ T4799] loop1: detected capacity change from 0 to 164 [ 128.990746][ T4805] loop1: detected capacity change from 0 to 2048 [ 129.175870][ T4805] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 129.263290][ T4816] loop2: detected capacity change from 0 to 512 [ 129.406060][ T4816] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 129.432785][ T4820] loop4: detected capacity change from 0 to 164 [ 129.459906][ T4816] FAT-fs (loop2): Filesystem has been set read-only [ 130.259651][ T4828] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 130.276356][ T4828] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 130.285364][ T4828] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 133.375842][ T1270] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.390390][ T1270] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.869830][ T4842] loop4: detected capacity change from 0 to 32768 [ 134.950863][ T4842] XFS (loop4): Mounting V5 Filesystem [ 135.222582][ T4842] XFS (loop4): Ending clean mount [ 135.326817][ T4869] FAULT_INJECTION: forcing a failure. [ 135.326817][ T4869] name fail_futex, interval 1, probability 0, space 0, times 1 [ 135.342120][ T4842] XFS (loop4): Unmounting Filesystem [ 135.372937][ T4869] CPU: 1 PID: 4869 Comm: syz.1.120 Not tainted syzkaller #0 [ 135.380256][ T4869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 135.390323][ T4869] Call Trace: [ 135.393595][ T4869] [ 135.396517][ T4869] dump_stack_lvl+0x188/0x24e [ 135.401212][ T4869] ? show_regs_print_info+0x12/0x12 [ 135.406411][ T4869] ? load_image+0x410/0x410 [ 135.410911][ T4869] ? cgroup_rstat_updated+0xce/0x350 [ 135.416194][ T4869] ? rcu_read_lock_sched_held+0x86/0x110 [ 135.421826][ T4869] should_fail_ex+0x390/0x4c0 [ 135.426516][ T4869] get_futex_key+0x1b1/0x1000 [ 135.431207][ T4869] ? futex_setup_timer+0xc0/0xc0 [ 135.436146][ T4869] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 135.442124][ T4869] ? __lock_acquire+0x7c40/0x7c40 [ 135.447145][ T4869] ? lock_chain_count+0x20/0x20 [ 135.451997][ T4869] futex_wait_setup+0xb8/0x270 [ 135.456755][ T4869] ? futex_wait_multiple+0x920/0x920 [ 135.462034][ T4869] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 135.467925][ T4869] ? _raw_spin_unlock+0x40/0x40 [ 135.472773][ T4869] futex_wait+0x1b8/0x5c0 [ 135.477100][ T4869] ? futex_wait_setup+0x270/0x270 [ 135.482135][ T4869] do_futex+0x310/0x320 [ 135.486284][ T4869] ? __ia32_sys_get_robust_list+0x100/0x100 [ 135.492166][ T4869] ? __lock_acquire+0x7c40/0x7c40 [ 135.497192][ T4869] __se_sys_futex+0x381/0x410 [ 135.501868][ T4869] ? __x64_sys_futex+0xf0/0xf0 [ 135.506626][ T4869] ? __x64_sys_futex+0x1d/0xf0 [ 135.511385][ T4869] do_syscall_64+0x4c/0xa0 [ 135.515798][ T4869] ? clear_bhb_loop+0x60/0xb0 [ 135.520469][ T4869] ? clear_bhb_loop+0x60/0xb0 [ 135.525148][ T4869] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 135.531044][ T4869] RIP: 0033:0x7f014239e159 [ 135.535458][ T4869] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.555063][ T4869] RSP: 002b:00007f014328d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 135.563475][ T4869] RAX: ffffffffffffffda RBX: 00007f0142625fa8 RCX: 00007f014239e159 [ 135.571437][ T4869] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0142625fa8 [ 135.579397][ T4869] RBP: 00007f0142625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 135.587357][ T4869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.595321][ T4869] R13: 00007f0142626038 R14: 00007ffe640ca470 R15: 00007ffe640ca558 [ 135.603297][ T4869] [ 135.895491][ T4874] ceph: No mds server is up or the cluster is laggy [ 135.905849][ T4483] libceph: connect (1)[c::]:6789 error -101 [ 135.926110][ T4483] libceph: mon0 (1)[c::]:6789 connect error [ 139.483833][ T4887] loop4: detected capacity change from 0 to 16 [ 139.507054][ T4887] erofs: (device loop4): mounted with root inode @ nid 36. [ 142.007360][ T4911] loop4: detected capacity change from 0 to 1024 [ 149.876730][ T4980] loop3: detected capacity change from 0 to 4096 [ 149.925725][ T4980] ntfs: (device loop3): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 149.979557][ T4980] ntfs: (device loop3): read_ntfs_boot_sector(): Hot-fix: Recovering invalid primary boot sector from backup copy. [ 149.995536][ T4980] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 150.004566][ T4980] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 150.025443][ T4980] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 150.034361][ T4980] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 150.054885][ T4980] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 150.066916][ T4980] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 150.129352][ T4980] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 150.160744][ T4980] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 150.186683][ T4978] netlink: 'syz.1.145': attribute type 2 has an invalid length. [ 150.243160][ T4980] ntfs: volume version 3.1. [ 150.263191][ T4989] af_packet: tpacket_rcv: packet too big, clamped from 110 to 4294967272. macoff=96 [ 151.690635][ T5027] loop3: detected capacity change from 0 to 128 [ 151.877284][ T5027] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 152.017627][ T5027] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 152.445562][ T5041] loop3: detected capacity change from 0 to 2048 [ 152.645040][ T5041] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 153.155156][ T5041] EXT4-fs (loop3): shut down requested (2) [ 153.478413][ T4283] EXT4-fs (loop3): unmounting filesystem. [ 153.637326][ T5042] loop4: detected capacity change from 0 to 32768 [ 153.676685][ T5042] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 153.689473][ T5042] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 153.702521][ T5042] BTRFS info (device loop4): using free space tree [ 153.739874][ T4484] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 153.899620][ T5042] BTRFS info (device loop4): enabling ssd optimizations [ 153.921517][ T4484] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 153.994018][ T4484] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 154.051053][ T4484] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 154.130483][ T4484] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 154.139561][ T4484] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 154.182179][ T4484] usb 3-1: Product: syz [ 154.189935][ T4484] usb 3-1: Manufacturer: syz [ 154.225628][ T5057] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 154.307995][ T4287] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 154.403721][ T4484] garmin_gps 3-1:1.0: Garmin GPS usb/tty converter detected [ 154.425410][ T4484] usb 3-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 155.160251][ T4752] usb 3-1: USB disconnect, device number 3 [ 155.294563][ T4752] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 155.330648][ T4752] garmin_gps 3-1:1.0: device disconnected [ 155.645422][ T5118] loop3: detected capacity change from 0 to 1024 [ 155.839849][ T4483] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 155.968157][ T26] kernel write not supported for file bpf-prog (pid: 26 comm: kworker/1:1) [ 156.029891][ T4483] usb 2-1: Using ep0 maxpacket: 8 [ 156.037579][ T4483] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 156.072816][ T4483] usb 2-1: config 179 has no interface number 0 [ 156.087001][ T4483] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 156.098748][ T4483] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 156.115494][ T4483] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 156.133591][ T4483] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 156.158545][ T4483] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 156.177244][ T4483] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 156.186583][ T4483] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.207736][ T5112] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 156.315151][ T5143] FAULT_INJECTION: forcing a failure. [ 156.315151][ T5143] name failslab, interval 1, probability 0, space 0, times 0 [ 157.490726][ T5143] CPU: 0 PID: 5143 Comm: syz.3.197 Not tainted syzkaller #0 [ 157.498052][ T5143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 157.508106][ T5143] Call Trace: [ 157.511381][ T5143] [ 157.514310][ T5143] dump_stack_lvl+0x188/0x24e [ 157.519000][ T5143] ? show_regs_print_info+0x12/0x12 [ 157.524202][ T5143] ? load_image+0x410/0x410 [ 157.528702][ T5143] ? __might_sleep+0xd0/0xd0 [ 157.533284][ T5143] ? __lock_acquire+0x7c40/0x7c40 [ 157.538316][ T5143] ? lockdep_init_map_type+0x98/0x8d0 [ 157.543687][ T5143] should_fail_ex+0x390/0x4c0 [ 157.548366][ T5143] should_failslab+0x5/0x20 [ 157.552861][ T5143] slab_pre_alloc_hook+0x59/0x300 [ 157.557882][ T5143] ? io_ring_ctx_alloc+0x279/0xc85 [ 157.562992][ T5143] __kmem_cache_alloc_node+0x4f/0x270 [ 157.568359][ T5143] ? io_ring_ctx_alloc+0x279/0xc85 [ 157.573468][ T5143] kmalloc_trace+0x26/0xe0 [ 157.577889][ T5143] io_ring_ctx_alloc+0x279/0xc85 [ 157.582823][ T5143] io_uring_create+0x29f/0xd6c [ 157.587582][ T5143] ? __might_fault+0xc2/0x120 [ 157.592250][ T5143] ? __might_fault+0xa6/0x120 [ 157.596925][ T5143] __x64_sys_io_uring_setup+0x21b/0x230 [ 157.602476][ T5143] ? __ia32_sys_io_uring_enter+0xf0/0xf0 [ 157.608120][ T5143] ? lockdep_hardirqs_on+0x94/0x140 [ 157.613314][ T5143] do_syscall_64+0x4c/0xa0 [ 157.617728][ T5143] ? clear_bhb_loop+0x60/0xb0 [ 157.622405][ T5143] ? clear_bhb_loop+0x60/0xb0 [ 157.627084][ T5143] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 157.632974][ T5143] RIP: 0033:0x7f8d8019e159 [ 157.637382][ T5143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 157.656982][ T5143] RSP: 002b:00007f8d8101ffb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 157.665392][ T5143] RAX: ffffffffffffffda RBX: 00002000000000c0 RCX: 00007f8d8019e159 [ 157.673362][ T5143] RDX: 0000200000000640 RSI: 00002000000000c0 RDI: 0000000000000025 [ 157.681324][ T5143] RBP: 00007f8d8023503b R08: 0000000000000000 R09: 0000000000000000 [ 157.689291][ T5143] R10: 0000200000000000 R11: 0000000000000206 R12: 0000200000000640 [ 157.697254][ T5143] R13: 0000200000000000 R14: 0000200000000000 R15: 00007ffc9d3dace8 [ 157.705235][ T5143] [ 157.774024][ T4483] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input6 [ 159.094742][ T4338] usb 2-1: USB disconnect, device number 3 [ 159.100701][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 159.100767][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 159.122246][ T4338] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 159.177109][ T5159] loop3: detected capacity change from 0 to 2048 [ 159.216939][ T5159] UDF-fs: error (device loop3): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 159.254383][ T5159] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 159.590831][ T5169] loop4: detected capacity change from 0 to 512 [ 159.749403][ T5169] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 159.760693][ T5169] ext4 filesystem being mounted at /41/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 159.798578][ T5178] FAULT_INJECTION: forcing a failure. [ 159.798578][ T5178] name failslab, interval 1, probability 0, space 0, times 0 [ 159.838811][ T4338] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 159.874913][ T4338] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 159.900581][ T5178] CPU: 1 PID: 5178 Comm: syz.1.208 Not tainted syzkaller #0 [ 159.907906][ T5178] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 159.917978][ T5178] Call Trace: [ 159.921271][ T5178] [ 159.924209][ T5178] dump_stack_lvl+0x188/0x24e [ 159.928913][ T5178] ? show_regs_print_info+0x12/0x12 [ 159.934150][ T5178] ? load_image+0x410/0x410 [ 159.938676][ T5178] ? __might_sleep+0xd0/0xd0 [ 159.943280][ T5178] ? __lock_acquire+0x7c40/0x7c40 [ 159.948334][ T5178] should_fail_ex+0x390/0x4c0 [ 159.953039][ T5178] should_failslab+0x5/0x20 [ 159.957552][ T5178] slab_pre_alloc_hook+0x59/0x300 [ 159.962596][ T5178] ? __virt_addr_valid+0x188/0x540 [ 159.967735][ T5178] ? __se_sys_mount+0x157/0x3d0 [ 159.972610][ T5178] __kmem_cache_alloc_node+0x4f/0x270 [ 159.978007][ T5178] ? __se_sys_mount+0x157/0x3d0 [ 159.982885][ T5178] kmalloc_trace+0x26/0xe0 [ 159.987331][ T5178] __se_sys_mount+0x157/0x3d0 [ 159.992032][ T5178] ? __x64_sys_mount+0xc0/0xc0 [ 159.996818][ T5178] ? lockdep_hardirqs_on+0x94/0x140 [ 160.002035][ T5178] ? __x64_sys_mount+0x1c/0xc0 [ 160.006819][ T5178] do_syscall_64+0x4c/0xa0 [ 160.011259][ T5178] ? clear_bhb_loop+0x60/0xb0 [ 160.015957][ T5178] ? clear_bhb_loop+0x60/0xb0 [ 160.020642][ T5178] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 160.026532][ T5178] RIP: 0033:0x7f014239e159 [ 160.030941][ T5178] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 160.050539][ T5178] RSP: 002b:00007f014328d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 160.058948][ T5178] RAX: ffffffffffffffda RBX: 00007f0142625fa0 RCX: 00007f014239e159 [ 160.066916][ T5178] RDX: 0000200000000180 RSI: 0000000000000000 RDI: 0000200000000040 [ 160.074882][ T5178] RBP: 00007f014243503b R08: 00002000000001c0 R09: 0000000000000000 [ 160.082848][ T5178] R10: 0000000000010010 R11: 0000000000000246 R12: 0000000000000000 [ 160.090811][ T5178] R13: 00007f0142626038 R14: 00007f0142625fa0 R15: 00007ffe640ca558 [ 160.098787][ T5178] [ 160.114916][ T4287] EXT4-fs (loop4): unmounting filesystem. [ 163.347929][ T5209] loop2: detected capacity change from 0 to 2048 [ 163.479487][ T5209] UDF-fs: error (device loop2): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 163.524089][ T5209] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 163.968842][ T5230] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 164.204459][ T5230] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 164.338061][ T5230] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 164.535100][ T5230] device bridge_slave_0 left promiscuous mode [ 164.635332][ T5230] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.649241][ T5230] device bridge_slave_1 left promiscuous mode [ 164.657897][ T5230] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.668975][ T5230] bond0: (slave bond_slave_0): Releasing backup interface [ 164.705773][ T5230] bond0: (slave bond_slave_1): Releasing backup interface [ 164.827515][ T5230] team0: Port device team_slave_0 removed [ 164.841872][ T5230] team0: Port device team_slave_1 removed [ 164.882545][ T5230] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 164.904531][ T5230] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 164.905526][ T5253] program syz.2.225 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 164.924702][ T5230] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 164.936407][ T5230] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 166.648279][ T5288] loop2: detected capacity change from 0 to 8192 [ 166.685488][ T5293] device syzkaller0 entered promiscuous mode [ 166.817499][ T5298] overlayfs: failed to set xattr on upper [ 166.817503][ T5297] 9pnet_fd: Insufficient options for proto=fd [ 166.835849][ T5298] overlayfs: ...falling back to index=off,metacopy=off. [ 167.029335][ T5307] FAULT_INJECTION: forcing a failure. [ 167.029335][ T5307] name failslab, interval 1, probability 0, space 0, times 0 [ 167.042977][ T5307] CPU: 1 PID: 5307 Comm: syz.2.244 Not tainted syzkaller #0 [ 167.050292][ T5307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 167.060345][ T5307] Call Trace: [ 167.063617][ T5307] [ 167.066541][ T5307] dump_stack_lvl+0x188/0x24e [ 167.071233][ T5307] ? show_regs_print_info+0x12/0x12 [ 167.076434][ T5307] ? load_image+0x410/0x410 [ 167.080939][ T5307] ? __might_sleep+0xd0/0xd0 [ 167.085523][ T5307] ? __lock_acquire+0x7c40/0x7c40 [ 167.090547][ T5307] should_fail_ex+0x390/0x4c0 [ 167.095226][ T5307] should_failslab+0x5/0x20 [ 167.099726][ T5307] slab_pre_alloc_hook+0x59/0x300 [ 167.104747][ T5307] ? ramfs_init_fs_context+0x4b/0xe0 [ 167.110028][ T5307] __kmem_cache_alloc_node+0x4f/0x270 [ 167.115399][ T5307] ? ramfs_init_fs_context+0x4b/0xe0 [ 167.120682][ T5307] kmalloc_trace+0x26/0xe0 [ 167.125106][ T5307] ramfs_init_fs_context+0x4b/0xe0 [ 167.130213][ T5307] alloc_fs_context+0x628/0x7d0 [ 167.135064][ T5307] __se_sys_fsopen+0xa0/0x2c0 [ 167.139742][ T5307] do_syscall_64+0x4c/0xa0 [ 167.144158][ T5307] ? clear_bhb_loop+0x60/0xb0 [ 167.148836][ T5307] ? clear_bhb_loop+0x60/0xb0 [ 167.153522][ T5307] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 167.159413][ T5307] RIP: 0033:0x7f4ac0d9e159 [ 167.163821][ T5307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 167.183422][ T5307] RSP: 002b:00007f4ac1c30028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 167.191832][ T5307] RAX: ffffffffffffffda RBX: 00007f4ac1025fa0 RCX: 00007f4ac0d9e159 [ 167.199801][ T5307] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000240 [ 167.207760][ T5307] RBP: 00007f4ac0e3503b R08: 0000000000000000 R09: 0000000000000000 [ 167.215721][ T5307] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 167.223683][ T5307] R13: 00007f4ac1026038 R14: 00007f4ac1025fa0 R15: 00007ffd4151ba88 [ 167.231658][ T5307] [ 167.252356][ T5306] loop4: detected capacity change from 0 to 2048 [ 167.343092][ T5306] loop4: p2 p3 < > p4 < p5 > [ 167.390658][ T5306] loop4: partition table partially beyond EOD, truncated [ 167.430093][ T5306] loop4: p3 start 4284289 is beyond EOD, truncated [ 167.437933][ T5313] loop2: detected capacity change from 0 to 512 [ 167.680839][ T5313] EXT4-fs (loop2): Test dummy encryption mode enabled [ 167.680839][ T5321] loop4: detected capacity change from 0 to 128 [ 167.712001][ T5313] EXT4-fs error (device loop2): ext4_orphan_get:1409: inode #11: comm syz.2.247: casefold flag without casefold feature [ 167.712870][ T5321] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 167.725026][ T5313] EXT4-fs error (device loop2): ext4_orphan_get:1414: comm syz.2.247: couldn't read orphan inode 11 (err -117) [ 167.751443][ T5313] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 167.764849][ T5321] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 167.775692][ T5321] ext2 filesystem being mounted at /47/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 167.803238][ T27] kauditd_printk_skb: 9 callbacks suppressed [ 167.803250][ T27] audit: type=1800 audit(1789144418.317:2): pid=5313 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.247" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 167.906413][ T4287] EXT4-fs (loop4): unmounting filesystem. [ 167.952935][ T4279] EXT4-fs (loop2): unmounting filesystem. [ 168.053093][ T5332] FAULT_INJECTION: forcing a failure. [ 168.053093][ T5332] name failslab, interval 1, probability 0, space 0, times 0 [ 168.066158][ T5332] CPU: 0 PID: 5332 Comm: syz.4.252 Not tainted syzkaller #0 [ 168.073476][ T5332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 168.083531][ T5332] Call Trace: [ 168.086809][ T5332] [ 168.089743][ T5332] dump_stack_lvl+0x188/0x24e [ 168.094451][ T5332] ? show_regs_print_info+0x12/0x12 [ 168.099659][ T5332] ? load_image+0x410/0x410 [ 168.104168][ T5332] ? __might_sleep+0xd0/0xd0 [ 168.108754][ T5332] ? __lock_acquire+0x7c40/0x7c40 [ 168.113784][ T5332] should_fail_ex+0x390/0x4c0 [ 168.118465][ T5332] should_failslab+0x5/0x20 [ 168.122962][ T5332] slab_pre_alloc_hook+0x59/0x300 [ 168.127981][ T5332] ? __lock_acquire+0x7c40/0x7c40 [ 168.133007][ T5332] ? security_prepare_creds+0x47/0x130 [ 168.138465][ T5332] __kmem_cache_alloc_node+0x4f/0x270 [ 168.143842][ T5332] ? security_prepare_creds+0x47/0x130 [ 168.149296][ T5332] __kmalloc+0xa3/0x240 [ 168.153461][ T5332] security_prepare_creds+0x47/0x130 [ 168.158748][ T5332] prepare_creds+0x450/0x610 [ 168.163339][ T5332] __se_sys_capset+0x35f/0x780 [ 168.168107][ T5332] ? __x64_sys_capset+0x60/0x60 [ 168.172956][ T5332] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 168.178936][ T5332] ? lock_chain_count+0x20/0x20 [ 168.183788][ T5332] ? lockdep_hardirqs_on+0x94/0x140 [ 168.188984][ T5332] do_syscall_64+0x4c/0xa0 [ 168.193400][ T5332] ? clear_bhb_loop+0x60/0xb0 [ 168.198078][ T5332] ? clear_bhb_loop+0x60/0xb0 [ 168.202754][ T5332] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 168.208647][ T5332] RIP: 0033:0x7f05d4b9e159 [ 168.213058][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.232657][ T5332] RSP: 002b:00007f05d5a41028 EFLAGS: 00000246 ORIG_RAX: 000000000000007e [ 168.241069][ T5332] RAX: ffffffffffffffda RBX: 00007f05d4e25fa0 RCX: 00007f05d4b9e159 [ 168.249036][ T5332] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000040 [ 168.256999][ T5332] RBP: 00007f05d4c3503b R08: 0000000000000000 R09: 0000000000000000 [ 168.264964][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 168.272933][ T5332] R13: 00007f05d4e26038 R14: 00007f05d4e25fa0 R15: 00007ffc61187de8 [ 168.280910][ T5332] [ 168.661006][ T4281] Bluetooth: hci5: command 0x1003 tx timeout [ 168.720537][ T4292] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 169.713775][ T5363] capability: warning: `syz.0.264' uses 32-bit capabilities (legacy support in use) [ 171.385819][ T5410] FAULT_INJECTION: forcing a failure. [ 171.385819][ T5410] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 171.409944][ T5410] CPU: 1 PID: 5410 Comm: syz.1.279 Not tainted syzkaller #0 [ 171.417252][ T5410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 171.427303][ T5410] Call Trace: [ 171.430578][ T5410] [ 171.433508][ T5410] dump_stack_lvl+0x188/0x24e [ 171.438192][ T5410] ? show_regs_print_info+0x12/0x12 [ 171.443396][ T5410] ? load_image+0x410/0x410 [ 171.447899][ T5410] ? __lock_acquire+0x7c40/0x7c40 [ 171.452926][ T5410] ? __lock_acquire+0x138a/0x7c40 [ 171.457954][ T5410] should_fail_ex+0x390/0x4c0 [ 171.462636][ T5410] prepare_alloc_pages+0x1e1/0x5b0 [ 171.467758][ T5410] __alloc_pages+0x130/0x4f0 [ 171.472356][ T5410] ? zone_statistics+0x170/0x170 [ 171.477308][ T5410] ? verify_lock_unused+0x140/0x140 [ 171.482516][ T5410] __folio_alloc+0xe/0x30 [ 171.486851][ T5410] vma_alloc_folio+0x499/0x900 [ 171.491616][ T5410] ? mpol_shared_policy_lookup+0x147/0x1e0 [ 171.497442][ T5410] shmem_alloc_and_acct_folio+0x463/0xbd0 [ 171.503184][ T5410] ? shmem_replace_folio+0xdc0/0xdc0 [ 171.508487][ T5410] ? xas_load+0x127/0x140 [ 171.512816][ T5410] ? __filemap_get_folio+0x10f/0xde0 [ 171.518103][ T5410] ? __filemap_get_folio+0xb43/0xde0 [ 171.523388][ T5410] ? __filemap_get_folio+0x10f/0xde0 [ 171.528677][ T5410] ? page_cache_prev_miss+0x380/0x380 [ 171.534059][ T5410] shmem_get_folio_gfp+0x1439/0x35e0 [ 171.539349][ T5410] ? __lock_acquire+0x7c40/0x7c40 [ 171.544389][ T5410] shmem_fault+0x1b6/0x790 [ 171.548814][ T5410] ? shmem_fallocate+0xfc0/0xfc0 [ 171.553749][ T5410] ? filemap_map_pages+0x1ae/0x11e0 [ 171.558952][ T5410] ? filemap_read_folio+0x7a0/0x7a0 [ 171.564150][ T5410] ? count_memcg_event_mm+0x8a/0x3c0 [ 171.569445][ T5410] __do_fault+0x13b/0x4e0 [ 171.573774][ T5410] ? handle_mm_fault+0x2600/0x3d40 [ 171.578900][ T5410] handle_mm_fault+0x2610/0x3d40 [ 171.583856][ T5410] ? numa_migrate_prep+0x250/0x250 [ 171.588980][ T5410] __get_user_pages+0x40d/0xec0 [ 171.593838][ T5410] ? populate_vma_page_range+0x2b0/0x2b0 [ 171.599482][ T5410] populate_vma_page_range+0x214/0x2b0 [ 171.604955][ T5410] __mm_populate+0x25c/0x380 [ 171.609552][ T5410] ? check_vma_flags+0x4c0/0x4c0 [ 171.614490][ T5410] ? up_write+0x1b6/0x410 [ 171.618820][ T5410] vm_mmap_pgoff+0x212/0x2d0 [ 171.623412][ T5410] ? account_locked_vm+0xe0/0xe0 [ 171.628355][ T5410] ? ksys_mmap_pgoff+0xef/0x720 [ 171.633205][ T5410] ? lockdep_hardirqs_on+0x94/0x140 [ 171.638403][ T5410] do_syscall_64+0x4c/0xa0 [ 171.642824][ T5410] ? clear_bhb_loop+0x60/0xb0 [ 171.647502][ T5410] ? clear_bhb_loop+0x60/0xb0 [ 171.652180][ T5410] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 171.658070][ T5410] RIP: 0033:0x7f014239e159 [ 171.662483][ T5410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 171.682086][ T5410] RSP: 002b:00007f014328d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 171.690498][ T5410] RAX: ffffffffffffffda RBX: 00007f0142625fa0 RCX: 00007f014239e159 [ 171.698469][ T5410] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 171.706440][ T5410] RBP: 00007f014243503b R08: ffffffffffffffff R09: 0000000000002000 [ 171.714405][ T5410] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 171.722369][ T5410] R13: 00007f0142626038 R14: 00007f0142625fa0 R15: 00007ffe640ca558 [ 171.730344][ T5410] [ 175.353348][ T5476] FAULT_INJECTION: forcing a failure. [ 175.353348][ T5476] name failslab, interval 1, probability 0, space 0, times 0 [ 175.435345][ T5476] CPU: 0 PID: 5476 Comm: syz.4.298 Not tainted syzkaller #0 [ 175.442677][ T5476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 175.452749][ T5476] Call Trace: [ 175.456041][ T5476] [ 175.458993][ T5476] dump_stack_lvl+0x188/0x24e [ 175.463711][ T5476] ? show_regs_print_info+0x12/0x12 [ 175.468942][ T5476] ? load_image+0x410/0x410 [ 175.473471][ T5476] ? __might_sleep+0xd0/0xd0 [ 175.478087][ T5476] ? __lock_acquire+0x7c40/0x7c40 [ 175.483144][ T5476] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 175.488808][ T5476] should_fail_ex+0x390/0x4c0 [ 175.493520][ T5476] should_failslab+0x5/0x20 [ 175.498040][ T5476] slab_pre_alloc_hook+0x59/0x300 [ 175.503107][ T5476] kmem_cache_alloc_node+0x5a/0x310 [ 175.508326][ T5476] ? __alloc_skb+0xf9/0x7d0 [ 175.512846][ T5476] __alloc_skb+0xf9/0x7d0 [ 175.517189][ T5476] __ip6_append_data+0x2b5e/0x3e30 [ 175.522325][ T5476] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 175.527614][ T5476] ? ip6_setup_cork+0xff0/0xff0 [ 175.532460][ T5476] ? ip6_setup_cork+0xa4a/0xff0 [ 175.537308][ T5476] ip6_append_data+0x1c8/0x3d0 [ 175.542078][ T5476] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 175.547361][ T5476] rawv6_sendmsg+0x1221/0x1710 [ 175.552130][ T5476] ? compat_rawv6_ioctl+0x60/0x60 [ 175.557166][ T5476] ? tomoyo_socket_sendmsg_permission+0x212/0x2f0 [ 175.563589][ T5476] ? aa_sock_msg_perm+0x94/0x150 [ 175.568543][ T5476] ? inet_sendmsg+0x7a/0x2a0 [ 175.573134][ T5476] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 175.578415][ T5476] ? inet_send_prepare+0x250/0x250 [ 175.583524][ T5476] ____sys_sendmsg+0x5ed/0x9a0 [ 175.588299][ T5476] ? __sys_sendmsg_sock+0x30/0x30 [ 175.593324][ T5476] ? __import_iovec+0x306/0x510 [ 175.598185][ T5476] ? import_iovec+0x6f/0xa0 [ 175.602692][ T5476] ___sys_sendmsg+0x2a2/0x360 [ 175.607377][ T5476] ? __sys_sendmsg+0x2a0/0x2a0 [ 175.612183][ T5476] __se_sys_sendmsg+0x1c3/0x2b0 [ 175.617058][ T5476] ? __x64_sys_sendmsg+0x80/0x80 [ 175.622026][ T5476] ? lockdep_hardirqs_on+0x94/0x140 [ 175.627232][ T5476] do_syscall_64+0x4c/0xa0 [ 175.631667][ T5476] ? clear_bhb_loop+0x60/0xb0 [ 175.636357][ T5476] ? clear_bhb_loop+0x60/0xb0 [ 175.641044][ T5476] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 175.646939][ T5476] RIP: 0033:0x7f05d4b9e159 [ 175.651352][ T5476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 175.670963][ T5476] RSP: 002b:00007f05d5a41028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 175.679374][ T5476] RAX: ffffffffffffffda RBX: 00007f05d4e25fa0 RCX: 00007f05d4b9e159 [ 175.687348][ T5476] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000004 [ 175.695312][ T5476] RBP: 00007f05d4c3503b R08: 0000000000000000 R09: 0000000000000000 [ 175.703277][ T5476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 175.711243][ T5476] R13: 00007f05d4e26038 R14: 00007f05d4e25fa0 R15: 00007ffc61187de8 [ 175.719225][ T5476] [ 175.881551][ T26] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 176.079937][ T26] usb 3-1: Using ep0 maxpacket: 16 [ 176.095879][ T26] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 176.118794][ T5501] loop4: detected capacity change from 0 to 128 [ 176.143504][ T5501] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 176.152625][ T26] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 176.189377][ T26] usb 3-1: config 0 interface 0 has no altsetting 0 [ 176.199881][ T5501] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 176.208937][ T26] usb 3-1: New USB device found, idVendor=0b05, idProduct=18c6, bcdDevice= 0.00 [ 176.238772][ T26] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.265189][ T5501] UDF-fs: error (device loop4): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 176.294339][ T26] usb 3-1: config 0 descriptor?? [ 176.357883][ T5507] UDF-fs: error (device loop4): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 177.410396][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 177.437063][ T26] input: HID 0b05:18c6 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0B05:18C6.0003/input/input7 [ 177.618197][ T26] hid-generic 0003:0B05:18C6.0003: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0b05:18c6] on usb-dummy_hcd.2-1/input0 [ 177.668396][ T5526] syz.0.317 uses obsolete (PF_INET,SOCK_PACKET) [ 177.686596][ T26] usb 3-1: USB disconnect, device number 4 [ 177.917123][ T5532] fido_id[5532]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 177.927249][ T5536] FAULT_INJECTION: forcing a failure. [ 177.927249][ T5536] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 177.955105][ T5536] CPU: 0 PID: 5536 Comm: syz.1.320 Not tainted syzkaller #0 [ 177.962425][ T5536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 177.972512][ T5536] Call Trace: [ 177.975802][ T5536] [ 177.978748][ T5536] dump_stack_lvl+0x188/0x24e [ 177.983456][ T5536] ? show_regs_print_info+0x12/0x12 [ 177.988678][ T5536] ? load_image+0x410/0x410 [ 177.993208][ T5536] ? __lock_acquire+0x7c40/0x7c40 [ 177.998260][ T5536] ? verify_lock_unused+0x140/0x140 [ 178.003492][ T5536] should_fail_ex+0x390/0x4c0 [ 178.008201][ T5536] prepare_alloc_pages+0x1e1/0x5b0 [ 178.013353][ T5536] __alloc_pages+0x130/0x4f0 [ 178.017974][ T5536] ? zone_statistics+0x170/0x170 [ 178.022947][ T5536] ? alloc_pages+0x4dd/0x740 [ 178.027568][ T5536] kimage_alloc_pages+0xc5/0x330 [ 178.032533][ T5536] ? __might_sleep+0xd0/0xd0 [ 178.037143][ T5536] kimage_alloc_page+0x87/0x790 [ 178.042024][ T5536] ? __might_fault+0xc2/0x120 [ 178.046721][ T5536] ? __might_fault+0xa6/0x120 [ 178.051426][ T5536] kimage_load_segment+0x5ed/0x9f0 [ 178.056576][ T5536] do_kexec_load+0x4a5/0x670 [ 178.061199][ T5536] __se_sys_kexec_load+0x170/0x1c0 [ 178.066339][ T5536] do_syscall_64+0x4c/0xa0 [ 178.070789][ T5536] ? clear_bhb_loop+0x60/0xb0 [ 178.075486][ T5536] ? clear_bhb_loop+0x60/0xb0 [ 178.080183][ T5536] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 178.086098][ T5536] RIP: 0033:0x7f014239e159 [ 178.090525][ T5536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.107989][ T5541] FAULT_INJECTION: forcing a failure. [ 178.107989][ T5541] name failslab, interval 1, probability 0, space 0, times 0 [ 178.110126][ T5536] RSP: 002b:00007f014328d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f6 [ 178.110153][ T5536] RAX: ffffffffffffffda RBX: 00007f0142625fa0 RCX: 00007f014239e159 [ 178.110168][ T5536] RDX: 00002000000002c0 RSI: 0000000000000001 RDI: 0000000000000002 [ 178.110181][ T5536] RBP: 00007f014243503b R08: 0000000000000000 R09: 0000000000000000 [ 178.110194][ T5536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 178.110207][ T5536] R13: 00007f0142626038 R14: 00007f0142625fa0 R15: 00007ffe640ca558 [ 178.110234][ T5536] [ 178.191440][ T5541] CPU: 0 PID: 5541 Comm: syz.4.323 Not tainted syzkaller #0 [ 178.198756][ T5541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 178.208821][ T5541] Call Trace: [ 178.212113][ T5541] [ 178.215054][ T5541] dump_stack_lvl+0x188/0x24e [ 178.219759][ T5541] ? show_regs_print_info+0x12/0x12 [ 178.224984][ T5541] ? load_image+0x410/0x410 [ 178.229512][ T5541] ? __might_sleep+0xd0/0xd0 [ 178.234123][ T5541] ? __lock_acquire+0x7c40/0x7c40 [ 178.239170][ T5541] ? lockdep_init_map_type+0x98/0x8d0 [ 178.244571][ T5541] should_fail_ex+0x390/0x4c0 [ 178.249275][ T5541] should_failslab+0x5/0x20 [ 178.253798][ T5541] slab_pre_alloc_hook+0x59/0x300 [ 178.258848][ T5541] ? __netlink_kernel_create+0x1ee/0x7b0 [ 178.264512][ T5541] __kmem_cache_alloc_node+0x4f/0x270 [ 178.269904][ T5541] ? __init_waitqueue_head+0xa4/0x140 [ 178.275303][ T5541] ? __netlink_kernel_create+0x1ee/0x7b0 [ 178.280968][ T5541] __kmalloc+0xa3/0x240 [ 178.285156][ T5541] __netlink_kernel_create+0x1ee/0x7b0 [ 178.290648][ T5541] ? netlink_set_err+0x3b0/0x3b0 [ 178.295615][ T5541] ? netlink_set_err+0x3b0/0x3b0 [ 178.300585][ T5541] ? memset+0x1e/0x40 [ 178.304584][ T5541] ? genl_pernet_init+0xa4/0x170 [ 178.309539][ T5541] genl_pernet_init+0xb6/0x170 [ 178.314325][ T5541] ? genl_get_cmd+0x8b0/0x8b0 [ 178.319018][ T5541] ? rtnetlink_net_init+0xbd/0x140 [ 178.324144][ T5541] ? genl_pernet_exit+0x60/0x60 [ 178.329009][ T5541] ? genl_rcv+0x40/0x40 [ 178.333185][ T5541] ? rtnetlink_rcv+0x20/0x20 [ 178.337808][ T5541] ops_init+0x360/0x5e0 [ 178.341998][ T5541] setup_net+0x4f2/0xbd0 [ 178.346270][ T5541] ? copy_net_ns+0x5b0/0x5b0 [ 178.350897][ T5541] ? copy_net_ns+0x324/0x5b0 [ 178.355509][ T5541] ? down_read_killable+0x1cc/0x340 [ 178.360731][ T5541] copy_net_ns+0x33e/0x5b0 [ 178.365177][ T5541] create_new_namespaces+0x3ce/0x700 [ 178.370496][ T5541] unshare_nsproxy_namespaces+0x116/0x160 [ 178.376233][ T5541] ksys_unshare+0x4f6/0x8e0 [ 178.380737][ T5541] ? sighand_ctor+0x40/0x40 [ 178.385229][ T5541] ? lock_chain_count+0x20/0x20 [ 178.390083][ T5541] ? syscall_enter_from_user_mode+0x21/0x80 [ 178.395992][ T5541] __x64_sys_unshare+0x34/0x40 [ 178.400748][ T5541] do_syscall_64+0x4c/0xa0 [ 178.405162][ T5541] ? clear_bhb_loop+0x60/0xb0 [ 178.409841][ T5541] ? clear_bhb_loop+0x60/0xb0 [ 178.414530][ T5541] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 178.420411][ T5541] RIP: 0033:0x7f05d4b9e159 [ 178.424820][ T5541] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.444411][ T5541] RSP: 002b:00007f05d5a41028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 178.452818][ T5541] RAX: ffffffffffffffda RBX: 00007f05d4e25fa0 RCX: 00007f05d4b9e159 [ 178.460776][ T5541] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000060040000 [ 178.468733][ T5541] RBP: 00007f05d4c3503b R08: 0000000000000000 R09: 0000000000000000 [ 178.476693][ T5541] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 178.484651][ T5541] R13: 00007f05d4e26038 R14: 00007f05d4e25fa0 R15: 00007ffc61187de8 [ 178.492636][ T5541] [ 179.428290][ T5562] FAULT_INJECTION: forcing a failure. [ 179.428290][ T5562] name failslab, interval 1, probability 0, space 0, times 0 [ 179.511007][ T5562] CPU: 1 PID: 5562 Comm: syz.4.330 Not tainted syzkaller #0 [ 179.518347][ T5562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 179.528417][ T5562] Call Trace: [ 179.531741][ T5562] [ 179.534692][ T5562] dump_stack_lvl+0x188/0x24e [ 179.539413][ T5562] ? show_regs_print_info+0x12/0x12 [ 179.544644][ T5562] ? load_image+0x410/0x410 [ 179.549184][ T5562] ? __might_sleep+0xd0/0xd0 [ 179.553797][ T5562] ? __lock_acquire+0x7c40/0x7c40 [ 179.558849][ T5562] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 179.564518][ T5562] should_fail_ex+0x390/0x4c0 [ 179.569231][ T5562] should_failslab+0x5/0x20 [ 179.573754][ T5562] slab_pre_alloc_hook+0x59/0x300 [ 179.578809][ T5562] kmem_cache_alloc_node+0x5a/0x310 [ 179.584034][ T5562] ? __alloc_skb+0xf9/0x7d0 [ 179.588572][ T5562] __alloc_skb+0xf9/0x7d0 [ 179.592931][ T5562] __ip_append_data+0x26d7/0x38d0 [ 179.598005][ T5562] ? raw_send_hdrinc+0x1130/0x1130 [ 179.603151][ T5562] ? ip_setup_cork+0x850/0x850 [ 179.607938][ T5562] ? ip_setup_cork+0x29c/0x850 [ 179.612744][ T5562] ? ip_setup_cork+0x528/0x850 [ 179.617540][ T5562] ip_append_data+0x132/0x1a0 [ 179.622246][ T5562] ? raw_send_hdrinc+0x1130/0x1130 [ 179.627359][ T5562] raw_sendmsg+0x12c8/0x1940 [ 179.631959][ T5562] ? compat_raw_ioctl+0x60/0x60 [ 179.636811][ T5562] ? aa_sk_perm+0x81f/0x950 [ 179.641312][ T5562] ? __might_fault+0xa6/0x120 [ 179.645984][ T5562] ? tomoyo_socket_sendmsg_permission+0x212/0x2f0 [ 179.652398][ T5562] ? aa_sock_msg_perm+0x94/0x150 [ 179.657335][ T5562] ? sock_rps_record_flow+0x19/0x3f0 [ 179.662620][ T5562] ? inet_sendmsg+0x7a/0x2a0 [ 179.667209][ T5562] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 179.672581][ T5562] ? inet_send_prepare+0x250/0x250 [ 179.677697][ T5562] ____sys_sendmsg+0x5ed/0x9a0 [ 179.682480][ T5562] ? __sys_sendmsg_sock+0x30/0x30 [ 179.687503][ T5562] ? __import_iovec+0x306/0x510 [ 179.692361][ T5562] ? import_iovec+0x6f/0xa0 [ 179.696867][ T5562] ___sys_sendmsg+0x2a2/0x360 [ 179.701552][ T5562] ? __sys_sendmsg+0x2a0/0x2a0 [ 179.706351][ T5562] __se_sys_sendmsg+0x1c3/0x2b0 [ 179.711220][ T5562] ? __x64_sys_sendmsg+0x80/0x80 [ 179.716182][ T5562] ? lockdep_hardirqs_on+0x94/0x140 [ 179.721385][ T5562] do_syscall_64+0x4c/0xa0 [ 179.725808][ T5562] ? clear_bhb_loop+0x60/0xb0 [ 179.730488][ T5562] ? clear_bhb_loop+0x60/0xb0 [ 179.735171][ T5562] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 179.741066][ T5562] RIP: 0033:0x7f05d4b9e159 [ 179.745477][ T5562] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 179.765078][ T5562] RSP: 002b:00007f05d5a41028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 179.773491][ T5562] RAX: ffffffffffffffda RBX: 00007f05d4e25fa0 RCX: 00007f05d4b9e159 [ 179.781460][ T5562] RDX: 0000000000000000 RSI: 0000200000000780 RDI: 0000000000000005 [ 179.789426][ T5562] RBP: 00007f05d4c3503b R08: 0000000000000000 R09: 0000000000000000 [ 179.797390][ T5562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 179.805357][ T5562] R13: 00007f05d4e26038 R14: 00007f05d4e25fa0 R15: 00007ffc61187de8 [ 179.813336][ T5562] [ 179.868826][ T5579] FAULT_INJECTION: forcing a failure. [ 179.868826][ T5579] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 179.910053][ T5579] CPU: 0 PID: 5579 Comm: syz.1.333 Not tainted syzkaller #0 [ 179.917389][ T5579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 179.927465][ T5579] Call Trace: [ 179.930758][ T5579] [ 179.933706][ T5579] dump_stack_lvl+0x188/0x24e [ 179.938425][ T5579] ? show_regs_print_info+0x12/0x12 [ 179.943657][ T5579] ? load_image+0x410/0x410 [ 179.948195][ T5579] ? __lock_acquire+0x7c40/0x7c40 [ 179.953258][ T5579] should_fail_ex+0x390/0x4c0 [ 179.957973][ T5579] _copy_from_user+0x2c/0x170 [ 179.962680][ T5579] strndup_user+0xb3/0x150 [ 179.967130][ T5579] __se_sys_fsopen+0x3d/0x2c0 [ 179.971843][ T5579] do_syscall_64+0x4c/0xa0 [ 179.976293][ T5579] ? clear_bhb_loop+0x60/0xb0 [ 179.980997][ T5579] ? clear_bhb_loop+0x60/0xb0 [ 179.985708][ T5579] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 179.991631][ T5579] RIP: 0033:0x7f014239e159 [ 179.996076][ T5579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.015699][ T5579] RSP: 002b:00007f014328d028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 180.024135][ T5579] RAX: ffffffffffffffda RBX: 00007f0142625fa0 RCX: 00007f014239e159 [ 180.032131][ T5579] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000240 [ 180.040128][ T5579] RBP: 00007f014243503b R08: 0000000000000000 R09: 0000000000000000 [ 180.048119][ T5579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 180.056112][ T5579] R13: 00007f0142626038 R14: 00007f0142625fa0 R15: 00007ffe640ca558 [ 180.064127][ T5579] [ 180.368589][ T5587] loop4: detected capacity change from 0 to 16 [ 180.389962][ T5587] erofs: (device loop4): mounted with root inode @ nid 36. [ 180.429938][ T4324] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 180.619799][ T4324] usb 3-1: Using ep0 maxpacket: 16 [ 180.630454][ T4324] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 180.638567][ T4324] usb 3-1: config 0 has no interface number 0 [ 180.672802][ T4324] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 180.703269][ T4324] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 180.742307][ T4324] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 180.755457][ T5600] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 180.759510][ T4324] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.781423][ T4324] usb 3-1: Product: syz [ 180.799608][ T4324] usb 3-1: Manufacturer: syz [ 180.814550][ T4324] usb 3-1: SerialNumber: syz [ 180.839587][ T4324] usb 3-1: config 0 descriptor?? [ 180.850161][ T5584] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 180.860498][ T5584] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 180.869016][ T5612] netlink: 12 bytes leftover after parsing attributes in process `syz.0.348'. [ 183.230224][ T5652] netlink: 12 bytes leftover after parsing attributes in process `syz.4.357'. [ 183.421166][ T4324] asix: probe of 3-1:0.34 failed with error -71 [ 183.462114][ T4324] usb 3-1: USB disconnect, device number 5 [ 183.556320][ T5659] Illegal XDP return value 4294967285 on prog (id 17) dev syz_tun, expect packet loss! [ 183.712988][ T5667] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 183.724711][ T5667] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 183.746798][ T5667] netlink: 'syz.1.363': attribute type 13 has an invalid length. [ 183.780901][ T5667] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 183.810643][ T5667] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 183.829154][ T5667] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 184.397846][ T5684] netlink: 'syz.2.369': attribute type 2 has an invalid length. [ 185.448411][ T5717] netlink: 12 bytes leftover after parsing attributes in process `syz.1.382'. [ 185.833023][ T5733] gadgetfs: bound to dummy_udc driver [ 185.864302][ T5735] fuse: Bad value for 'fd' [ 186.109916][ T5099] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 186.117973][ C0] gadgetfs: connected [ 186.124663][ T5732] gadgetfs: suspended from state 3 [ 186.132163][ T5732] gadgetfs: disconnected [ 186.880631][ T5768] netlink: 'syz.1.400': attribute type 1 has an invalid length. [ 186.922383][ T5768] 8021q: adding VLAN 0 to HW filter on device bond1 [ 186.952993][ T5773] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 187.033745][ T5768] device dummy0 left promiscuous mode [ 187.075443][ T5768] bond1: (slave dummy0): Enslaving as a backup interface with an up link [ 187.124846][ T5773] netlink: 'syz.1.400': attribute type 10 has an invalid length. [ 187.141068][ T4440] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 187.187006][ T5773] netlink: 40 bytes leftover after parsing attributes in process `syz.1.400'. [ 187.310418][ T4409] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 187.940102][ T5773] device dummy0 entered promiscuous mode [ 187.958269][ T4409] bond1: (slave dummy0): link status up again after 0 ms [ 187.980884][ T4409] bond1: (slave dummy0): link status up again after 0 ms [ 187.989391][ T5773] bond1: (slave dummy0): Removing an active aggregator [ 187.999840][ T4403] bond1: (slave dummy0): link status up again after 0 ms [ 188.005904][ T5773] bond1: (slave dummy0): Releasing backup interface [ 190.960468][ T5834] netlink: 12 bytes leftover after parsing attributes in process `syz.2.421'. [ 190.969982][ T4290] Bluetooth: hci1: command 0x0406 tx timeout [ 190.976004][ T4290] Bluetooth: hci2: command 0x0406 tx timeout [ 190.982346][ T4292] Bluetooth: hci4: command 0x0406 tx timeout [ 190.988363][ T4292] Bluetooth: hci3: command 0x0406 tx timeout [ 191.004136][ T5830] device-mapper: table: 248:0: thi: unknown target type [ 191.069846][ T5830] device-mapper: ioctl: error adding target to table [ 194.015234][ T1270] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.021604][ T1270] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.834473][ T27] audit: type=1800 audit(1789144445.347:3): pid=5894 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.440" name="addr_traddr" dev="configfs" ino=40639 res=0 errno=0 [ 194.895837][ T27] audit: type=1800 audit(1789144445.347:4): pid=5894 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.440" name="addr_trsvcid" dev="configfs" ino=40640 res=0 errno=0 [ 195.037719][ T5898] fuse: Bad value for 'fd' [ 195.120907][ T5906] netlink: 4 bytes leftover after parsing attributes in process `syz.0.445'. [ 195.274244][ T5900] device-mapper: table: 248:0: thi: unknown target type [ 195.281480][ T5900] device-mapper: ioctl: error adding target to table [ 196.361419][ T5926] capability: warning: `syz.3.451' uses deprecated v2 capabilities in a way that may be insecure [ 197.419911][ T5970] FAULT_INJECTION: forcing a failure. [ 197.419911][ T5970] name failslab, interval 1, probability 0, space 0, times 0 [ 197.536349][ T5970] CPU: 1 PID: 5970 Comm: syz.0.455 Not tainted syzkaller #0 [ 197.543694][ T5970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 197.553765][ T5970] Call Trace: [ 197.557059][ T5970] [ 197.560003][ T5970] dump_stack_lvl+0x188/0x24e [ 197.564715][ T5970] ? show_regs_print_info+0x12/0x12 [ 197.569933][ T5970] ? load_image+0x410/0x410 [ 197.574438][ T5970] ? __might_sleep+0xd0/0xd0 [ 197.579009][ T5970] ? __lock_acquire+0x7c40/0x7c40 [ 197.584023][ T5970] should_fail_ex+0x390/0x4c0 [ 197.588690][ T5970] should_failslab+0x5/0x20 [ 197.593178][ T5970] slab_pre_alloc_hook+0x59/0x300 [ 197.598187][ T5970] ? kvmalloc_node+0x6c/0x180 [ 197.602854][ T5970] __kmem_cache_alloc_node+0x4f/0x270 [ 197.608247][ T5970] ? kvmalloc_node+0x6c/0x180 [ 197.612924][ T5970] __kmalloc_node+0xa2/0x240 [ 197.617517][ T5970] kvmalloc_node+0x6c/0x180 [ 197.622011][ T5970] ceph_msg_new2+0x15e/0x490 [ 197.626591][ T5970] ceph_monc_init+0x552/0xa60 [ 197.631255][ T5970] ceph_create_client+0x221/0x300 [ 197.636264][ T5970] ceph_get_tree+0x1c1/0x1350 [ 197.640927][ T5970] ? bpf_lsm_capable+0x5/0x10 [ 197.645588][ T5970] ? security_capable+0x85/0xb0 [ 197.650437][ T5970] vfs_get_tree+0x88/0x270 [ 197.654836][ T5970] vfs_fsconfig_locked+0x22f/0x400 [ 197.659933][ T5970] __se_sys_fsconfig+0x69e/0x7e0 [ 197.664857][ T5970] ? __x64_sys_fsconfig+0xc0/0xc0 [ 197.669870][ T5970] ? lockdep_hardirqs_on+0x94/0x140 [ 197.675048][ T5970] ? __x64_sys_fsconfig+0x1c/0xc0 [ 197.680056][ T5970] do_syscall_64+0x4c/0xa0 [ 197.684458][ T5970] ? clear_bhb_loop+0x60/0xb0 [ 197.689117][ T5970] ? clear_bhb_loop+0x60/0xb0 [ 197.693782][ T5970] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 197.699660][ T5970] RIP: 0033:0x7fa61339e159 [ 197.704059][ T5970] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 197.723648][ T5970] RSP: 002b:00007fa61420a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 197.732041][ T5970] RAX: ffffffffffffffda RBX: 00007fa613625fa0 RCX: 00007fa61339e159 [ 197.740002][ T5970] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 197.747972][ T5970] RBP: 00007fa61343503b R08: 0000000000000000 R09: 0000000000000000 [ 197.755957][ T5970] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 197.763929][ T5970] R13: 00007fa613626038 R14: 00007fa613625fa0 R15: 00007ffd8be91d08 [ 197.771892][ T5970] [ 199.029788][ T127] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 199.260849][ T127] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 199.287043][ T127] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 199.419306][ T127] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 199.480194][ T127] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 200.600349][ T127] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 200.609995][ T127] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 200.618011][ T127] usb 3-1: Product: syz [ 200.623054][ T127] usb 3-1: Manufacturer: syz [ 200.648798][ T127] cdc_wdm 3-1:1.0: skipping garbage [ 200.658016][ T127] cdc_wdm 3-1:1.0: skipping garbage [ 200.681070][ T127] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 200.687001][ T127] cdc_wdm 3-1:1.0: Unknown control protocol [ 200.720077][ T6122] fuse: Bad value for 'fd' [ 201.265224][ T6137] overlayfs: failed to clone lowerpath [ 201.332649][ T6138] overlayfs: failed to clone lowerpath [ 201.612160][ T6147] bridge0: port 3(syz_tun) entered blocking state [ 201.646977][ T5099] usb 3-1: USB disconnect, device number 6 [ 201.699976][ T6147] bridge0: port 3(syz_tun) entered disabled state [ 201.707629][ T6147] device syz_tun entered promiscuous mode [ 201.876349][ T6147] bridge0: port 3(syz_tun) entered blocking state [ 201.883126][ T6147] bridge0: port 3(syz_tun) entered listening state [ 201.919976][ C1] bridge0: port 3(syz_tun) neighbor 0000.00:00:00:00:00:00 lost [ 201.928774][ C1] bridge0: topology change detected, propagating [ 202.080720][ T6162] fuse: Bad value for 'fd' [ 202.423611][ T6174] netlink: 4 bytes leftover after parsing attributes in process `syz.1.482'. [ 205.388114][ T6235] netlink: 20 bytes leftover after parsing attributes in process `syz.1.486'. [ 205.499979][ T6235] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.507396][ T6235] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.869709][ T4338] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 206.034378][ T6267] FAULT_INJECTION: forcing a failure. [ 206.034378][ T6267] name failslab, interval 1, probability 0, space 0, times 0 [ 206.047793][ T6267] CPU: 0 PID: 6267 Comm: syz.3.495 Not tainted syzkaller #0 [ 206.055114][ T6267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 206.065186][ T6267] Call Trace: [ 206.068481][ T6267] [ 206.071432][ T6267] dump_stack_lvl+0x188/0x24e [ 206.076137][ T6267] ? show_regs_print_info+0x12/0x12 [ 206.079771][ T4338] usb 3-1: Using ep0 maxpacket: 32 [ 206.081328][ T6267] ? load_image+0x410/0x410 [ 206.090956][ T6267] ? __might_sleep+0xd0/0xd0 [ 206.095566][ T6267] ? __lock_acquire+0x7c40/0x7c40 [ 206.100622][ T6267] should_fail_ex+0x390/0x4c0 [ 206.105327][ T6267] should_failslab+0x5/0x20 [ 206.109846][ T6267] slab_pre_alloc_hook+0x59/0x300 [ 206.114895][ T6267] ? rcu_is_watching+0x11/0xa0 [ 206.119701][ T6267] kmem_cache_alloc+0x56/0x2f0 [ 206.123953][ T4338] usb 3-1: config 0 has no interfaces? [ 206.124469][ T6267] ? ceph_msg_new2+0x36/0x490 [ 206.134622][ T6267] ceph_msg_new2+0x36/0x490 [ 206.139156][ T6267] ceph_monc_init+0x607/0xa60 [ 206.141800][ T4338] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 206.143842][ T6267] ceph_create_client+0x221/0x300 [ 206.157888][ T6267] ceph_get_tree+0x1c1/0x1350 [ 206.162595][ T6267] ? bpf_lsm_capable+0x5/0x10 [ 206.166236][ T4338] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.167280][ T6267] ? security_capable+0x85/0xb0 [ 206.180117][ T6267] vfs_get_tree+0x88/0x270 [ 206.184561][ T6267] vfs_fsconfig_locked+0x22f/0x400 [ 206.188488][ T4338] usb 3-1: Product: syz [ 206.189692][ T6267] __se_sys_fsconfig+0x69e/0x7e0 [ 206.189727][ T6267] ? __x64_sys_fsconfig+0xc0/0xc0 [ 206.189760][ T6267] ? lockdep_hardirqs_on+0x94/0x140 [ 206.189781][ T6267] ? __x64_sys_fsconfig+0x1c/0xc0 [ 206.189805][ T6267] do_syscall_64+0x4c/0xa0 [ 206.189836][ T6267] ? clear_bhb_loop+0x60/0xb0 [ 206.194811][ T4338] usb 3-1: Manufacturer: syz [ 206.198896][ T6267] ? clear_bhb_loop+0x60/0xb0 [ 206.198932][ T6267] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 206.209956][ T4338] usb 3-1: SerialNumber: syz [ 206.214156][ T6267] RIP: 0033:0x7f8d8019e159 [ 206.240044][ T4338] usb 3-1: config 0 descriptor?? [ 206.242915][ T6267] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 206.271933][ T6267] RSP: 002b:00007f8d81020028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 206.280362][ T6267] RAX: ffffffffffffffda RBX: 00007f8d80425fa0 RCX: 00007f8d8019e159 [ 206.288340][ T6267] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 206.296331][ T6267] RBP: 00007f8d8023503b R08: 0000000000000000 R09: 0000000000000000 [ 206.304325][ T6267] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 206.312313][ T6267] R13: 00007f8d80426038 R14: 00007f8d80425fa0 R15: 00007ffc9d3dace8 [ 206.320320][ T6267] [ 206.362601][ T6271] netlink: 4 bytes leftover after parsing attributes in process `syz.1.496'. [ 206.857195][ T6285] xt_hashlimit: max too large, truncated to 1048576 [ 206.864205][ T6285] xt_hashlimit: Unknown mode mask 300, kernel too old? [ 208.713346][ T5099] usb 3-1: USB disconnect, device number 7 [ 209.981135][ T4292] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 209.990033][ T4292] Bluetooth: hci2: Injecting HCI hardware error event [ 210.001129][ T4290] Bluetooth: hci2: hardware error 0x00 [ 210.068953][ T6353] netlink: 'syz.4.509': attribute type 1 has an invalid length. [ 210.145833][ T6353] bond1: (slave veth3): Enslaving as an active interface with a down link [ 210.184789][ T6353] bond1: (slave veth0_to_bond): making interface the new active one [ 210.194345][ T6353] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 211.531323][ T6348] loop2: detected capacity change from 0 to 32768 [ 212.129506][ T4290] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 213.892998][ T6436] device bond_slave_0 entered promiscuous mode [ 213.899593][ T6436] device bond_slave_1 entered promiscuous mode [ 213.920524][ T6436] device vlan2 entered promiscuous mode [ 213.926105][ T6436] device bond0 entered promiscuous mode [ 214.063132][ T6442] netlink: 8 bytes leftover after parsing attributes in process `syz.4.522'. [ 214.366088][ T6447] TC_ACT_REPEAT abuse ? [ 215.036816][ T6452] genirq: Flags mismatch irq 4. 00000000 (pcl812) vs. 00000000 (ttyS0) [ 217.170520][ C1] bridge0: port 3(syz_tun) entered learning state [ 218.205271][ T6491] device syzkaller0 entered promiscuous mode [ 220.644371][ T6542] tipc: Enabling of bearer rejected, failed to enable media [ 222.904959][ T6554] kvm [6553]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x500000000 [ 227.643240][ T6574] netlink: 52 bytes leftover after parsing attributes in process `syz.3.550'. [ 227.749142][ T6574] netlink: 52 bytes leftover after parsing attributes in process `syz.3.550'. [ 229.059736][ T6590] nvmet_tcp: address family 255 not supported [ 229.108557][ T27] audit: type=1800 audit(1789144479.568:5): pid=6590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.554" name="addr_trtype" dev="configfs" ino=41711 res=0 errno=0 [ 229.227845][ T27] audit: type=1800 audit(1789144479.568:6): pid=6590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.554" name="addr_trsvcid" dev="configfs" ino=41712 res=0 errno=0 [ 232.697060][ C1] bridge0: port 3(syz_tun) entered forwarding state [ 232.703736][ C1] bridge0: topology change detected, propagating [ 232.830087][ T6621] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 232.915226][ T6624] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 234.013208][ T26] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 234.619158][ T26] usb 3-1: config 0 has an invalid interface number: 50 but max is 0 [ 234.659326][ T26] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 234.863514][ T26] usb 3-1: config 0 has no interface number 0 [ 234.889230][ T26] usb 3-1: config 0 interface 50 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 235.088752][ T26] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 235.097839][ T26] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.181037][ T26] usb 3-1: Product: syz [ 235.185585][ T26] usb 3-1: Manufacturer: syz [ 235.990519][ T26] usb 3-1: SerialNumber: syz [ 236.033241][ T26] usb 3-1: config 0 descriptor?? [ 236.048948][ T26] yurex 3-1:0.50: Could not find endpoints [ 236.602954][ T6660] ip_tables: iptables: counters copy to user failed while replacing table [ 238.321163][ T5099] usb 3-1: USB disconnect, device number 8 [ 238.501272][ T6675] device syzkaller0 entered promiscuous mode [ 238.573443][ T6677] dns_resolver: Unsupported content type (6) [ 238.966010][ T6671] netlink: 24 bytes leftover after parsing attributes in process `syz.3.575'. [ 239.333289][ T6683] device syzkaller0 entered promiscuous mode [ 245.161885][ T6772] device syzkaller0 entered promiscuous mode [ 245.252386][ T6780] loop4: detected capacity change from 0 to 128 [ 245.272399][ T6774] device syzkaller0 entered promiscuous mode [ 248.822409][ T6806] loop4: detected capacity change from 0 to 256 [ 251.197648][ T4759] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 252.833028][ T4759] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 253.464071][ T4759] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 253.575128][ T4759] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 253.604532][ T4759] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.631437][ T4759] usb 3-1: Product: syz [ 253.653656][ T4759] usb 3-1: Manufacturer: syz [ 254.485839][ T4759] usb 3-1: SerialNumber: syz [ 254.572547][ T4759] usb 3-1: can't set config #1, error -71 [ 254.602163][ T4759] usb 3-1: USB disconnect, device number 9 [ 254.811824][ T6842] loop2: detected capacity change from 0 to 256 [ 255.018510][ T6842] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 255.098356][ T6845] virtio-fs: tag not found [ 255.460926][ T1270] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.468910][ T1270] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.778380][ T27] audit: type=1800 audit(1789144506.300:7): pid=6842 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.611" name="file1" dev="loop2" ino=1048624 res=0 errno=0 [ 264.230893][ T6918] using random self ethernet address [ 264.247848][ T6918] using random host ethernet address [ 265.913959][ T6934] Need at least one configuration in g1. [ 265.986986][ T6934] udc dummy_udc.0: failed to start g1: -22 [ 266.112202][ T6934] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 266.505196][ T6934] UDC core: g1: couldn't find an available UDC or it's busy [ 271.248443][ T6983] autofs4:pid:6983:autofs_fill_super: called with bogus options [ 271.450873][ T6985] loop2: detected capacity change from 0 to 256 [ 274.956620][ T7008] fuse: Bad value for 'fd' [ 276.400684][ T7015] netlink: 8 bytes leftover after parsing attributes in process `syz.0.655'. [ 277.711005][ T7027] loop4: detected capacity change from 0 to 32768 [ 278.602637][ T7027] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 282.143841][ T4287] ocfs2: Unmounting device (7,4) on (node local) [ 282.836005][ T7047] netlink: 404 bytes leftover after parsing attributes in process `syz.4.666'. [ 284.173542][ T7058] "syz.3.661" (7058) uses obsolete ecb(arc4) skcipher [ 287.804378][ T7084] page:ffffea0001260180 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x49806 [ 287.815386][ T7084] head:ffffea0001260180 order:1 compound_mapcount:0 compound_pincount:0 [ 287.823862][ T7084] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 287.832045][ T7084] raw: 00fff00000010200 ffffea00010e1880 dead000000000002 ffff8880174c5000 [ 287.840940][ T7084] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 287.850046][ T7084] page dumped because: unmovable page [ 287.855672][ T7084] page_owner tracks the page as allocated [ 287.862192][ T7084] page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 6218, tgid 6218 (modprobe), ts 204119383150, free_ts 149872127053 [ 287.884964][ T7084] post_alloc_hook+0x173/0x1a0 [ 287.889919][ T7084] get_page_from_freelist+0x206b/0x2180 [ 287.896487][ T7084] __alloc_pages+0x1ec/0x4f0 [ 287.902611][ T7084] alloc_slab_page+0x5d/0x180 [ 287.907637][ T7084] new_slab+0x87/0x2d0 [ 287.911865][ T7084] ___slab_alloc+0xbc5/0x1240 [ 287.916773][ T7084] kmem_cache_alloc_bulk+0x1a3/0x4e0 [ 287.922188][ T7084] mas_alloc_nodes+0x449/0x880 [ 287.927153][ T7084] mas_preallocate+0x162/0x3b0 [ 287.932106][ T7084] __vma_adjust+0x2ff/0x1d00 [ 287.936884][ T7084] __split_vma+0x3a2/0x4f0 [ 287.941475][ T7084] do_mas_align_munmap+0x399/0x12d0 [ 287.946884][ T7084] do_mas_munmap+0x240/0x2b0 [ 287.951647][ T7084] mmap_region+0x7ab/0x1c50 [ 287.956389][ T7084] do_mmap+0x9ce/0x10d0 [ 287.960711][ T7084] vm_mmap_pgoff+0x1c1/0x2d0 [ 287.965506][ T7084] page last free stack trace: [ 287.970338][ T7084] free_unref_page_prepare+0x8e5/0x9e0 [ 287.975978][ T7084] free_unref_page_list+0xbb/0x8e0 [ 287.981247][ T7084] release_pages+0x20d1/0x2340 [ 287.986153][ T7084] __pagevec_release+0x6d/0xe0 [ 287.991073][ T7084] shmem_undo_range+0x808/0x21d0 [ 287.996953][ T7084] shmem_evict_inode+0x225/0x9f0 [ 288.002246][ T7084] evict+0x4b6/0x8b0 [ 288.553384][ T7084] do_unlinkat+0x388/0x580 [ 288.566946][ T7084] __x64_sys_unlink+0x45/0x50 [ 288.571631][ T7084] do_syscall_64+0x4c/0xa0 [ 288.576381][ T7084] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 289.563371][ T7094] loop2: detected capacity change from 0 to 256 [ 289.618874][ T27] audit: type=1400 audit(1789144540.142:8): apparmor="DENIED" operation="stack_onexec" info="label not found" error=-2 profile="unconfined" name=3AAE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F7D91F81B621CC4214D4A27E1614FBEE0BEAC8F4A045070B770212D46D4A2DF096B791F2A4BA218E12CB76AA24945B70A7C9DD5EDEAC52B5A876F73CFBE66371A72F11F3D9544D6B59B4A5541DCEF5CBF11FFFF37DFD147C8A3E5098A207BE806EA7167101F8C1B5C8FE41E170FD0C775DBC5BE0B6D3AB625AB702E5B1DC15F9C4B3D09BE812F340E681E0694F5BADF640DA3FDFC2F929B4C2BEB9A592C577287B6021BFEEC24146C7F95608BB60A736207A09D9F47E89C4044EADDE57CDEFD15F25B822D2EAF2205DF0D6B71B63EE0B63CB598F26509AF36983578F6F4198A0843CC1B1BD780015007AB9709CC6211E3B5C685B972B5C5E95F054A7A9FE149282F679C8466B9734E3850EC98419DD0C887715902F9E7802842085BC606F30C2654869E9E3701FD0FC69137FE165592689465EEBD5CAFAD7C29DE2ADADEC42A818D8EE389CA1FE33A1EF23617C89116A3A458B56612E4C36C43A9150D5331ADBB0BEB01A062B1F1349FC2ECEA76CB7C40CDFE378185F3099B1D71414D0FDA [ 289.667578][ T7094] exFAT-fs (loop2): failed to load upcase table (idx : 0x00012153, chksum : 0xc3dffc2e, utbl_chksum : 0xe619d30d) [ 291.605454][ T7105] loop4: detected capacity change from 0 to 2048 [ 291.612624][ T7105] EXT4-fs: Ignoring removed i_version option [ 291.691405][ T7116] rnbd_client L600: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 293.651477][ T7105] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 293.660083][ T7105] ext4 filesystem being mounted at /127/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 293.719663][ T7116] rtrs_client L2076: : Failed to resolve address, err: -19 [ 293.745451][ T4287] EXT4-fs (loop4): unmounting filesystem. [ 293.782730][ T7116] rtrs_client L2619: : init_conns() failed: err=-19 path=@ip:127.0.0.1 [:0] [ 295.709408][ T7140] overlayfs: missing 'lowerdir' [ 298.379714][ T7163] rnbd_client L600: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 298.391055][ T7163] rtrs_client L2076: : Failed to resolve address, err: -19 [ 298.398784][ T7163] rtrs_client L2619: : init_conns() failed: err=-19 path=@ip:127.0.0.1 [:0] [ 304.183679][ T7207] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 304.197945][ T7207] pci 0000:00:07.0: [1af4:1005] type 00 class 0x00ff00 [ 304.213614][ T7207] pci 0000:00:07.0: BAR 0 [io 0xc0a0-0xc0bf] [ 304.226895][ T7207] pci 0000:00:07.0: BAR 1 [mem 0xfe802000-0xfe80203f] [ 304.269161][ T7207] pci 0000:00:07.0: BAR 1 [mem 0xc0000000-0xc000003f]: assigned [ 304.280541][ T7207] pci 0000:00:07.0: BAR 0 [io 0x1000-0x101f]: assigned [ 304.301387][ T7207] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver [ 304.971511][ T7207] hwrng_fill thread creation failed [ 305.265291][ T7215] Cannot find add_set index 0 as target [ 305.341498][ T7218] overlayfs: conflicting options: nfs_export=on,index=off [ 305.777276][ T7217] xt_l2tp: v2 tid > 0xffff: 4294967294 [ 308.239114][ T7241] Cannot find add_set index 0 as target [ 308.322798][ T7242] overlayfs: missing 'lowerdir' [ 309.867990][ T7249] kvm: apic: phys broadcast and lowest prio [ 314.086127][ T7272] loop2: detected capacity change from 0 to 1764 [ 314.832812][ T7276] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 316.783755][ T27] audit: type=1800 audit(1789144575.295:9): pid=7342 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.725" name="addr_trtype" dev="configfs" ino=44492 res=0 errno=0 [ 316.810193][ T7342] nvmet_tcp: address family 255 not supported [ 316.887968][ T1270] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.894796][ T1270] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.669084][ T27] audit: type=1800 audit(1789144575.325:10): pid=7342 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.725" name="addr_traddr" dev="configfs" ino=44493 res=0 errno=0 [ 317.736900][ T7340] tipc: Failed to remove unknown binding: 66,0,0/0:3574943420/3574943421 [ 319.190504][ T7351] netlink: 256 bytes leftover after parsing attributes in process `syz.3.727'. [ 319.280792][ T7351] netlink: 20 bytes leftover after parsing attributes in process `syz.3.727'. [ 319.681955][ T7359] loop2: detected capacity change from 0 to 64 [ 320.664163][ T7368] usb0: HOST MAC 56:e5:d7:61:8a:3c [ 320.669693][ T7368] usb0: MAC 6e:56:56:d5:00:4d [ 323.021242][ T7434] loop4: detected capacity change from 0 to 16 [ 323.342166][ T7434] erofs: (device loop4): mounted with root inode @ nid 36. [ 328.664429][ T7490] null_blk: disk nullb1 created [ 329.891763][ T7509] syz.4.752: attempt to access beyond end of device [ 329.891763][ T7509] loop4: rw=0, sector=16, nr_sectors = 2 limit=0 [ 331.145984][ T7510] device syzkaller0 entered promiscuous mode [ 333.324694][ T7528] xt_nfacct: accounting object `' does not exist [ 337.109030][ T7551] rt1719: probe of 0-0049 failed with error -5 [ 337.115827][ T7551] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 341.706617][ T7579] xt_nfacct: accounting object `' does not exist [ 343.171443][ T7585] netlink: 'syz.3.778': attribute type 2 has an invalid length. [ 343.179284][ T7585] netlink: 224 bytes leftover after parsing attributes in process `syz.3.778'. [ 344.340312][ T7600] xt_nfacct: accounting object `' does not exist [ 344.919994][ T7604] xt_nfacct: accounting object `' does not exist [ 346.002725][ T4292] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 346.020044][ T4292] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 346.030771][ T4292] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 346.056009][ T4292] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 346.076585][ T4292] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 346.093718][ T4292] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 348.247521][ T4292] Bluetooth: hci5: command 0x0409 tx timeout [ 349.057775][ T7612] chnl_net:caif_netlink_parms(): no params data found [ 349.685367][ T4290] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 349.701862][ T4290] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 349.710197][ T4290] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 349.722610][ T4281] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 349.738258][ T4290] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 349.751654][ T4290] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 350.306958][ T4286] Process accounting resumed [ 350.321608][ T4290] Bluetooth: hci5: command 0x041b tx timeout [ 350.348323][ T7612] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.355884][ T7612] bridge0: port 1(bridge_slave_0) entered disabled state [ 350.365951][ T7612] device bridge_slave_0 entered promiscuous mode [ 350.387934][ T7660] netlink: 'syz.2.789': attribute type 10 has an invalid length. [ 351.235525][ T7660] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 351.253134][ T7612] bridge0: port 2(bridge_slave_1) entered blocking state [ 351.260231][ T7612] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.427770][ T4290] Bluetooth: hci0: command 0x0409 tx timeout [ 352.428663][ T4292] Bluetooth: hci5: command 0x040f tx timeout [ 352.493179][ T7612] device bridge_slave_1 entered promiscuous mode [ 352.658750][ T6139] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.111253][ T6139] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.175977][ T7612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 353.266512][ T6139] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.324299][ T7612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 353.554650][ T6139] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.947627][ T7612] team0: Port device team_slave_0 added [ 354.482041][ T4292] Bluetooth: hci5: command 0x0419 tx timeout [ 354.482608][ T4290] Bluetooth: hci0: command 0x041b tx timeout [ 354.906765][ T7612] team0: Port device team_slave_1 added [ 355.019920][ T7612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 355.027674][ T7612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 355.774054][ T7699] xt_nfacct: accounting object `' does not exist [ 355.881841][ T7612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 355.936590][ T7612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 355.980016][ T7612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 356.048863][ T7612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 356.570418][ T4290] Bluetooth: hci0: command 0x040f tx timeout [ 357.172989][ T7612] device hsr_slave_0 entered promiscuous mode [ 357.211432][ T7612] device hsr_slave_1 entered promiscuous mode [ 357.249445][ T7612] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 357.267789][ T7612] Cannot create hsr debugfs directory [ 357.277805][ T7651] chnl_net:caif_netlink_parms(): no params data found [ 358.122188][ T7720] xt_nfacct: accounting object `' does not exist [ 358.725073][ T4290] Bluetooth: hci0: command 0x0419 tx timeout [ 359.485916][ T5103] Process accounting resumed [ 359.523663][ T7733] netlink: 'syz.3.815': attribute type 10 has an invalid length. [ 359.651306][ T7733] device dummy0 entered promiscuous mode [ 359.699117][ T7733] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 360.104439][ T7651] bridge0: port 1(bridge_slave_0) entered blocking state [ 360.155161][ T7651] bridge0: port 1(bridge_slave_0) entered disabled state [ 360.187695][ T7651] device bridge_slave_0 entered promiscuous mode [ 360.290242][ T7651] bridge0: port 2(bridge_slave_1) entered blocking state [ 360.312223][ T7651] bridge0: port 2(bridge_slave_1) entered disabled state [ 360.374234][ T7651] device bridge_slave_1 entered promiscuous mode [ 361.319396][ T7612] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 361.383027][ T7651] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 361.398664][ T7612] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 361.413652][ T7612] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 361.449171][ T7651] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 361.553135][ T7612] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 361.725351][ T7651] team0: Port device team_slave_0 added [ 361.868335][ T7651] team0: Port device team_slave_1 added [ 362.661639][ T7773] xt_nfacct: accounting object `' does not exist [ 362.779663][ T7651] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 362.811039][ T7651] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 362.877824][ T7651] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 363.251839][ T7651] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 363.267407][ T7651] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 363.347744][ T7651] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 363.522950][ T7612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 363.633193][ T5987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 363.653113][ T5987] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 363.748439][ T7651] device hsr_slave_0 entered promiscuous mode [ 363.805557][ T7651] device hsr_slave_1 entered promiscuous mode [ 363.826588][ T7651] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 363.861572][ T7651] Cannot create hsr debugfs directory [ 363.890367][ T7612] 8021q: adding VLAN 0 to HW filter on device team0 [ 364.008201][ T6139] device hsr_slave_0 left promiscuous mode [ 364.054480][ T6139] device hsr_slave_1 left promiscuous mode [ 364.267908][ T6139] device veth1_macvtap left promiscuous mode [ 364.317324][ T6139] device veth0_macvtap left promiscuous mode [ 364.373235][ T6139] device veth1_vlan left promiscuous mode [ 364.421159][ T6139] device veth0_vlan left promiscuous mode [ 365.191683][ T7792] xt_nfacct: accounting object `' does not exist [ 368.720173][ T7858] xt_nfacct: accounting object `' does not exist [ 372.103016][ T7875] xt_nfacct: accounting object `' does not exist [ 373.709549][ T6139] bond0 (unregistering): Released all slaves [ 374.461114][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 374.500640][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 374.525679][ T5992] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.532778][ T5992] bridge0: port 1(bridge_slave_0) entered forwarding state [ 374.540977][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 374.561332][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 374.590403][ T5992] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.597507][ T5992] bridge0: port 2(bridge_slave_1) entered forwarding state [ 374.610649][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 374.629529][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 374.662525][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 374.672289][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 374.710821][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 374.731042][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 374.831092][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 374.840942][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 374.848815][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 374.892739][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 374.902962][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 374.944047][ T5992] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 374.971180][ T7612] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 375.368178][ T7651] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 375.444891][ T7651] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 375.489233][ T7651] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 375.520422][ T7906] device syzkaller0 entered promiscuous mode [ 375.568883][ T7651] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 375.910618][ T6139] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 375.974547][ T7651] 8021q: adding VLAN 0 to HW filter on device bond0 [ 376.128387][ T6139] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.176728][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 376.190580][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 376.255725][ T7651] 8021q: adding VLAN 0 to HW filter on device team0 [ 376.293592][ T7612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 376.465821][ T6139] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.583061][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 376.617180][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 376.707469][ T6139] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 377.590600][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 377.640743][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 377.656338][ T4519] bridge0: port 1(bridge_slave_0) entered blocking state [ 377.663437][ T4519] bridge0: port 1(bridge_slave_0) entered forwarding state [ 377.720331][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 377.741235][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 377.770666][ T4519] bridge0: port 2(bridge_slave_1) entered blocking state [ 377.777749][ T4519] bridge0: port 2(bridge_slave_1) entered forwarding state [ 377.820387][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 377.853162][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 377.898662][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 377.932963][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 377.973538][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 377.993946][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 378.080159][ T5975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 378.120859][ T5975] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 378.163553][ T5975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 378.207680][ T5975] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 378.225542][ T7651] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 378.325968][ T1270] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.345329][ T1270] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.391756][ T7651] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 378.572315][ T5998] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 378.646430][ T7942] virtio-fs: tag not found [ 379.538231][ T5998] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 380.418046][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 380.448553][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 380.515992][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 380.524636][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 380.553039][ T7612] device veth0_vlan entered promiscuous mode [ 380.672374][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 380.700811][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 380.736405][ T7612] device veth1_vlan entered promiscuous mode [ 380.880325][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 380.888866][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 380.979577][ T7612] device veth0_macvtap entered promiscuous mode [ 381.001698][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 381.012354][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 381.068706][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 381.097353][ T7651] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 381.161770][ T7612] device veth1_macvtap entered promiscuous mode [ 381.258284][ T7612] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 381.295066][ T7612] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.323116][ T7612] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 381.354010][ T7612] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.369900][ T7612] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 381.417134][ T7612] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.428288][ T7612] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 381.452225][ T7612] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.475064][ T7612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 381.487058][ T5998] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 381.497399][ T5998] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 381.517251][ T5998] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 381.542481][ T7612] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 381.560376][ T7612] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.584870][ T7612] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 381.609889][ T7612] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.639835][ T7612] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 381.680063][ T7612] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.696771][ T7612] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 381.717155][ T7612] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.748845][ T7612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 381.833786][ T5998] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 381.851869][ T5998] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 381.872971][ T7612] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.887674][ T7612] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.907606][ T7612] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.916742][ T7612] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.119572][ T5975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 382.130465][ T5975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 382.321221][ T5975] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 382.652583][ T5981] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 382.673842][ T5981] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 382.686652][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 382.705638][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 382.775376][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 382.789869][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 382.811110][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 382.836150][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 382.870264][ T6010] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 383.004011][ T7651] device veth0_vlan entered promiscuous mode [ 383.194322][ T7651] device veth1_vlan entered promiscuous mode [ 383.287742][ T6139] device hsr_slave_0 left promiscuous mode [ 383.316724][ T6139] device hsr_slave_1 left promiscuous mode [ 383.340677][ T6139] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 383.382341][ T6139] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 383.932410][ T6139] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 384.119791][ T6139] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 384.127812][ T6139] device bridge_slave_1 left promiscuous mode [ 384.503026][ T6139] bridge0: port 2(bridge_slave_1) entered disabled state [ 384.525653][ T6139] device bridge_slave_0 left promiscuous mode [ 384.549577][ T6139] bridge0: port 1(bridge_slave_0) entered disabled state [ 384.645122][ T6139] device veth1_macvtap left promiscuous mode [ 384.679798][ T6139] device veth0_macvtap left promiscuous mode [ 384.685932][ T6139] device veth1_vlan left promiscuous mode [ 385.560645][ T8033] xt_nfacct: accounting object `' does not exist [ 386.076676][ T6139] device veth0_vlan left promiscuous mode [ 387.882000][ T8057] netlink: 8 bytes leftover after parsing attributes in process `syz.5.871'. [ 388.004050][ T6139] bond1 (unregistering): (slave veth3): Releasing backup interface [ 389.066391][ T6139] bond1 (unregistering): Released all slaves [ 389.616096][ T8065] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 389.726901][ T8069] netlink: 12 bytes leftover after parsing attributes in process `syz.3.874'. [ 390.083501][ T6139] team0 (unregistering): Port device team_slave_1 removed [ 390.143158][ T6139] team0 (unregistering): Port device team_slave_0 removed [ 390.210952][ T6139] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 390.267082][ T6139] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 390.665582][ T8083] netlink: 'syz.4.876': attribute type 2 has an invalid length. [ 390.673461][ T8083] netlink: 224 bytes leftover after parsing attributes in process `syz.4.876'. [ 391.345411][ T6139] bond0 (unregistering): Released all slaves [ 391.996243][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 392.579590][ T8090] xt_nfacct: accounting object `' does not exist [ 392.863358][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 392.895027][ T7651] device veth0_macvtap entered promiscuous mode [ 392.956044][ T7651] device veth1_macvtap entered promiscuous mode [ 393.040397][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 393.054327][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 393.194074][ T7651] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 393.228330][ T7651] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.239043][ T7651] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 393.251201][ T7651] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.261147][ T7651] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 393.319255][ T7651] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.329231][ T7651] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 393.339825][ T7651] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.358365][ T7651] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 393.372224][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 393.414151][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 393.466804][ T7651] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 393.477738][ T7651] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.490500][ T7651] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 393.501481][ T7651] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.513508][ T7651] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 393.528271][ T7651] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.544102][ T7651] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 393.583542][ T7651] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.597845][ T7651] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 393.622663][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 393.633713][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 393.653150][ T7651] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.665600][ T7651] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.674834][ T7651] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.686317][ T7651] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.118258][ T4307] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 395.290913][ T4307] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 395.354326][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 395.446809][ T5998] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 395.486253][ T5998] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 395.541058][ T5998] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 395.940312][ T8122] 9pnet_fd: Insufficient options for proto=fd [ 396.811037][ T8127] se_dev->se_dev_ptr already set for storage object [ 399.439343][ C1] ------------[ cut here ]------------ [ 399.445223][ C1] WARNING: CPU: 1 PID: 0 at net/core/flow_dissector.c:1027 __skb_flow_dissect+0xade/0x6d50 [ 399.455351][ C1] Modules linked in: [ 399.459259][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 [ 399.466316][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 399.476391][ C1] RIP: 0010:__skb_flow_dissect+0xade/0x6d50 [ 399.482366][ C1] Code: c6 e8 c6 83 4e f9 85 db 0f 84 5b 06 00 00 80 3d d3 dc d8 05 01 0f 85 81 06 00 00 e8 4c 80 4e f9 e9 e7 f9 ff ff e8 42 80 4e f9 <0f> 0b e8 8b 8c fd 01 89 c3 31 ff 89 c6 e8 90 83 4e f9 85 db 74 18 [ 399.502032][ C1] RSP: 0018:ffffc900001dfb00 EFLAGS: 00010246 [ 399.508088][ C1] RAX: ffffffff8833c14e RBX: 0000000000000000 RCX: ffff888017739e00 [ 399.516065][ C1] RDX: 0000000000000100 RSI: ffffffff8adf6400 RDI: ffffffff8adf63c0 [ 399.524037][ C1] RBP: ffffc900001e00c8 R08: dffffc0000000000 R09: 1ffffffff2162648 [ 399.532015][ C1] R10: dffffc0000000000 R11: fffffbfff2162649 R12: ffffffff8e2187fc [ 399.540008][ C1] R13: 1ffffffff1c43100 R14: ffffffff8e218802 R15: dffffc0000000000 [ 399.547981][ C1] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 399.556923][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 399.563520][ C1] CR2: 0000200000010000 CR3: 000000004b42f000 CR4: 00000000003506e0 [ 399.571502][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 399.579474][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 399.587428][ C1] Call Trace: [ 399.590772][ C1] [ 399.593614][ C1] ? __skb_flow_dissect+0x407/0x6d50 [ 399.599003][ C1] ? __lock_acquire+0x1465/0x7c40 [ 399.604088][ C1] ? mark_lock+0x94/0x320 [ 399.608402][ C1] ? bpf_flow_dissect+0x3f0/0x3f0 [ 399.613432][ C1] ? __lock_acquire+0x138a/0x7c40 [ 399.618446][ C1] ? mark_lock+0x94/0x320 [ 399.622779][ C1] ? __lock_acquire+0x1465/0x7c40 [ 399.627789][ C1] ? __bfs+0x27a/0x560 [ 399.631892][ C1] ? check_path+0x40/0x40 [ 399.636217][ C1] ? verify_lock_unused+0x140/0x140 [ 399.641440][ C1] ? verify_lock_unused+0x140/0x140 [ 399.646623][ C1] ? stack_trace_save+0xf0/0xf0 [ 399.651571][ C1] ? arch_stack_walk+0x10c/0x140 [ 399.656548][ C1] ? mark_lock+0x94/0x320 [ 399.660889][ C1] ? __siphash_unaligned+0x289/0x3d0 [ 399.666172][ C1] ___skb_get_hash+0x55/0x6e0 [ 399.670885][ C1] __skb_get_hash+0xd2/0x270 [ 399.675475][ C1] ? verify_lock_unused+0x140/0x140 [ 399.680702][ C1] ? __irq_exit_rcu+0x13b/0x230 [ 399.685589][ C1] ? __skb_get_hash_symmetric+0x3b0/0x3b0 [ 399.691336][ C1] ? nf_conntrack_tuple_taken+0x67/0xb20 [ 399.697015][ C1] nft_trace_init+0x1e0/0x430 [ 399.701731][ C1] ? nf_trace_fill_pkt_info+0x870/0x870 [ 399.707298][ C1] nft_do_chain+0x1612/0x16d0 [ 399.712022][ C1] ? nf_ct_nat_ext_add+0x190/0x190 [ 399.717151][ C1] ? __local_bh_enable_ip+0x136/0x1c0 [ 399.722528][ C1] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 399.728405][ C1] ? mark_lock+0x94/0x320 [ 399.732741][ C1] ? ipt_do_table+0x1371/0x1580 [ 399.737636][ C1] ? nf_nat_inet_fn+0x8c7/0xb30 [ 399.742498][ C1] nft_do_chain_inet+0x25c/0x340 [ 399.747417][ C1] ? nft_do_chain_arp+0xf0/0xf0 [ 399.752265][ C1] ? ipt_do_table+0x2c1/0x1580 [ 399.757017][ C1] ? nf_nat_ipv4_local_fn+0x40d/0x560 [ 399.762395][ C1] ? nft_do_chain_arp+0xf0/0xf0 [ 399.767228][ C1] nf_hook_slow+0xb9/0x200 [ 399.771705][ C1] ? nf_hook+0x390/0x390 [ 399.775944][ C1] nf_hook+0x224/0x390 [ 399.780024][ C1] ? nf_hook+0x9e/0x390 [ 399.784186][ C1] ? __ip_local_out+0x5d0/0x5d0 [ 399.789041][ C1] ? nf_hook+0x390/0x390 [ 399.793269][ C1] ? __kmem_cache_alloc_node+0x19d/0x270 [ 399.798959][ C1] ? igmp_send_report+0x372/0xd30 [ 399.803987][ C1] ? ip_fast_csum+0x1ea/0x2b0 [ 399.808700][ C1] __ip_local_out+0x49c/0x5d0 [ 399.813391][ C1] ? nf_hook+0x390/0x390 [ 399.817631][ C1] ip_local_out+0x26/0x120 [ 399.822052][ C1] igmp_send_report+0x85c/0xd30 [ 399.826893][ C1] ? unsolicited_report_interval+0x390/0x390 [ 399.832898][ C1] ? detach_timer+0x30/0x350 [ 399.837474][ C1] ? do_raw_spin_unlock+0x11d/0x230 [ 399.842677][ C1] igmp_timer_expire+0x1fe/0x500 [ 399.847604][ C1] call_timer_fn+0x1ac/0x670 [ 399.852217][ C1] ? igmp_start_timer+0x2b0/0x2b0 [ 399.857238][ C1] ? call_timer_fn+0xcf/0x670 [ 399.861947][ C1] ? __run_timers+0x810/0x810 [ 399.866622][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 399.871939][ C1] ? lockdep_hardirqs_on+0x94/0x140 [ 399.877173][ C1] ? igmp_start_timer+0x2b0/0x2b0 [ 399.882228][ C1] __run_timers+0x56c/0x810 [ 399.886731][ C1] ? detach_timer+0x350/0x350 [ 399.891422][ C1] ? lock_chain_count+0x20/0x20 [ 399.896275][ C1] run_timer_softirq+0x63/0xf0 [ 399.901141][ C1] handle_softirqs+0x291/0x910 [ 399.905897][ C1] ? __irq_exit_rcu+0x13b/0x230 [ 399.910749][ C1] ? do_softirq+0x210/0x210 [ 399.915236][ C1] ? hrtimer_interrupt+0x775/0x980 [ 399.920353][ C1] ? irqtime_account_irq+0xb2/0x1b0 [ 399.925551][ C1] __irq_exit_rcu+0x13b/0x230 [ 399.930233][ C1] ? irq_exit_rcu+0x20/0x20 [ 399.934723][ C1] irq_exit_rcu+0x5/0x20 [ 399.938967][ C1] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 399.944587][ C1] [ 399.947518][ C1] [ 399.950516][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 399.956486][ C1] RIP: 0010:finish_task_switch+0x267/0x8e0 [ 399.962407][ C1] Code: d7 08 85 c0 0f 84 38 01 00 00 48 85 db 0f 85 57 01 00 00 e9 e7 04 00 00 4c 89 e7 e8 f3 d0 e1 08 e8 ae 17 2f 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 399.982022][ C1] RSP: 0018:ffffc90000177be0 EFLAGS: 00000282 [ 399.988078][ C1] RAX: 3ca89df17b9d1b00 RBX: 0000000000000000 RCX: 3ca89df17b9d1b00 [ 399.996056][ C1] RDX: dffffc0000000000 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf6420 [ 400.004028][ C1] RBP: ffffc90000177c30 R08: ffff8880b8e3acc3 R09: 1ffff110171c7598 [ 400.012021][ C1] R10: dffffc0000000000 R11: ffffed10171c7599 R12: ffff888017739e00 [ 400.019996][ C1] R13: ffff8880b8f3ba08 R14: dffffc0000000000 R15: ffff8880b8f3b790 [ 400.027965][ C1] __schedule+0x1087/0x4030 [ 400.032482][ C1] ? sched_clock_idle_sleep_event+0x10/0x10 [ 400.038369][ C1] ? release_firmware_map_entry+0x187/0x187 [ 400.044264][ C1] ? flush_smp_call_function_queue+0x127/0x350 [ 400.050493][ C1] ? generic_smp_call_function_single_interrupt+0x120/0x120 [ 400.057762][ C1] ? tick_nohz_restart_sched_tick+0x1e0/0x1e0 [ 400.063899][ C1] schedule_idle+0x4a/0x90 [ 400.068304][ C1] do_idle+0x635/0x680 [ 400.072387][ C1] ? idle_inject_timer_fn+0x60/0x60 [ 400.077572][ C1] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 400.083738][ C1] ? schedule_idle+0x57/0x90 [ 400.088321][ C1] cpu_startup_entry+0x3f/0x60 [ 400.093123][ C1] start_secondary+0xe4/0xf0 [ 400.097779][ C1] secondary_startup_64_no_verify+0xcf/0xdb [ 400.103733][ C1] [ 400.106754][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 400.114014][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 [ 400.121014][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 400.131051][ C1] Call Trace: [ 400.134317][ C1] [ 400.137145][ C1] dump_stack_lvl+0x188/0x24e [ 400.141815][ C1] ? memcpy+0x3c/0x60 [ 400.145847][ C1] ? show_regs_print_info+0x12/0x12 [ 400.151046][ C1] ? load_image+0x410/0x410 [ 400.155540][ C1] panic+0x2d3/0x710 [ 400.159417][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 400.163908][ C1] ? secondary_startup_64_no_verify+0xcf/0xdb [ 400.169964][ C1] __warn+0x2f8/0x4f0 [ 400.173929][ C1] ? __skb_flow_dissect+0xade/0x6d50 [ 400.179198][ C1] ? __skb_flow_dissect+0xade/0x6d50 [ 400.184466][ C1] report_bug+0x2ba/0x4f0 [ 400.188872][ C1] ? __skb_flow_dissect+0xade/0x6d50 [ 400.194143][ C1] handle_bug+0x3a/0x70 [ 400.198281][ C1] exc_invalid_op+0x16/0x40 [ 400.202769][ C1] asm_exc_invalid_op+0x16/0x20 [ 400.207616][ C1] RIP: 0010:__skb_flow_dissect+0xade/0x6d50 [ 400.213499][ C1] Code: c6 e8 c6 83 4e f9 85 db 0f 84 5b 06 00 00 80 3d d3 dc d8 05 01 0f 85 81 06 00 00 e8 4c 80 4e f9 e9 e7 f9 ff ff e8 42 80 4e f9 <0f> 0b e8 8b 8c fd 01 89 c3 31 ff 89 c6 e8 90 83 4e f9 85 db 74 18 [ 400.233086][ C1] RSP: 0018:ffffc900001dfb00 EFLAGS: 00010246 [ 400.239135][ C1] RAX: ffffffff8833c14e RBX: 0000000000000000 RCX: ffff888017739e00 [ 400.247087][ C1] RDX: 0000000000000100 RSI: ffffffff8adf6400 RDI: ffffffff8adf63c0 [ 400.255042][ C1] RBP: ffffc900001e00c8 R08: dffffc0000000000 R09: 1ffffffff2162648 [ 400.262999][ C1] R10: dffffc0000000000 R11: fffffbfff2162649 R12: ffffffff8e2187fc [ 400.270953][ C1] R13: 1ffffffff1c43100 R14: ffffffff8e218802 R15: dffffc0000000000 [ 400.278912][ C1] ? __skb_flow_dissect+0xade/0x6d50 [ 400.284189][ C1] ? __skb_flow_dissect+0x407/0x6d50 [ 400.289466][ C1] ? __lock_acquire+0x1465/0x7c40 [ 400.294476][ C1] ? mark_lock+0x94/0x320 [ 400.298787][ C1] ? bpf_flow_dissect+0x3f0/0x3f0 [ 400.303803][ C1] ? __lock_acquire+0x138a/0x7c40 [ 400.308838][ C1] ? mark_lock+0x94/0x320 [ 400.313159][ C1] ? __lock_acquire+0x1465/0x7c40 [ 400.318176][ C1] ? __bfs+0x27a/0x560 [ 400.322239][ C1] ? check_path+0x40/0x40 [ 400.326570][ C1] ? verify_lock_unused+0x140/0x140 [ 400.331774][ C1] ? verify_lock_unused+0x140/0x140 [ 400.336967][ C1] ? stack_trace_save+0xf0/0xf0 [ 400.341802][ C1] ? arch_stack_walk+0x10c/0x140 [ 400.346741][ C1] ? mark_lock+0x94/0x320 [ 400.351068][ C1] ? __siphash_unaligned+0x289/0x3d0 [ 400.356341][ C1] ___skb_get_hash+0x55/0x6e0 [ 400.361008][ C1] __skb_get_hash+0xd2/0x270 [ 400.365590][ C1] ? verify_lock_unused+0x140/0x140 [ 400.370799][ C1] ? __irq_exit_rcu+0x13b/0x230 [ 400.375649][ C1] ? __skb_get_hash_symmetric+0x3b0/0x3b0 [ 400.381356][ C1] ? nf_conntrack_tuple_taken+0x67/0xb20 [ 400.386981][ C1] nft_trace_init+0x1e0/0x430 [ 400.391641][ C1] ? nf_trace_fill_pkt_info+0x870/0x870 [ 400.397191][ C1] nft_do_chain+0x1612/0x16d0 [ 400.401851][ C1] ? nf_ct_nat_ext_add+0x190/0x190 [ 400.406947][ C1] ? __local_bh_enable_ip+0x136/0x1c0 [ 400.412310][ C1] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 400.418185][ C1] ? mark_lock+0x94/0x320 [ 400.422502][ C1] ? ipt_do_table+0x1371/0x1580 [ 400.427370][ C1] ? nf_nat_inet_fn+0x8c7/0xb30 [ 400.432215][ C1] nft_do_chain_inet+0x25c/0x340 [ 400.437134][ C1] ? nft_do_chain_arp+0xf0/0xf0 [ 400.441963][ C1] ? ipt_do_table+0x2c1/0x1580 [ 400.446712][ C1] ? nf_nat_ipv4_local_fn+0x40d/0x560 [ 400.452069][ C1] ? nft_do_chain_arp+0xf0/0xf0 [ 400.456897][ C1] nf_hook_slow+0xb9/0x200 [ 400.461299][ C1] ? nf_hook+0x390/0x390 [ 400.465530][ C1] nf_hook+0x224/0x390 [ 400.469589][ C1] ? nf_hook+0x9e/0x390 [ 400.473729][ C1] ? __ip_local_out+0x5d0/0x5d0 [ 400.478568][ C1] ? nf_hook+0x390/0x390 [ 400.482797][ C1] ? __kmem_cache_alloc_node+0x19d/0x270 [ 400.488418][ C1] ? igmp_send_report+0x372/0xd30 [ 400.493423][ C1] ? ip_fast_csum+0x1ea/0x2b0 [ 400.498086][ C1] __ip_local_out+0x49c/0x5d0 [ 400.502744][ C1] ? nf_hook+0x390/0x390 [ 400.506972][ C1] ip_local_out+0x26/0x120 [ 400.511371][ C1] igmp_send_report+0x85c/0xd30 [ 400.516213][ C1] ? unsolicited_report_interval+0x390/0x390 [ 400.522179][ C1] ? detach_timer+0x30/0x350 [ 400.526750][ C1] ? do_raw_spin_unlock+0x11d/0x230 [ 400.531932][ C1] igmp_timer_expire+0x1fe/0x500 [ 400.536871][ C1] call_timer_fn+0x1ac/0x670 [ 400.541444][ C1] ? igmp_start_timer+0x2b0/0x2b0 [ 400.546449][ C1] ? call_timer_fn+0xcf/0x670 [ 400.551124][ C1] ? __run_timers+0x810/0x810 [ 400.555784][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 400.560971][ C1] ? lockdep_hardirqs_on+0x94/0x140 [ 400.566151][ C1] ? igmp_start_timer+0x2b0/0x2b0 [ 400.571157][ C1] __run_timers+0x56c/0x810 [ 400.575652][ C1] ? detach_timer+0x350/0x350 [ 400.580315][ C1] ? lock_chain_count+0x20/0x20 [ 400.585159][ C1] run_timer_softirq+0x63/0xf0 [ 400.589939][ C1] handle_softirqs+0x291/0x910 [ 400.594688][ C1] ? __irq_exit_rcu+0x13b/0x230 [ 400.599521][ C1] ? do_softirq+0x210/0x210 [ 400.604010][ C1] ? hrtimer_interrupt+0x775/0x980 [ 400.609108][ C1] ? irqtime_account_irq+0xb2/0x1b0 [ 400.614289][ C1] __irq_exit_rcu+0x13b/0x230 [ 400.618949][ C1] ? irq_exit_rcu+0x20/0x20 [ 400.623435][ C1] irq_exit_rcu+0x5/0x20 [ 400.627673][ C1] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 400.633295][ C1] [ 400.636210][ C1] [ 400.639121][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 400.645098][ C1] RIP: 0010:finish_task_switch+0x267/0x8e0 [ 400.650906][ C1] Code: d7 08 85 c0 0f 84 38 01 00 00 48 85 db 0f 85 57 01 00 00 e9 e7 04 00 00 4c 89 e7 e8 f3 d0 e1 08 e8 ae 17 2f 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 400.670499][ C1] RSP: 0018:ffffc90000177be0 EFLAGS: 00000282 [ 400.676546][ C1] RAX: 3ca89df17b9d1b00 RBX: 0000000000000000 RCX: 3ca89df17b9d1b00 [ 400.684506][ C1] RDX: dffffc0000000000 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf6420 [ 400.692479][ C1] RBP: ffffc90000177c30 R08: ffff8880b8e3acc3 R09: 1ffff110171c7598 [ 400.700435][ C1] R10: dffffc0000000000 R11: ffffed10171c7599 R12: ffff888017739e00 [ 400.708388][ C1] R13: ffff8880b8f3ba08 R14: dffffc0000000000 R15: ffff8880b8f3b790 [ 400.716361][ C1] __schedule+0x1087/0x4030 [ 400.720862][ C1] ? sched_clock_idle_sleep_event+0x10/0x10 [ 400.726746][ C1] ? release_firmware_map_entry+0x187/0x187 [ 400.732638][ C1] ? flush_smp_call_function_queue+0x127/0x350 [ 400.738786][ C1] ? generic_smp_call_function_single_interrupt+0x120/0x120 [ 400.746061][ C1] ? tick_nohz_restart_sched_tick+0x1e0/0x1e0 [ 400.752118][ C1] schedule_idle+0x4a/0x90 [ 400.756520][ C1] do_idle+0x635/0x680 [ 400.760574][ C1] ? idle_inject_timer_fn+0x60/0x60 [ 400.765755][ C1] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 400.771898][ C1] ? schedule_idle+0x57/0x90 [ 400.776474][ C1] cpu_startup_entry+0x3f/0x60 [ 400.781223][ C1] start_secondary+0xe4/0xf0 [ 400.785801][ C1] secondary_startup_64_no_verify+0xcf/0xdb [ 400.791684][ C1] [ 400.794931][ C1] Kernel Offset: disabled [ 400.799316][ C1] Rebooting in 86400 seconds..