last executing test programs: 18m15.910861704s ago: executing program 3 (id=1345): gettid() sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, 0x0, 0x0) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 18m12.457777209s ago: executing program 3 (id=1353): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) msync(&(0x7f0000bc9000/0x2000)=nil, 0x2000, 0x4) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, 0x0) listen(0xffffffffffffffff, 0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) r3 = socket$netlink(0x10, 0x3, 0x13) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080028bd7000ffdbdf250100000000000000014100000000000000000000050000936574683a65727370616e3000"], 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x48c0) msgsnd(0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x5800) 18m6.819619627s ago: executing program 3 (id=1363): mkdirat(0xffffffffffffff9c, 0x0, 0xbd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x47, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@newlink={0x54, 0x10, 0x401, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x1ff, 0x9}}]}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) 18m5.510282269s ago: executing program 3 (id=1364): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) inotify_init1(0x800) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) socket$nl_route(0x10, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r0], 0x3c}, 0x1, 0x0, 0x0, 0xc881}, 0x10) 17m58.949703589s ago: executing program 3 (id=1375): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/kernel/mm/ksm/pages_to_scan\x00', 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x74) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) 17m57.902772755s ago: executing program 3 (id=1377): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000640)=[{&(0x7f0000000080)="89e7ee2c67062f080700000088ca54", 0xf}], 0x1) 17m42.133385181s ago: executing program 32 (id=1377): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000640)=[{&(0x7f0000000080)="89e7ee2c67062f080700000088ca54", 0xf}], 0x1) 14m57.826186683s ago: executing program 2 (id=1611): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) dup(r0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x808b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000003980)={0xb, {{0xa, 0x0, 0x0, @mcast2, 0x1}}, 0x0, 0x2, [{{0xa, 0x0, 0x0, @empty}}, {{0xa, 0xfffc, 0x0, @remote, 0x7}}]}, 0x190) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200), 0x0, 0xfffffffffffffffe) 14m55.598885198s ago: executing program 2 (id=1612): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socketpair(0x1e, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x18, 0x30, 0xffff, 0x1000000, 0x0, {0x0, 0x0, 0x1300}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x2000c010}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) lseek(r3, 0x289e0cb5, 0x0) 14m53.369132772s ago: executing program 2 (id=1615): r0 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) sched_setaffinity(r0, 0x47, &(0x7f0000000200)=0x7) process_vm_readv(r0, &(0x7f0000000800)=[{&(0x7f0000000540)=""/7, 0x7}, {0x0}], 0x2, &(0x7f0000002d40)=[{&(0x7f0000000840)=""/216, 0xd8}, {&(0x7f0000000a40)=""/7, 0x7}, {&(0x7f0000000a80)=""/4096, 0x1000}, {0x0}, {0x0}], 0x5, 0x0) 14m52.913409783s ago: executing program 2 (id=1616): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) msync(&(0x7f0000bc9000/0x2000)=nil, 0x2000, 0x4) listen(0xffffffffffffffff, 0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) r3 = socket$netlink(0x10, 0x3, 0x13) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080028bd7000ffdbdf250100000000000000014100000000000000000000050000936574683a65727370616e3000"], 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x48c0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x7, 0xffffffff}, 0x8, 0x10, &(0x7f0000000040)={0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) msgsnd(0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x5800) 14m44.955828688s ago: executing program 2 (id=1624): r0 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) sched_setaffinity(r0, 0x47, &(0x7f0000000200)=0x7) process_vm_readv(r0, &(0x7f0000000800)=[{&(0x7f0000000540)=""/7, 0x7}, {0x0}], 0x2, &(0x7f0000002d40)=[{&(0x7f0000000840)=""/216, 0xd8}, {&(0x7f0000000a40)=""/7, 0x7}, {&(0x7f0000000a80)=""/4096, 0x1000}, {0x0}, {0x0}], 0x5, 0x0) 14m44.335538244s ago: executing program 2 (id=1627): socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000040)={0x28, 0x7, 0x0, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x48, 0x7, r2, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x11403f, 0x3f}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) nanosleep(&(0x7f0000000000), 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000100)={0x3, 0x8000000000000001, 0xfffffffffffff329, 0x5, 0x77b2, 0x1, 0x100000001, 0xd}, &(0x7f0000000140)={0x6b0f, 0x3, 0x0, 0x1, 0x81, 0x9, 0x9}, &(0x7f0000000180)={0x5, 0x3, 0x6, 0x10, 0x4000000000000000, 0x9e54, 0x126, 0x6}, &(0x7f0000000200)={r4, r5+60000000}, &(0x7f0000000300)={&(0x7f00000002c0)={[0xfffffffffffffff9]}, 0x8}) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) 14m28.993010439s ago: executing program 33 (id=1627): socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000040)={0x28, 0x7, 0x0, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x48, 0x7, r2, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x11403f, 0x3f}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) nanosleep(&(0x7f0000000000), 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000100)={0x3, 0x8000000000000001, 0xfffffffffffff329, 0x5, 0x77b2, 0x1, 0x100000001, 0xd}, &(0x7f0000000140)={0x6b0f, 0x3, 0x0, 0x1, 0x81, 0x9, 0x9}, &(0x7f0000000180)={0x5, 0x3, 0x6, 0x10, 0x4000000000000000, 0x9e54, 0x126, 0x6}, &(0x7f0000000200)={r4, r5+60000000}, &(0x7f0000000300)={&(0x7f00000002c0)={[0xfffffffffffffff9]}, 0x8}) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) 12m23.882403262s ago: executing program 4 (id=1817): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) msync(&(0x7f0000bc9000/0x2000)=nil, 0x2000, 0x4) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, 0x0) listen(0xffffffffffffffff, 0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) r3 = socket$netlink(0x10, 0x3, 0x13) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20004040}, 0x48c0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x7, 0xffffffff}, 0x8, 0x10, &(0x7f0000000040)={0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) msgsnd(0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x5800) 12m15.943742146s ago: executing program 4 (id=1825): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) msync(&(0x7f0000bc9000/0x2000)=nil, 0x2000, 0x4) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, 0x0) listen(0xffffffffffffffff, 0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) r3 = socket$netlink(0x10, 0x3, 0x13) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0], 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x48c0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x7, 0xffffffff}, 0x8, 0x10, &(0x7f0000000040)={0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) msgsnd(0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x5800) 12m7.760579526s ago: executing program 4 (id=1835): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) msync(&(0x7f0000bc9000/0x2000)=nil, 0x2000, 0x4) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, 0x0) listen(0xffffffffffffffff, 0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) r3 = socket$netlink(0x10, 0x3, 0x13) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x48c0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x7, 0xffffffff}, 0x8, 0x10, &(0x7f0000000040)={0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) msgsnd(0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x5800) 12m1.363291493s ago: executing program 4 (id=1843): msgget$private(0x0, 0x230) prlimit64(0x0, 0xe, &(0x7f00000006c0)={0x8, 0x80020100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0xc4c03d12, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x47, &(0x7f0000000200)=0x7) process_vm_readv(r1, &(0x7f0000000800)=[{&(0x7f0000000540)=""/7, 0x7}, {0x0}], 0x2, &(0x7f0000002d40)=[{&(0x7f0000000840)=""/216, 0xd8}, {&(0x7f0000000a40)=""/7, 0x7}, {&(0x7f0000000a80)=""/4096, 0x1000}, {0x0}, {0x0}], 0x5, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, 0x0, 0x0) fadvise64(r3, 0xc, 0xc35, 0x3) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x30, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x10, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9, 0x1, "261fbabd4e"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CMP_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x104}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4) 12m0.153034842s ago: executing program 4 (id=1846): r0 = socket(0x10, 0x803, 0x0) syz_emit_ethernet(0x76, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) clock_adjtime(0x0, &(0x7f0000000280)={0x1000000000066fb, 0x800000000004, 0x376, 0x0, 0x0, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x200000240b, 0x3f, 0x9, 0x0, 0x80, 0xfffffffffffffffd, 0x1fff, 0xfffffffffffffffc, 0x4, 0x1010000000000, 0x0, 0xffff, 0x100000000003f89, 0x0, 0x7fffffffffffffff}) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r4, &(0x7f00000001c0)={0x1f, @any, 0x6}, 0xa) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f0000000d40)={0x0, 0x7}, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/graphics/fbcon/rotate\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) r6 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000600)={{{@in=@broadcast, @in=@loopback, 0x0, 0x0, 0x0, 0x5, 0x2, 0x20, 0xa0, 0x6c}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x40000, 0x1000000000004, 0x2, 0xa78a}, 0xfffffffe, 0x0, 0x2, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x0, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x3506, 0x4, 0x2, 0x2}}, 0xe8) sendmmsg(r6, &(0x7f0000000480), 0x2e9, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x3]}}) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) 11m58.456767664s ago: executing program 4 (id=1850): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) msync(&(0x7f0000bc9000/0x2000)=nil, 0x2000, 0x4) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, 0x0) listen(0xffffffffffffffff, 0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) r3 = socket$netlink(0x10, 0x3, 0x13) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, 0x0, 0x48c0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x7, 0xffffffff}, 0x8, 0x10, &(0x7f0000000040)={0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) msgsnd(0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x5800) 11m42.898817405s ago: executing program 34 (id=1850): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) msync(&(0x7f0000bc9000/0x2000)=nil, 0x2000, 0x4) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, 0x0) listen(0xffffffffffffffff, 0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) r3 = socket$netlink(0x10, 0x3, 0x13) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, 0x0, 0x48c0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x7, 0xffffffff}, 0x8, 0x10, &(0x7f0000000040)={0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) msgsnd(0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x5800) 7m8.789418064s ago: executing program 5 (id=2198): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$udf(&(0x7f0000000c40), &(0x7f00000000c0)='./file1\x00', 0x10048, &(0x7f00000009c0)=ANY=[@ANYRES16, @ANYRES32], 0x67, 0xc54, &(0x7f0000002500)="$eJzs3U9onOl9B/DfMyOtRtp0o80m3qTNbgdSEqPUxv9iK7gEOVbUBhxviKzQPUWjP3aGlSUjyY03bYPakhZ6Cd1L6aWIJksLOfTU7TFKs4WEUighh+RQEDRZ9tCDDoHSll2F951npJEs27Nry5LXn88y+33nnd87ev6M3nkFfmYCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIj47OcunDiZDroVAMDDdHn8SydOe/8HgMfKFX//AwAAAAAAAAAAAADAYZeiGkcixcBrG2myvN9Su9Scv3lrYnRs78P6U6SoRLWsL261k6dOn/nU2XPD7bz78Q/aR+KF8SsX6hd/dvzG4uzS0uxMfWK+Ob0wM9v1M7SOX7j+bo/fbagcgPr1l27OXL26VD91/PSOh28NvtH35JHB8+eOnR1u106Mjo2Nd9T09L7rn36bO63weCKq0YgUbw2+mRoRUYn7H4t7vHb2W3/ZiaGyExOjY2VH5pqN+eXiwVTJVZWIesdBI+0xeghzcV9GIlaK5hcNHiq6N36jsdiYmputf7GxuNxcbi7Mp0qrtUV/6lGJ4RSxGhHrfbc/XW9U4/lI8cqJjTQVEdX2OHyyXBh87/ZU9qGPXSjaWe+NWK08AnN2iPVFNS5Hil++fjSmizHLt/h4xBeKfC3i1SI/E5GKF8aZiF/s8Tri0dQT1fj3SLGQNtJMeT5on1cufbn++fmrCx217fPKI//+8DAd8nNTLaoxVZ7xN9K7v9gBAAAAAAAAAAAAAAAA4EHrj2p8O1L82XN/UK4rjnJd+vvPD7/vxd/tXDP+7D2ep6g9HhErle7W5PbmpcOpUvy3Dx2jK7Woxjfy+r8/OejGAAAAAAAAAAAAAAAAAAAAPNaq8WKk+Mqxo2k1Or9TvDl/rX6lMTXX+lbY9nf/tr8zfXNzc7OeWjmSczLnSs7VnGs513NGJR+fcyTnZM6VnKs513Ku54xqPj7nSM7JnCs5V3Ou5VzPGT35+JwjOSdzruRczbmWcz1nHJLv7gUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeC+pRDXejhTf+tpGihQRIxGT0cq1voNuHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQqKVqHI8Uay/WyvurlYgrEfH25uZmefvfzc3NiI1i+34ddF8BAAAAAAAAAAAAAAAAAADg0ErV+FikeOb/NlI9Im4NvtH35JHB8+eOnR2uRjVSUdJZ/8L4lQv1iwvXbyzOLi3NztQnLn7nnfy42qXm/M1bE6NjD7wjXem/vf3zzemFmdlun+Ae7e+vXVy48fJi89pXl/d8fKB2YWppebExvffD0R+ViMnOPUNlgydGx8pGzzUb8+WhqXKHBlYiRrrtDAAAAAAAAAAAAAAAAAAAAIfGQKrG5yLFz//zTGqvG+9prfn/tda96lbtq3+0/VkAc7uyrfPzA7rZTt02dKhceF+fGB0bG+/Y3dN7e2nRppSq8Wyk+MQrHy7Xw6cY2HNtfFH3VFF3/UyuG/yNom5lR1VtaGJ0rH55Yf7Yhbm5henGcmNqbrY+fqMxfdsHBzzVbYcAAAAAAAAAAAAAAAAAAABg20Cqxk8ixX//w3+k9vfO5/X/Pa17Hev/f6dcQl+qpZ25pVzb/1S5tr+1/f7zwwPPP3en/fux/r9oU0rV+Ob2xxVsrf+f3FVb1P1FpHjzuY+Wj6WoPFHUNdrdaT3j1ebc7Imi9m8jxW++1a6NsvZarn1mu/ZkUdsfKf56Y2ftV3PtB7drTxW1RyPFD/5r79oPbdeeLmp/Hin++e/r7dqBovYPc+2R7drj0wtzM/ca1mL+vxspvnP591K7z3ec/47Pf1jZlVtum/O7b3c//+127D3/gx37VvK8/nmkOP2TD5dzebf5Pxspvlv7aK5rjf1Ufvzp8v/b8/+JSPGzf9tZezXXfmC79mS33Tpoxfx/O1J8/29+utXnPP95ZLdnqHP+f71nZ269SvZt/u/++/90x77B3K7pdzgWj6Oll7/+UmNubnbxvjdqz0c8iOfpdqN4me77z8qfgRMPsV82bByGjXudOb7Xv/9nJ/Zb8f7/l5Hi/49UU/s6Jr//v691b/v673++sf3+f35Xbjmg9/8PdOw7n69aensiasvXb/Q+G1Fbevnrx5rXG9dmr83Onzp54tOfPnvyxMmzvU+0L+62t7oeu/eCYv5/FCl+/I8/3vo7Zuf1397X/wO7cssBzf8znX3acV3T9VA8lor5/7tI8fRnf7r19+bdrv/bf/8f/djO3Pr9O6D5/2DHvsHcruY7HAsAAAAAAAAAAIBHyUCqxl9Fit//099O7TVE3fz7v5ldueWA/v3XkY59Mw90XcOdN7oeZACAQ6S4/vtQpPje5g+31nLvvP6L32rXdl7/3clh+P5/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB41KWoxh9HioHXNtJaX3G/pXapOX/z1sTo2N6H9adIUYlqWV/caidPnT7zqbPnhtt5qe9hduMj8cL4lQv1iwvXbyzOLi3NztQn5pvTCzOzXT/D/R6/21A5gPXrL92cuXp1qX7q+OkdD98afKPvySOD588dOzvcrp0YHRsb76jp6X3XP/026Q77n4hq/DBSvDX4Zvp+X0Ql7n8s7vHa2W/9ZSeGyk5MjI6VHZlrNuaXiwdTJVdVIuodB420x+ghzMV9GYlYKZpfNHio6N74jcZiY2putv7FxuJyc7m5MJ8qrdYW/alHJYZTxGpErO/xK9kb1fhmpHjlxEb6l76IanscPnl5/EsnTt+7PZV96GMXinbWeyNWK4/AnB1ifVGNf4oUv3z9aPygL6InWrf4eMQXinwt4tUiPxORihfGmYhfPNRTO/upJ6pxJlIspI30el9xPmifVy59uf75+asLHbXt88oj//7wMB3yc1MtqvGj8oy/kf519+/1wAE1CgAAAAAAAAAAAAAAAIByJe1qpPjKsaOpXB+8taa4OX+tfqUxNdda1tde+9deM725ublZT60cyTmZcyXnas61nOs5o5KPzzmSczLnSs7VnGs513NGNR+fcyTnZM6VnKtl9m21eD3vj558fM6RnJM5V3Ku5lzLuZ4zDsnaPQAAAAAAAAAAAAAAAAAA4L2lEtXyW9y/9bWNVC6VHomYjFau+Z7f97xfBQAA///sg2Mq") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$sock_timeval(r3, 0x1, 0x14, 0x0, 0x0) getsockopt$bt_BT_POWER(r3, 0x112, 0x9, 0x0, &(0x7f00000005c0)) r4 = syz_pidfd_open(r0, 0x0) r5 = pidfd_getfd(r4, r1, 0x0) connect$unix(r5, 0x0, 0x0) r6 = syz_open_dev$loop(&(0x7f00000000c0), 0x81, 0x141200) r7 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, 0x0) ioctl$LOOP_CHANGE_FD(r6, 0x4c03, r7) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000280)='./file1\x00', 0xc, &(0x7f0000000300), 0x2, 0x53a, &(0x7f00000011c0)="$eJzs3c9vI1cdAPDvOPHmR7NNCj0AArqUwoJW6yTeNqp6YXsBoaoSouLEYRsSN4pir6PYK5qwh+yReyVW4gT8B9w4IPXEgRs3kDj0Ug5IC6xADRIHoxlPEjexE7dJ7ST+fKTJzHszO9/34n3veV5kvwBG1o2I2I2IaxHxdkTM5vlJvsXd9pZe99HThyt7Tx+uJNFqvfXPJDuf5kXHv0k9k99zMiJ++L2InyTH4za2dzaWq9XKVp6eb9Y25xvbO7fXC3lOeWlxaeHVO6+Uz62uL9R+++S762/86Pe/+8qHf9r99s/SYs38/Hp2rrMeh4pnjpnk95npyBuPiDfOfOeLYzz//8Plk7a2z0XEi1n7n42x7NUEAK6yVms2WrOdaQDgqkuf/2ciKZTyuYCZKBRKpfYc3vMxXajWG81bs/UH91cjm8Oai2LhnfVqZSGfK5yLYpKmF7Pjw3T5Y+n3Knci4rmIeG9iKjtfWqlXV4f5xgcARtgzR8b//0y0x/9OZ/8rGABw4UwOuwAAwMB1jP9zwywHADA4nv8BYPR8gvHfpwMB4Irw/A8Ao8f4DwCj59Tx/9FgygEADMQP3nwz3Vp77e+/3v+m7turlcZGqfZgpbRS39osrdXra9VKaaXVOu1+1Xp9c/Hlg2Rje+derf7gfvPeem15rXKv4rsEAGD4nnvh/b+kg/7ua1PZFh1rORir4WorDLsAwNCMDbsAwND4PA+Mrj6e8U0DwBXXZYnetnyCIOl1wWOLv8JldfOL5v9hVJ1l/t/cAVxun27+/zvnXg5g8IzhMLparcSa/wAwYszxAz3//p/r+RUhj/u4+d1PXh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4DGayLSmUsrXAd9OfhVIp4npEzEUxeWe9WlmIiGcj4s8TxYk0vTjsQgMAZ1T4e5Kv/3Vz9qWZo2evJf+dyPYR8dNfvvWLd5ebza3FNP9fB/nNx2n+VHOrfG0YFQAAOu2vu/nBYVY2fpfzfceD/EdPH67sb4Ms4pPXI2JyKou/l2/tM+Mxnu0noxgR0/9O8nRb+n5l7Bzi7z6KiC/s138y3u2IMJPNgbRXPj0aP419/dzjd/7+j8YvfKy+hexcui9mv4vPx5HCAad6//V2P5m3vbSJ5+2vEDeyfff2P5n1UGeX9n9pc9071v8VDvq/sWPxk6zN3zhIn1ySJy//4fvHMluz7XOPIr403i1+chA/6d7/Fl/qs44ffPmrL/Y61/pVxM2u9d9fkbqWdbPzzdrmfGN75/Z6bXmtsla5Xy4vLS4tvHrnlfJ8Nkfd/vnHbjH+8dqtZ3vFT+s/3SP+5Mn1j2/0Wf9f/+/tH3/thPjf+nr31//5E+KnY+I3+4y/PH235/LdafzVHvU/5fWPW33G//BvO6t9XgoADEBje2djuVqtbJ1ykL7XPO0aB/0fpM/2F6AY2UHsRpzXDbNJiYjoek36jvpiVPmzOkiGFv03533DYfdMwGftsNH3vuavgywQAAAAAAAAAAAAAABwTGN7Z2Oi+6e1zu1g2HUEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg6vp/AAAA//9W1cZQ") 7m6.775470874s ago: executing program 5 (id=2202): unshare(0x6a040000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x13, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(r0, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$DVB_DEMUX_DMX_STOP(r0, 0x6f2a) mmap(&(0x7f00000d8000/0x2000)=nil, 0x2000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) fsopen(0x0, 0x1) 7m2.930521098s ago: executing program 5 (id=2206): socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet(0xa, 0x801, 0x84) close(0xffffffffffffffff) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x0) sync_file_range(0xffffffffffffffff, 0xfffffffffffffffe, 0xb9, 0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x4008004) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000200), 0x8003, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x0, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'veth0_virt_wifi\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000040)) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r3, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCUNBRIDGECHAN(r3, 0x7434) 6m58.088260397s ago: executing program 5 (id=2213): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x8c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x2c, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0xc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x7, 0x1, "261fba"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CMP_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xf4}}, 0x0) 6m57.275163856s ago: executing program 5 (id=2215): msgget$private(0x0, 0x230) prlimit64(0x0, 0xe, &(0x7f00000006c0)={0x8, 0x80020100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) getpid() ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0xc4c03d12, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x47, &(0x7f0000000200)=0x7) process_vm_readv(r1, &(0x7f0000000800)=[{&(0x7f0000000540)=""/7, 0x7}, {0x0}], 0x2, &(0x7f0000002d40)=[{&(0x7f0000000840)=""/216, 0xd8}, {&(0x7f0000000a40)=""/7, 0x7}, {&(0x7f0000000a80)=""/4096, 0x1000}, {0x0}, {0x0}], 0x5, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, 0x0, 0x0) fadvise64(r3, 0xc, 0xc35, 0x3) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x30, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x10, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9, 0x1, "261fbabd4e"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CMP_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x104}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4) 6m51.465922679s ago: executing program 5 (id=2221): unshare(0x6a040000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x13, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(r0, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$DVB_DEMUX_DMX_STOP(r0, 0x6f2a) mmap(&(0x7f00000d8000/0x2000)=nil, 0x2000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) fsopen(0x0, 0x1) 6m36.149724254s ago: executing program 35 (id=2221): unshare(0x6a040000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x13, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(r0, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$DVB_DEMUX_DMX_STOP(r0, 0x6f2a) mmap(&(0x7f00000d8000/0x2000)=nil, 0x2000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) fsopen(0x0, 0x1) 13.076697577s ago: executing program 0 (id=2859): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$IOMMU_IOAS_UNMAP$ALL(0xffffffffffffffff, 0x3b86, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f0000004200)="a28096c80abf3543ecde7564abff5085d2227ebcb0f164ae92706ad0b083a3f469a3efd15b4921e9c3063b98b3082068e7c31950dde842eac55df0f991453cad62a6956b0b6f7b8cf49b506a3060fe1127eca99663ade8efa89ee189acb5f3b92f6bc4c46621c803eed0d0bb5f32384870ed08f89d4f74445762fb99715e083c4c92a8878be19ffacc30d0f2da64f971cd40563163adc15670ecf25cd3ad96138967c4b53ad9d04b5193ab5fb674aa0030a9d703d1baf810ce897f969121f142161919e583c275671b999e7f363891dfdfdf3556d01b86ee29eca8fccbfeaf1771395148706cc6e6be7ce29fc9ffef061b5420950c1a525bf75ad06edec51538d1c5bbc77da72dc90fd9998936fffdda2427e5a68966c7e2208f76304680182ec73007e482f034195712af922db2726195d997708734db9e7825a864be00b2a4f800881fc0363f5e618398454f35b148b4ccb88d418269fac868a8ba4a2d5b4f06a1ac01b5ad158b842e05adca22c7372585bf4ce95560b6c1e021a3ed2ff7bd3b6b3c7734c3b66d7e4c460096312082f89b16baa6e73814aa60925780cd92cd65087e260ec046fc363264366a9df2c849c0644911303946adad544521ceb469a3e193ecc9a7876403fac461a4a70d6193b2451189a5c5120b3535e9edf619108af7f517b58abd3fa7fb1ab832213430d2e6901076fba9c9e1acc6c6f48ff0e419bbc45589745a176f52a7407ad5e3dd49acb31b47862806f47077dda04905e45a80a12cbcd4d2dd9fe66c2d1f99394fed8ec60961cd2dc7115a96ece432fac86d51bebb08b95f447a83792fe80291fca7b298c9043ef2c26f0f7e42798d3f54c84b94c24c76c555d83ecc53b99bb22d71845e5cf21a5ba7fbeffeb6306e1730db14561b950a3f24bcfd78d4ab0d97de8054bb1a6077ae7cca6e45d846d3df82298d07212922742cb0facac3b77edfbab90e9ee2d4f7b0ee9b17bb11ec5e5721340d84cb6bd93428167e69b47759172557acda313c3decdfc6fe9336bfade459f43b39d0f2289f9142db280f4ee668e650e12858c577e12e2b9a57ee66c834be97979bcbe94747fa5d8d0b7d3a9f8f218df1bf960f828429a1efe838616b18faf6629236ddbded43a093efae163228e5c38fd7714743c2fcca47e3382bcfb1ab893fd7377527b4ec43f3fa60ebd338161d8de7cad65b15579e4af258f5fe3a63c2637a15703207029b0899b5427767647baef11e291358e6e54f6f13d3d2ca7a5e7969e04d2733b3b9ab822c69a3cfac097384de5071a9b74a656136d55eb1000008747b509fd610ff62b4950ef71c934fe21a48a4931d3d9458b415f112cee65c660f5490e982341da1c58634b3967ca6f3596d20cc90f508382156e36f16539093240ef5f2aa6a2c0dff2a67df30dcf50bf6e0b82a3d49f2d532a8dde1b3ceefcf0837190b74186090d1c18b59917d7efce1adfb238ef4a7b1d22c4cef09320221de883e97e6882466508de06fcdabad3b741bdca2cff879d57ddda52f42b3dcb8a78cfc05826af7e4ff155960ff8491194f4d321ef195990abaeeefdcb852d1e1e3703f317385a9458b6c2dd9db830f757ec29c9939fc7313e639fe485bc1e41ddaaef3fbf1f7cc527c8fad0d21b8082482caad7bee440e5097665f636c3dfec82f8c98afb6243bc3944939675a594277d278ba4361461f7da52e224e4ce5dee4a467bf6ae9f67b61ac6eb0a440406abac2016eec907e241c57f5f44be47290fd0fef785ff04df3810ccd637b4d97a84bae8486a36f75d872e645fe46625969fc2d1f032c56ed44bd98ea27bd9b6ddc8eb2dc2ec9f90f2f1ca1bd20e37ac58b03c84c872f4ba47310654986641460dfdd531ac62a76ad87b89c103ac5c9c2e7e70c66447b3412d4a1e5cbc30e16939505116c04de33ae054ed366de8d1f971c2de439957a194e22a488f58d7efd46439177f3f3c45a1475927eecd846d3d2e6a2ab5c7f8addd99062c2fc6b272d1f51bb8f22f1b6f8bb3faf8aa85e5eb9abf7df5cf8f26267323808b0833a987989cbe59205e7ad06556e2d1b8a4873ca1cbcbc8d43abc145fd4eb832e7a58ab2c793d003ce7b1850ce45eb7480417a1e9eb9d39a1028a2a04a2aa649c098c4f8eee514db5f6021173bb254b8e22b150b2ca01dc7ff235db46ed78d07f43d1adab13b8445d1b32069eb45f9d389fcf5a3f7d3ebe243c5b1fe17b1f5a3d571b65f21b9e471e818172554dc956749b99cb7a5f303ec480d7194a2ba86e204f06aa1becdddc8c49082c527e7064ac2ad77dc05639d3d2a7778f6943ed6105ebf6f0b9e94fddbe05c236ec000f4d1d4e496b10068211ab68ada4c7f7ac61f5f5ba5f1810d5bbe87ff4f8356af0d3f682baedb0ad8f8488b277421f0a03fc5e3095ee34bc4472d8f17e3f7013cf2f79f5ff3ea4b6bae56d1365a33b09bfa9a496323f7da923b7e29dce4beb80035f13130004c96e56d7ef6ca6c101d20c27a218e623227c33c9e488b17e7ae9ac20da8240501f7b614a1730f164553fe479ef149866e4ea47296814284a3d3eb7cbb294289ffb996e0eb053b9c16e54cf267832e3d360eb196ed51305630223309ea97215628f01ec9d3ea48096418d5e962cac5063460f0a18772ec7ce66d14a1cce14b52c40bbbfafccbf1e76f09e57ff0718048e5b993157a6cf4718826b1e09430413a3596a15c4a620fa8c8e1d1663e5739f9f790ddbb3be0e00187d43717d659242467d8681ac10303346157f894d9037641417010e9654c6a5b22383e73a5a37128f50078a980c30930321aa5c5e7851d5d392ddce3a14a96916fa8421ae6728f37f5de7c3e98feb4babd4e1bd2315d595e209d52748f70adc2284fcdaa6ad880470d2a071f3490aaf3491fb64b4547419e8eccdc491a8921156cb4811ad1e66514a32b0b31b641438881f28c1e6461b4f451938999af671e8c6a5cd0c072a9fe4cdbefe24ca616f3d0a15ac97cca835b1a440e04fa28340c6044176c8ecc8ee0d033d47db8a0aacfa0eabdfa1c9509fc2604008f01cbafeb5bd2b503b809ed672340b9a576593f1ef388391b54b605e7a15bef7b1345627a34fca57738b0f8f4f19eea93c903495274a4425a1a1cc6c4c6e335b631df5185c95b485a4257867b5347a40e4e14dcc560f061fd4fd265137dc68afd548adde778f1330f769acb1ccf5da14ff6992c24e210ea6e6179421881b803393bc6974e37106c5b5b3b5d0b3469f8969bffb7e4ceb2c98e928e74366492d27235ae4c74a2f48511aeeaa53a2beafa7a331b50e454c507af1b63350a5cef35668a5b9325014192277e509561008b3601088f79d42eaa8b1e4ae2000b31749e2b8094312ddb7f3c1cd625ef885c11fa22a66e374b52b3425e0b8016154e1fd8471339e32e7373d63ab646d893fbe09ae07b06074c01401ea76b3c382a9d32f24f93c789964e16bc4206ecd75c10917ab84ffd8d6cdf4cd28fd90375ff28518f8c1a3befc538e1b9e427fb671988d29f2fb2fcd039f4d341c84eb4d7cf600ddaba88bb094e4d87a1419180149f491368e648b69985b05ac39a4ecdd3c5135f3a5c8ad7792dacb6470144bb9e67805a211efb3ec9ccaf8e0901345fb19e4da579e1fbe86a1207f4f13c3436009c2c640b7cf3f8b77ca7bd994bf93308027359c6dd1b7db1e153fc0821968ef36c003b6c73fe890f4de24f5c6458dbaaf3819edeaa91783c3cfc7e773689236248195c7bbd60113f2476fa3687621d668d1728ee433d2f8f4db707345d30f1e52ab87a2a0afd547c6bb06500f59f17facde48f693490e22494b75d11df1a143b85068d143ef6a9bb5937a9df380c8948f1a01e9675e18409edb0f6b9605b68e34632fcce472dc50b90b0f6dcd57931f78e1e8861a0fb62e72b0baad6f9d23c1cfb0f19b25013c8d9fcd786a2f6f79768b5fb398f7b2baa31ce8156d1fc4a46c1c463fdf30360d42aeed2ef11611d0b7f654bb51052fd4dc39328f8ec4c58bbda05e6f1b3c8f6d8adca0268f2410e9a4a7d63b6616006d0e02f6edacc10e5c54fd85f15a8bd7648a293f23d6a699bd9a675250475a73a96d7475e4fabb89fb5e7de5d7a3479aa485c0befc60d0ac4fd5ac6dbecceb06cad86e219fc0ce4720758917811a3215f8d13e413bfb64fc065fc421aede0b56691797dac428c7e463479fa591b9072c309b7533e427c5cc11a1f6cf9a5b995d328d796d874c5b55dfc12a5039b413ce319cf5ba1f355c4e0717d32650b43e18010f37f048731931c52c4f36eb969dda702afe96c2a5241350a67ba2d026946189c5e281293c9a8e2cff3784776f1de78b917101b54e5ab00c045ea15f28a0e3f509962cf8bd3385d85250737eae5c34ece86b86669c13b00308a3b13c0ac3c83ff26fb52a4aa83c1233a9490cb9ca917a056908931751bddb88a62379a713395f0764e4a393faf253a4026d0472270e6036287d56850df1751543484d65b3062155b6300e0024241c59a862ae769c1a9232a2d9fb24705177a09cceb3eefbf9f106f67e01be14cdeb4d2fc7d8661df3e75de5ccd09a7e559f028fb9837c621ea0045b4d1b679067f246339c974631aa7134d4e910efb28d3c48929cef1df7e6c73668762d55086b6c59c36ac90154135fd7ca4e4047dd0aa161fa982d8edf9c0cb9666477e096c55718f6e4742415fefd4f696d1f1ccd6322bc19496ddebd36282a7c707d5b44113e30678e6e33ab7d34be04a59ac614d6a54134490998be02636fa91633d6294781c2b9a54c611c0045cfcfe81f49aa21b29d835cd2047c854486fd8e65a2ebf629f7ced602b9dd107bfde483e5c9b5cbba4a08cdce09920bda9978b7fc2b4a89bf1573a26389e52090fdf5dccf22111dc8c42fd3c8c477092895398086cc22cca665269e193fc650742a361a44b857d258429f701f22e9b7615bc3dab78c1479a41cf8575cdb17169470b347adfc03e03daea3e269725cfc72df5664b9df36d2f2b55013b71133e0b80577a47182511ebb308b6248d457bd2af7b28e77182c305241178c4124ab102771fd5a8c3dacb8775de881301d71587c76bcf0a97a72ad244d0c42fd71aceec32dd48bb5c9a95b391166c832ac5bac8c7cae4d18b3f7d9f2e4782fdf97732e3d51f67bbb57f989ee0d7589dbd0c2a5c63840e914b9d7d720fa120acbffebf816b588b2ccc052e7fa78992e0ea39dd21a122add41195f8e2e1acd777c1a4e8ef4362fef441feb4d9252c6bfbd2742152300a32027776e3341620d3c8d9365e10e81adcca7d87a0e555c98a0353c692557d90ee9be3fbaab766abf93e2462149fd99c92a5fc58d899ee75535cd1fe1386c5ab0b157c2102039d6015258f59cef3f15b951893a30ae839f740402a30b34e7be73796286403c5beb0853d856d83f1b00b48328f56dcb32e1faab08a3435b1482bf18b21c95aefeaafa7fd761c7f28d416fcde06bf7aee5c6e9eb50e55874253ba3f1d0ce2505b4fc7c3fc996bfbb8446bafe84f5bea94bfd7ca5aeaf237fe793b66e5c521d4092e4e1f9bde1dfcfe53fa55005d21cfa833a338fd9792614129336060e10d1911862070761aa20c2902eb7c5a355eff4cf6253d7102a2ca1fead4c53b57d576d104c081310d92797e4e2e8c269d19910d0d4cedf30fa28ba680c00137f83de940624229b6a125ce5233c6cf4a3640b74f58f288dad8451fbe37641c5559a5f3caf1299c8bfb230723652278fe378efd8e459b9da26cffeb58468a6301dbc06d713ba2d8d43d9038f5f2dc8b831ba58a88eeb5b1786b21e398aeeeb7c1f3d6f01d82b3947862fb9e7cbd7da5d04c5fcd34da28d53e2246e3ac1e3a619ad174efa6435eaa0fc94d610799ce0158421dce046306eb5042143daa336d52206b12610ea6389cdda49bf5af1d4ee42ac090a94ae7b7612073f3a5c36a2245eda887f41478f7d20f18667f941f71eebcfa76c1ab28f2a49a3bd56bd3f4e6bd079ab3fe2d94782236e83585a03e52907abaef7456a95d5d3f3d37efdc035dbfd7c41b8ba0af2df8adf1cf24f7ff0beccd3d26bc91caf42314ef7e466f74e19ae0df2e2298fc2f694a7ec134632035585d530e7e19f65c256f001d75382d9825ef741bc213af186377d9ca10d3722354e1897ca5c23ac6a52c9ad0e6b686e1776f7ec65df033e8f4d5db80c1bc354093b319cb70df93d610667675816328c99322f14e636b95f04e6497f139d508b453f53ddb5c289d849fd5407c9bdcefd1642abd46e28cb4e94371bdc606eeb67c9fe17747c68f2d50e82711da4d3edb0eda06f41b7f93fa8fb4d83cf21c79da67000bac2275508217ade1659fa8d24e5f8efb9f4bd21073ebef3d06368eb03fa3cf0d638448bd055ed20d292033ffdba538559c8ff9a2a5c8f83b5c393643d6585d1df994c3be43e72b8f3f53114d2a5f6bcedb573842b23b6a3eb7fca8495bf03bd03fde7b19bd39a16cec49e01f38e671af33cae082d9788e3202799bc466babec2080528d0609c0b731964719093735b4c1e73bd0705637c47516922197c552baeaf3516b5e3bbc2cd1afa3ef8215196ed580d9561092f620b897e98e786a0c7cbb0eedda8063292ba6482497f5f6bb62fb5ab4c97cb7658dc6579718eb97b547fcf47ced1426561af93a15fb4dc6d3d93b868644943c2c94b23b0570bbb81df2666c24f5abccfcdd71e209f3bb43c01d17f9bc8b9af2c26762fc6a741a150b7d1186e4f35175f3c315243e1c11e92c43a1fc492eef5a13c77a81fcf514ebfd0f8e645dae15a07e86b2f01fda065db4505a5eea83cb616f744f6bee731be191c65449c02603556d5a51422cf9c2f19f8d6843e0c1091e0708aa271e91f71c8602b9fa72189e036b7cb6af1569f21269283de94a6d7fe5849fd433d5b719c80419873db0587fc29786cc598d896fb16360bddd2ce12e54d05418f4f5e5f2d7aafe9fcd6268cbe2e9e6329ffb6c67fab8f3ce673028cc06aaa6b857556bba3b44d3fab5b6e875e70a2f3ad4b2ff76f31ead3462d3801ba373b3c2f545e94f57021575e2947f81f53283fc0a5137fd44fa3d074c92de54a0a3465c858f5a7ef08313faddbc3663e4e0167f3cba39612057a7518fbfb031f5ad0f9f75831973ebd733b82e554bf3fdec84e51f65dab6028c6c51366d9d4700fdf255e4c7bd70766e7f2281b3f2a5363f85ce49f9135904d14bcb117ad754c2594dcdca2d30e40ff265b5accfb116f64ed99aad570c4c5a91efdbb984ac651d8721405a0342cf77f448c17a152eabf29e88950558a86d0074e1cefab1eb7c366682f686ee1338737e675ea58eb8b4c86b9f28a6f6e96459f29e3b4dc59ff044c61a0dcc5c31d803e6e98420e446229ccdec3d0f705e92ffe016bb3696373eadab7f35ccf65ab4d9be09a085ce21bbd7c0555376e4d7fe68b5e7a64f48b5127825fb2be598d991f9c1a54bf52713417dcc599e812d85513a537e6eafa738edc972b67e065595d11678449bce6cd3d69800a649b560d0e057c502ca3e72e97820829ecfea801192c3f4e2c8763c095a43ee6fe45fe8730130937668df1d4ee577ada28238be03286481f2d2a004cc4d48856e71fbd64f1a0043a4520ecbbf1b3abdc96b87a27be8495a20542967aa4cd3a44a11502419a083d84e97abfde0901b66dde48388649a0ed6d93b9f20c530e990c7c52370a114d800d6ab3f6687d6bbc105b63738fe05fa6cac98ad6663936bb18cb923264e4c921012b68a26a70977446b8f15f9d62467d8b356560c183a6bd6cd76ec868c3bd94a595cd7bf996755a508a814980c5e588b275200c45afd900c8c2de329ec2484b0e3ecd7b0960e5e3425881d1ff7f8bd8b20f5cc98ffc3acb77f5e88775a4bd3ab9f9eb027e27d3af55ebdf4eebab48ea911128d668d00fc3f5b5480aa0d9a4af563ba577384448e5425157133d59e1cef3c722f33700bd372825046b1fa5824e405154a3af1440bc2b75acfbd07cf92e8c162587e74b5ab66b1c6aeab3ad5fa3ee91da4900ef30ad04baea326df912517dd96e1696b4a91faa66675978a375e81f25464a1073dc6737af08d7e25956bb31d438548a7da38662d49db812a8cf1d6cc65f5c63879fd9ee7fd2a66ca3fc1a768cb239aab88c87206470b4c60592afeb6d69ed97a8f990155862ba4e22b64804142c131a23792937aa8a8696e165c24d7692a04bb4471b0f0d2507fe7c8618421428fc7a0acc984ca5cc6bacb772e8a717bbaa646f9643275910a6037afaf5a80678d18edda138a4e13d06d04a5d06431eab48738225cf1567e960e765728dc12e91b91c6f2b33dfb6e033aa68c1c2334d24335abc4a7a1df5636dec29091da54d5f5a1fff41e4a35a0c2f04f968f7d78e2f51c73577e2192bb20f289aaba5a175c2ed533855bd9ed9a842ad482136dd5e0cf45eb5e2d31ff62a3be1cf8a94a58316e74f4ab9fc54f3a0bb83beef0f355993bdea2c83e61cdc796bf2564ae51fae616799e8711998cd88d35cd9824452fdd65226174b46792cb87f4dd282e4e6f67eb66da413ad877ed6ce775f7e19bc93f48bb9e5ec04009de3c042aeacf7f4b25ad6b30e017303f64fe07ac79e8744aab6926d117f13513d0469cef335fe1d0d787c2d0b2c031a9521786ac10e9f8b768271680337f2c3262abdccb5d3107c632bf1f74c83ee91f49988222fb080cc8faa9b1a02526d8b6087e0b2354173d29016b3309587c16f057dd812aa63c3169150de81f3af97d082a8f8da4ce4f909ff649821d7f96d97613552e8cc4902e046ecfa329b1d980ff5ece69b8f1615fdff5244f41cec0af924624ae1641ecae5fa26c5fb9006e57100ee71377ced7c255ae17a0845e2ee0287c62c1852f93877f9f86157ca9675d383fff5cd6f2b001ec0136c07cf37f5ace1853122c2baa1092d418e2a490c4a5c8f56b828ce1bafeef4e77f095d6b4ed99d56f66812cb19be540ebe5d52e7eff2d69cbb8477e11514f7e3604bf9999f78c2f1ca6f60a2216b87fa0f25269c425b7d50709b200912b3b7899c95e12d6e9c4dacc19e327721860e0477a53e6793fbb7fb9704a848f395f48c24a6e79b9e1358cc3497251de88b8d3a7b22c6d8af1a7fab81530d9f0cc98f62debb222b54780d89794238532717b447d71b46a60ed481c21db85b590b31720009695ecffd4ef029964e5d5149622233ac013e960a005c924f73ea82c318455546c53d74aa3f7e2ff26aa074c40a55aba8b08027fc19b596eec6c4f89bae39e74b9aad88344f7cc5ad3eefa5095f2ab47222e9a357ecd71c6700ac576025201490d9e446603dfd4bda7617dd500981b2d2ab8c43882a5208494cb3f8ebc720bca8a7cf6c80bd7aaaf89507bb3412ea490a78973f12cc30413e9df1458917ea3d68b438d424c1314bc8d01939c5a5a842438281e62d0c800dee704b2a6cd3e1e4b885a6b26b894a98765fa3308c9e4b87f93625faecdb17c29a27cd243bf6030a67874ec9f2443cf8154261ac2a834c01cbe1f314ee7aa3ca552e1648cf8b42a63f249e3538026e09e44d69dc259adb0d1a0cbccb5a5dd5d0dccc90d023da79d5634188ff060f7e35a5f9d7ad99546824d63975d4452de876093f4e997dc46eedcd80a9eebf5e4f077fbb10c7d9e19a3419e7b845972a3b62613c5404a209b16fa88e0ff49d7b4f21fecc1f773c5b4be61021e0cab8602c6e8257649303aaeafcbb178e7a460ff07f219c46eb6fe5bf8113723e454003bd707767c107daf4255751daaf8decf35262640058924eb6587868b2c08230b317e97396ebc928ba8d274ca0eed0bfcb637676003c64e8c1e1a0420b6c96a44226061ced41b8448382abd2f3d0c472afcde231fbc9ee90c2f1132f8e2391246f95ad93354c7460e20de996ad0f61b13b27646887a637cede90b94b7d8c3130f0fe060e8d955c711a2700b302a75bdeb32a0a6802ea795cb114f5f82a1a381a86bbff88b299e47728b746dff964c94c52b661b9429376b1320b46081426b7c340206dc0da151bf84be2a49e78b6b5938753d2b1be8d9e67c43c5d70e72519f5f90d0500e84ee38f82b191ac4d968b0a37901fd923cb289d585693ac3c3f8a94fca6df45e694e199a9cd0b1bc1fa7394bcc96aae670dca6605a998793b7e067ac410ba631057b8b76fcbe9524df820c02efef1608b743cd2aa6d60d3d8e476fa12d3acc329f8272b087d89471177ed531fec1f9c24a975ca2fcd8c246a33e291a3f00b7f234052067a0059c86762475256bb5e7dac6f121a0925506b18933c6e314915d4b3b2130aafc2483ef22ff8bb7b887565b1bd22fabca22037d8fc9437f675c5313526266f60bb7c7c47f30c7d567ed142ea5ec367c4298328d20e5344f01c0c90cf8a6302f4d84b6ba7495fba314a05ba29b63bb6d458fdb05a4411136958309f418fb178e19aa09ff9e62b29732fb2986c96e738f7a688cb2122dbb8f2ad9a5f28bc49ec0c462413552afee8e403259b55ad6dc334dde7f2d306929dd01f2aa6036cafd41874522689301b81c9e50e86828894140356db0a3317b081ed9d8148c41e77e6bda6287762532b86eb91f5480915680deb8a91fb8652b7f0109064865d2b846af0861f67d3f720d6e306540cd7b68f095ef3690b88ea93fb6a402ff5697597cda83171f159e85307d1a8c01611189bd4eb4f0453ab88d43ae181a562a76902a67c687514079d6f4304d9a7c0fa24b6e86074ea0a9fd8187c120312078f5ebfa674adc0303734bf8f6b5585943706594192ad64c9f7d9794fb83758924f862855ddd50bff58b522c43d73c03289baec628cd693cab93101b1e473b76532510e10f03e86812fea6f2d6f5467dcf29e6d7cf8524f383a0ded3f0951c3ffb171a6b8a6d97b5fa8899a19f1a3d0e934a1d4741076e4394ba225158f697bf7d5651717c6950229a0be22e8120d76a414edbcd03d505264b7ede8272ccbd6dbdcebaf11daf6a652f6f9eb74ba7a3ecc942892891388005ae5d971e4e79d696564906dffd44845b704a9abc2fa5ba1bb69a548423a08044ad6d0e365db7e6bea0f3844a452759716cb98dcf326001ec90c1c343174098cdf47ea2e13341058ca014d2a30e9ba3c526de72a6e387181bf76a278c9cbc518d8c374a3f1d9802a39464a100903dbec16f8f095f5d82d9d09507281e4f7fe0ce4fbeced193902a5f658af2a4c1d0952dabdc6ae5830b6b5a2c3f5b8d33a73665990822e5f4a7ce5366755a1615543bdf78299c71e890e0bedb6ec277b10a389d6a3ba9c037221421279e51ab50fb115de2076cc99444202e88ebd9d0fbe4e60234b7b761495ac6c9e615ddac8176164a88fb6d6cc2b52672c8949afe3efc1e87a598896bc93e421423844fcaafe65af898a015b3bcaf623ebeef9a57155af5278ceb52b995f7ca466d9e18b05e86380679e0257cff6d0c6750078462f2ee4701d6d8289ed848b877cf5918625b7937060d667c11119881c30809056892352c6c53c01e395af6866ea350e6f21fa3db772c1177c759999973b51e11ffc590800", 0x2000, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x78, 0x0, 0x6, {0x8, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3966, 0x1, 0x8000, 0xfffffffc, r2, r3, 0x1, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) semget$private(0x0, 0x3, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) write$tcp_congestion(r4, 0x0, 0x0) r5 = dup2(r4, r0) syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000100)={0xfffffffffffffeab, 0x1, 0x0, {0x2}}, 0xffffffe8) fdatasync(r5) 11.173507624s ago: executing program 6 (id=2863): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, 0x0) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r4 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r4, 0x0, 0x0) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) 9.774341508s ago: executing program 1 (id=2865): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x1, &(0x7f00000005c0)=@raw=[@exit], &(0x7f0000000640)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x11, '\x00', 0x0, 0x25, r1, 0x8, &(0x7f0000000680)={0x4, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1f, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002000000000000000002020207b1af8ff000000007ba100000000000007010000f8ffffffb702000005000000b703000009000080850000007100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtaction={0x18, 0x31, 0x53b, 0x0, 0x25dfdbfc, {0x9}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000810}, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_emit_ethernet(0x76, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x68, 0x0, 0xf5ff, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) bind$netlink(r4, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000010000d042abd70000000000000000000", @ANYRES32=r5, @ANYBLOB="9b060000003800001c00128009000100626f6e64000000000c0002800500010006"], 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) getpeername$packet(r4, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f0000000380)={@mcast1, @local, @local, 0xffffff5f, 0x2, 0x8, 0x400, 0x4, 0x1, r6}) r7 = socket$inet(0x10, 0x3, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x48, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x38, 0x2, 0x0, 0x1, [@NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0x17}, @NFTA_INNER_EXPR={0x1c, 0x5, 0x0, 0x1, @meta={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x23}]}}}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_NUM={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa0}, 0x1, 0x0, 0x0, 0x8890}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) bind$netlink(r11, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r11, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=@newlink={0x2c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r12, 0x0, 0x1201}, [@IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x2c}}, 0x0) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="44000000100001040200"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r9, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB='\x00'], 0x44}}, 0x4008010) 9.541548504s ago: executing program 6 (id=2867): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x1, &(0x7f00000005c0)=@raw=[@exit], &(0x7f0000000640)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x11, '\x00', 0x0, 0x25, r1, 0x8, &(0x7f0000000680)={0x4, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1f, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002000000000000000002020207b1af8ff000000007ba100000000000007010000f8ffffffb702000005000000b703000009000080850000007100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtaction={0x18, 0x31, 0x53b, 0x0, 0x25dfdbfc, {0x9}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000810}, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_emit_ethernet(0x76, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x68, 0x0, 0xf5ff, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) bind$netlink(r4, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000010000d042abd70000000000000000000", @ANYRES32=r5, @ANYBLOB="9b060000003800001c00128009000100626f6e64000000000c0002800500010006"], 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) getpeername$packet(r4, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f0000000380)={@mcast1, @local, @local, 0xffffff5f, 0x2, 0x8, 0x400, 0x4, 0x1, r6}) r7 = socket$inet(0x10, 0x3, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x48, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x38, 0x2, 0x0, 0x1, [@NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0x17}, @NFTA_INNER_EXPR={0x1c, 0x5, 0x0, 0x1, @meta={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x23}]}}}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_NUM={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa0}, 0x1, 0x0, 0x0, 0x8890}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) bind$netlink(r11, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r11, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=@newlink={0x2c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r12, 0x0, 0x1201}, [@IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x2c}}, 0x0) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="44000000100001040200"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r9, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB='\x00'], 0x44}}, 0x4008010) 9.325633409s ago: executing program 1 (id=2868): socket$inet(0x2, 0x5, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x6, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x86, 0x2, 0x3, 0x7f, 0xa6, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x0, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x5, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0xff, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0xfffffffd, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x5, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0x6, 0x34, 0x800003, 0x200, 0x83, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x8a6, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r3}, 0x38) 9.001687297s ago: executing program 6 (id=2870): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000002010104000000000000000002001000240002801400018008000100e0000001"], 0x5c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) sendmsg$IPCTNL_MSG_CT_GET_DYING(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2404c030}, 0x20004080) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc980000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000006c0003806800008008000340000000025c000b802c0001800a0001006c696d69740000001c0002800c00024000000000000000030c00014000000000000100002c0001800a0001006c696d69740000001c0002800c00024000000000800000000c000140000000000000000814000000110001"], 0xfc}, 0x1, 0x0, 0x0, 0x4000850}, 0x844) 8.937071048s ago: executing program 7 (id=2871): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r3, 0x0, 0x0, 0x1, 0x1) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mknod$loop(&(0x7f000000db40)='./file0\x00', 0x1000, 0x0) openat2(0xffffffffffffff9c, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)={0x122240, 0x10b, 0x7}, 0x18) 8.936306419s ago: executing program 0 (id=2872): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_DISALLOCATE(r0, 0x5608) 7.532860394s ago: executing program 1 (id=2873): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1279000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) sendmmsg$alg(r4, 0x0, 0x0, 0x20008004) 7.126716764s ago: executing program 0 (id=2874): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={r5}, 0x8) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, 0x0, &(0x7f0000000740)) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 7.125791613s ago: executing program 7 (id=2875): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, 0x0) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r4 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r4, 0x0, 0x0) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) 7.117026384s ago: executing program 6 (id=2876): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r0}, 0x38) 6.07391967s ago: executing program 1 (id=2877): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1279000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) sendmmsg$alg(r4, 0x0, 0x0, 0x20008004) 5.349764857s ago: executing program 7 (id=2878): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/asound/seq/clients\x00', 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mknod$loop(&(0x7f000000db40)='./file0\x00', 0x1000, 0x0) openat2(0xffffffffffffff9c, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)={0x122240, 0x10b, 0x7}, 0x18) 5.075102275s ago: executing program 0 (id=2879): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000022c0)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4048170}], 0x1, 0x20008004) 4.289290504s ago: executing program 1 (id=2880): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r1, 0x0, 0x0, 0x1, 0x1) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mknod$loop(&(0x7f000000db40)='./file0\x00', 0x1000, 0x0) openat2(0xffffffffffffff9c, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)={0x122240, 0x10b, 0x7}, 0x18) 3.812895925s ago: executing program 6 (id=2881): gettid() syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffffffffffffc50c, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f00000007c0)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_sctp(0xa, 0x5, 0x84) 3.677732019s ago: executing program 0 (id=2882): socket$inet(0x2, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x6, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x86, 0x2, 0x3, 0x7f, 0xa6, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x0, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x5, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0xff, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0xfffffffd, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x5, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0x6, 0x34, 0x800003, 0x200, 0x83, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x8a6, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r3}, 0x38) 3.643516179s ago: executing program 7 (id=2883): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddb, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x1c}}, 0x60800) r1 = socket$nl_route(0x10, 0x3, 0x0) accept4$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000100)=0x1c, 0x80000) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_FLOW={0x8, 0xb, 0x7}]}, 0x24}}, 0x0) 2.221803855s ago: executing program 1 (id=2884): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/vtconsole/vtcon1/bind\x00', 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) mmap(&(0x7f00009c5000/0x4000)=nil, 0x4000, 0x3, 0x28012, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000bde000/0x2000)=nil, 0x2000, 0x4001, &(0x7f0000000080)=0x85, 0x7, 0x0) write$FUSE_INTERRUPT(r0, &(0x7f0000002bc0)={0x10, 0xffffffffffffffda}, 0x10) write(r0, &(0x7f0000000280)='1', 0x1) 2.191677105s ago: executing program 6 (id=2885): socket$inet(0x2, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x6, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x86, 0x2, 0x3, 0x7f, 0xa6, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x0, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x5, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0xff, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0xfffffffd, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x5, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0x6, 0x34, 0x800003, 0x200, 0x83, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x8a6, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r3}, 0x38) 1.844848754s ago: executing program 7 (id=2886): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x6, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x86, 0x2, 0x3, 0x7f, 0xa6, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x0, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x5, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0xff, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0xfffffffd, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x5, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0x6, 0x34, 0x800003, 0x200, 0x83, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x8a6, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r3}, 0x38) 1.085696043s ago: executing program 0 (id=2887): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={r5}, 0x8) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, 0x0, &(0x7f0000000740)) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 0s ago: executing program 7 (id=2888): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f00000000c0)) write$evdev(r0, &(0x7f0000000040)=[{{}, 0x0, 0x2}], 0x37) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x20, 0x1405, 0x621, 0x70bd26, 0x0, "", [{{0x8}, {0x4}}]}, 0x20}}, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000080)={@val={0x0, 0x6003}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3c}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x4000, 0x0, 0x3, 0x2f, 0x0, @private=0x1fe1, @multicast1}, {0xa000, 0x6558, 0xc, 0x0, @gue={{0x1, 0x0, 0x1, 0x9, 0x0, @void}}}}}}}}, 0x32) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0xbe9f5000) kernel console output (not intermixed with test programs): me: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1247.655426][T16635] Call Trace: [ 1247.658752][T16635] [ 1247.661719][T16635] dump_stack_lvl+0x18c/0x250 [ 1247.666455][T16635] ? show_regs_print_info+0x20/0x20 [ 1247.671697][T16635] ? load_image+0x420/0x420 [ 1247.676252][T16635] ? __might_sleep+0xe0/0xe0 [ 1247.680898][T16635] ? __lock_acquire+0x7eb0/0x7eb0 [ 1247.685979][T16635] should_fail_ex+0x394/0x4c0 [ 1247.690720][T16635] should_failslab+0x9/0x20 [ 1247.695286][T16635] slab_pre_alloc_hook+0x59/0x300 [ 1247.700446][T16635] ? nfs_alloc_fhandle+0x4a/0x90 [ 1247.705437][T16635] __kmem_cache_alloc_node+0x53/0x250 [ 1247.710881][T16635] ? nfs_alloc_fhandle+0x4a/0x90 [ 1247.715881][T16635] kmalloc_trace+0x2a/0xe0 [ 1247.720358][T16635] nfs_alloc_fhandle+0x4a/0x90 [ 1247.725181][T16635] nfs_init_fs_context+0x69/0xf60 [ 1247.730271][T16635] alloc_fs_context+0x618/0x7a0 [ 1247.735191][T16635] __se_sys_fsopen+0xa0/0x2c0 [ 1247.739935][T16635] do_syscall_64+0x55/0xb0 [ 1247.744408][T16635] ? clear_bhb_loop+0x40/0x90 [ 1247.749130][T16635] ? clear_bhb_loop+0x40/0x90 [ 1247.753852][T16635] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1247.759816][T16635] RIP: 0033:0x7f97e839e1d9 [ 1247.764285][T16635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1247.783946][T16635] RSP: 002b:00007f97e9239028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1247.792429][T16635] RAX: ffffffffffffffda RBX: 00007f97e8626180 RCX: 00007f97e839e1d9 [ 1247.800447][T16635] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1247.808457][T16635] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1247.816471][T16635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1247.824494][T16635] R13: 00007f97e8626218 R14: 00007f97e8626180 R15: 00007ffdf18c68c8 [ 1247.832548][T16635] [ 1248.198335][ T11] veth1_macvtap: left promiscuous mode [ 1248.203970][ T11] veth0_macvtap: left promiscuous mode [ 1248.332161][ T11] veth1_vlan: left promiscuous mode [ 1248.337637][ T11] veth0_vlan: left promiscuous mode [ 1249.039876][ T11] bond1 (unregistering): (slave macvlan2): Releasing active interface [ 1249.113254][ T11] bond1 (unregistering): Released all slaves [ 1249.252384][T16655] loop7: detected capacity change from 0 to 2048 [ 1249.308459][T16655] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1249.798222][T16657] loop7: detected capacity change from 0 to 512 [ 1250.490388][T16657] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1250.503141][T16657] ext4 filesystem being mounted at /43/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1250.804831][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1251.528138][ T11] team0 (unregistering): Port device team_slave_1 removed [ 1251.608072][ T11] team0 (unregistering): Port device team_slave_0 removed [ 1251.705567][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1251.785379][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1252.603675][ T11] bond0 (unregistering): Released all slaves [ 1252.702093][T16662] IPv6: Can't replace route, no match found [ 1252.884512][T16666] bond1: option mode: unable to set because the bond device has slaves [ 1252.987148][T16666] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1253.347272][T16673] FAULT_INJECTION: forcing a failure. [ 1253.347272][T16673] name failslab, interval 1, probability 0, space 0, times 0 [ 1253.360812][T16673] CPU: 1 PID: 16673 Comm: syz.1.2447 Not tainted syzkaller #0 [ 1253.368333][T16673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1253.378430][T16673] Call Trace: [ 1253.381751][T16673] [ 1253.384735][T16673] dump_stack_lvl+0x18c/0x250 [ 1253.389466][T16673] ? show_regs_print_info+0x20/0x20 [ 1253.394714][T16673] ? load_image+0x420/0x420 [ 1253.399272][T16673] ? __might_sleep+0xe0/0xe0 [ 1253.403933][T16673] ? __lock_acquire+0x7eb0/0x7eb0 [ 1253.409098][T16673] should_fail_ex+0x394/0x4c0 [ 1253.413835][T16673] should_failslab+0x9/0x20 [ 1253.418394][T16673] slab_pre_alloc_hook+0x59/0x300 [ 1253.423473][T16673] ? nfs_alloc_fhandle+0x4a/0x90 [ 1253.428466][T16673] __kmem_cache_alloc_node+0x53/0x250 [ 1253.433899][T16673] ? nfs_alloc_fhandle+0x4a/0x90 [ 1253.438908][T16673] kmalloc_trace+0x2a/0xe0 [ 1253.443387][T16673] nfs_alloc_fhandle+0x4a/0x90 [ 1253.448206][T16673] nfs_init_fs_context+0x69/0xf60 [ 1253.453288][T16673] alloc_fs_context+0x618/0x7a0 [ 1253.458210][T16673] __se_sys_fsopen+0xa0/0x2c0 [ 1253.462975][T16673] do_syscall_64+0x55/0xb0 [ 1253.467459][T16673] ? clear_bhb_loop+0x40/0x90 [ 1253.472196][T16673] ? clear_bhb_loop+0x40/0x90 [ 1253.476945][T16673] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1253.482915][T16673] RIP: 0033:0x7f97e839e1d9 [ 1253.487384][T16673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1253.507046][T16673] RSP: 002b:00007f97e9239028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1253.515526][T16673] RAX: ffffffffffffffda RBX: 00007f97e8626180 RCX: 00007f97e839e1d9 [ 1253.523557][T16673] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1253.531575][T16673] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1253.539609][T16673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1253.547622][T16673] R13: 00007f97e8626218 R14: 00007f97e8626180 R15: 00007ffdf18c68c8 [ 1253.555682][T16673] [ 1253.969034][T16675] bond1: option mode: unable to set because the bond device has slaves [ 1254.094820][T16675] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1254.217639][ T11] IPVS: stop unused estimator thread 0... [ 1254.413801][T16683] FAULT_INJECTION: forcing a failure. [ 1254.413801][T16683] name failslab, interval 1, probability 0, space 0, times 0 [ 1254.426704][T16683] CPU: 1 PID: 16683 Comm: syz.1.2450 Not tainted syzkaller #0 [ 1254.434225][T16683] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1254.444327][T16683] Call Trace: [ 1254.447653][T16683] [ 1254.450619][T16683] dump_stack_lvl+0x18c/0x250 [ 1254.455359][T16683] ? show_regs_print_info+0x20/0x20 [ 1254.460597][T16683] ? load_image+0x420/0x420 [ 1254.465151][T16683] ? __might_sleep+0xe0/0xe0 [ 1254.469793][T16683] ? __lock_acquire+0x7eb0/0x7eb0 [ 1254.474872][T16683] should_fail_ex+0x394/0x4c0 [ 1254.479616][T16683] should_failslab+0x9/0x20 [ 1254.484176][T16683] slab_pre_alloc_hook+0x59/0x300 [ 1254.489248][T16683] ? nfs_alloc_fhandle+0x4a/0x90 [ 1254.494247][T16683] __kmem_cache_alloc_node+0x53/0x250 [ 1254.499689][T16683] ? nfs_alloc_fhandle+0x4a/0x90 [ 1254.504690][T16683] kmalloc_trace+0x2a/0xe0 [ 1254.509178][T16683] nfs_alloc_fhandle+0x4a/0x90 [ 1254.513996][T16683] nfs_init_fs_context+0x69/0xf60 [ 1254.519083][T16683] alloc_fs_context+0x618/0x7a0 [ 1254.523993][T16683] __se_sys_fsopen+0xa0/0x2c0 [ 1254.528732][T16683] do_syscall_64+0x55/0xb0 [ 1254.533210][T16683] ? clear_bhb_loop+0x40/0x90 [ 1254.537928][T16683] ? clear_bhb_loop+0x40/0x90 [ 1254.542659][T16683] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1254.548623][T16683] RIP: 0033:0x7f97e839e1d9 [ 1254.553100][T16683] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1254.572755][T16683] RSP: 002b:00007f97e9239028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1254.581219][T16683] RAX: ffffffffffffffda RBX: 00007f97e8626180 RCX: 00007f97e839e1d9 [ 1254.589243][T16683] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1254.597255][T16683] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1254.605266][T16683] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1254.613277][T16683] R13: 00007f97e8626218 R14: 00007f97e8626180 R15: 00007ffdf18c68c8 [ 1254.621311][T16683] [ 1255.292406][T16691] loop1: detected capacity change from 0 to 2048 [ 1255.310436][T16688] loop7: detected capacity change from 0 to 2048 [ 1255.331220][T16688] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1255.336537][T16691] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1256.171191][T16486] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1256.180932][T16693] loop7: detected capacity change from 0 to 512 [ 1256.216224][T16693] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1256.229797][T16693] ext4 filesystem being mounted at /47/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1256.255274][T16486] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1256.504808][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1256.506101][T16699] loop6: detected capacity change from 0 to 2048 [ 1256.530535][T16486] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1256.604966][T16699] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1256.638762][T16486] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1256.975928][T16703] IPv6: Can't replace route, no match found [ 1257.099189][T16710] loop6: detected capacity change from 0 to 512 [ 1257.384173][T16710] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1257.397425][T16710] ext4 filesystem being mounted at /141/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1257.800241][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1258.039535][T16486] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1258.061945][T16715] loop7: detected capacity change from 0 to 2048 [ 1258.090635][T16715] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1258.122428][T16719] loop6: detected capacity change from 0 to 2048 [ 1258.267369][T16719] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1259.296635][T16486] 8021q: adding VLAN 0 to HW filter on device team0 [ 1259.377010][T10822] bridge0: port 1(bridge_slave_0) entered blocking state [ 1259.384287][T10822] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1259.483237][ T1142] bridge0: port 2(bridge_slave_1) entered blocking state [ 1259.490519][ T1142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1259.530272][T16733] loop6: detected capacity change from 0 to 2048 [ 1259.549553][T16733] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1259.614594][T16282] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1259.693632][T16486] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1259.731673][T16486] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1260.115784][T16745] loop6: detected capacity change from 0 to 512 [ 1260.352258][T16745] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1260.365507][T16745] ext4 filesystem being mounted at /143/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1260.725342][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1260.881319][T16753] bond1: option mode: unable to set because the bond device has slaves [ 1260.992710][T16753] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1261.166092][T16486] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1261.341316][T16486] veth0_vlan: entered promiscuous mode [ 1261.396648][T16486] veth1_vlan: entered promiscuous mode [ 1261.422420][T16763] loop1: detected capacity change from 0 to 2048 [ 1261.436208][T16763] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1261.605619][T16766] IPv6: Can't replace route, no match found [ 1261.874528][T16771] sctp: [Deprecated]: syz.6.2462 (pid 16771) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1261.874528][T16771] Use struct sctp_sack_info instead [ 1261.916125][T16770] loop1: detected capacity change from 0 to 512 [ 1262.210450][T16770] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1262.233712][T16770] ext4 filesystem being mounted at /67/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1262.492535][T16486] veth0_macvtap: entered promiscuous mode [ 1262.565647][T16486] veth1_macvtap: entered promiscuous mode [ 1262.590185][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1262.696100][T16486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1262.732757][T16486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1262.744528][T16486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1262.761157][T16486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1262.772662][T16486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1262.792604][T16486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1262.816687][T16486] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1262.844482][T16486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1262.866080][T16486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1262.876953][T16486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1262.893952][T16486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1262.907457][T16486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1262.926180][T16486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1262.956465][T16486] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1262.984539][T16777] bond1: option mode: unable to set because the bond device has slaves [ 1263.015620][T16486] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1263.038046][T16486] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1263.059149][T16486] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1263.077593][T16486] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1263.152335][T16780] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1263.376025][T10840] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1263.417808][T10840] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1263.581321][T16778] FAULT_INJECTION: forcing a failure. [ 1263.581321][T16778] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1263.615705][T16778] CPU: 0 PID: 16778 Comm: syz.7.2467 Not tainted syzkaller #0 [ 1263.623267][T16778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1263.633382][T16778] Call Trace: [ 1263.636722][T16778] [ 1263.639702][T16778] dump_stack_lvl+0x18c/0x250 [ 1263.644461][T16778] ? show_regs_print_info+0x20/0x20 [ 1263.649721][T16778] ? load_image+0x420/0x420 [ 1263.654295][T16778] ? __might_fault+0xaa/0x120 [ 1263.659035][T16778] ? __lock_acquire+0x7eb0/0x7eb0 [ 1263.664142][T16778] ? __kasan_slab_alloc+0x6c/0x80 [ 1263.669237][T16778] should_fail_ex+0x394/0x4c0 [ 1263.673984][T16778] strncpy_from_user+0x36/0x2f0 [ 1263.678892][T16778] getname_flags+0xf6/0x500 [ 1263.683452][T16778] __x64_sys_symlinkat+0x7c/0xb0 [ 1263.688448][T16778] do_syscall_64+0x55/0xb0 [ 1263.692912][T16778] ? clear_bhb_loop+0x40/0x90 [ 1263.697641][T16778] ? clear_bhb_loop+0x40/0x90 [ 1263.702383][T16778] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1263.708352][T16778] RIP: 0033:0x7fbbd999e1d9 [ 1263.712824][T16778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1263.732533][T16778] RSP: 002b:00007fbbda7a9028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 1263.741017][T16778] RAX: ffffffffffffffda RBX: 00007fbbd9c26090 RCX: 00007fbbd999e1d9 [ 1263.749053][T16778] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 [ 1263.757103][T16778] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1263.765123][T16778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1263.773154][T16778] R13: 00007fbbd9c26128 R14: 00007fbbd9c26090 R15: 00007fff153cdbf8 [ 1263.781206][T16778] [ 1263.813828][T16784] netlink: 'syz.1.2468': attribute type 3 has an invalid length. [ 1263.844344][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1264.055629][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1267.623426][T16798] bond1: option mode: unable to set because the bond device has slaves [ 1267.807351][T16801] bond1: option mode: unable to set because the bond device has slaves [ 1267.921142][T16798] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1268.701404][T16812] FAULT_INJECTION: forcing a failure. [ 1268.701404][T16812] name failslab, interval 1, probability 0, space 0, times 0 [ 1268.714176][T16812] CPU: 1 PID: 16812 Comm: syz.0.2474 Not tainted syzkaller #0 [ 1268.721696][T16812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1268.731861][T16812] Call Trace: [ 1268.735188][T16812] [ 1268.738163][T16812] dump_stack_lvl+0x18c/0x250 [ 1268.742898][T16812] ? show_regs_print_info+0x20/0x20 [ 1268.748162][T16812] ? load_image+0x420/0x420 [ 1268.752734][T16812] ? __lock_acquire+0x7eb0/0x7eb0 [ 1268.757846][T16812] should_fail_ex+0x394/0x4c0 [ 1268.762608][T16812] should_failslab+0x9/0x20 [ 1268.767176][T16812] slab_pre_alloc_hook+0x59/0x300 [ 1268.772275][T16812] ? nfs_init_fs_context+0x58/0xf60 [ 1268.777546][T16812] __kmem_cache_alloc_node+0x53/0x250 [ 1268.782984][T16812] ? nfs_init_fs_context+0x58/0xf60 [ 1268.788239][T16812] kmalloc_trace+0x2a/0xe0 [ 1268.792747][T16812] nfs_init_fs_context+0x58/0xf60 [ 1268.797832][T16812] alloc_fs_context+0x618/0x7a0 [ 1268.802752][T16812] __se_sys_fsopen+0xa0/0x2c0 [ 1268.807490][T16812] do_syscall_64+0x55/0xb0 [ 1268.811953][T16812] ? clear_bhb_loop+0x40/0x90 [ 1268.816681][T16812] ? clear_bhb_loop+0x40/0x90 [ 1268.821420][T16812] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1268.827390][T16812] RIP: 0033:0x7fcff279e1d9 [ 1268.831857][T16812] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1268.851521][T16812] RSP: 002b:00007fcff35e9028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1268.859988][T16812] RAX: ffffffffffffffda RBX: 00007fcff2a26270 RCX: 00007fcff279e1d9 [ 1268.868017][T16812] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1268.876039][T16812] RBP: 00007fcff2835888 R08: 0000000000000000 R09: 0000000000000000 [ 1268.884062][T16812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1268.892075][T16812] R13: 00007fcff2a26308 R14: 00007fcff2a26270 R15: 00007ffe786ca4b8 [ 1268.900126][T16812] [ 1270.475007][T16816] loop7: detected capacity change from 0 to 2048 [ 1270.493082][T16816] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1270.568414][T16817] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1270.605950][T16819] netlink: 'syz.0.2478': attribute type 3 has an invalid length. [ 1271.397794][T16820] loop7: detected capacity change from 0 to 512 [ 1271.442194][T16820] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1271.455134][T16820] ext4 filesystem being mounted at /56/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1271.905894][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1273.807029][T16836] loop6: detected capacity change from 0 to 2048 [ 1273.834069][T16836] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1274.033924][T16843] netlink: 'syz.0.2483': attribute type 3 has an invalid length. [ 1274.210658][T16845] loop6: detected capacity change from 0 to 512 [ 1274.381857][T16845] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1274.394749][T16845] ext4 filesystem being mounted at /148/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1274.727464][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1275.354938][T16855] loop1: detected capacity change from 0 to 2048 [ 1275.365046][T16855] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1275.433751][T16857] FAULT_INJECTION: forcing a failure. [ 1275.433751][T16857] name failslab, interval 1, probability 0, space 0, times 0 [ 1275.446730][T16857] CPU: 0 PID: 16857 Comm: syz.6.2484 Not tainted syzkaller #0 [ 1275.454239][T16857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1275.464343][T16857] Call Trace: [ 1275.467670][T16857] [ 1275.470645][T16857] dump_stack_lvl+0x18c/0x250 [ 1275.475382][T16857] ? show_regs_print_info+0x20/0x20 [ 1275.480634][T16857] ? load_image+0x420/0x420 [ 1275.485207][T16857] ? __might_sleep+0xe0/0xe0 [ 1275.489847][T16857] ? __lock_acquire+0x7eb0/0x7eb0 [ 1275.494923][T16857] should_fail_ex+0x394/0x4c0 [ 1275.499684][T16857] should_failslab+0x9/0x20 [ 1275.504241][T16857] slab_pre_alloc_hook+0x59/0x300 [ 1275.509314][T16857] ? nfs_alloc_fhandle+0x4a/0x90 [ 1275.514310][T16857] __kmem_cache_alloc_node+0x53/0x250 [ 1275.519740][T16857] ? nfs_alloc_fhandle+0x4a/0x90 [ 1275.524739][T16857] kmalloc_trace+0x2a/0xe0 [ 1275.529213][T16857] nfs_alloc_fhandle+0x4a/0x90 [ 1275.534027][T16857] nfs_init_fs_context+0x69/0xf60 [ 1275.539116][T16857] alloc_fs_context+0x618/0x7a0 [ 1275.544027][T16857] __se_sys_fsopen+0xa0/0x2c0 [ 1275.548763][T16857] do_syscall_64+0x55/0xb0 [ 1275.553220][T16857] ? clear_bhb_loop+0x40/0x90 [ 1275.557937][T16857] ? clear_bhb_loop+0x40/0x90 [ 1275.562665][T16857] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1275.568630][T16857] RIP: 0033:0x7f9af559e1d9 [ 1275.573094][T16857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1275.592758][T16857] RSP: 002b:00007f9af641d028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1275.601285][T16857] RAX: ffffffffffffffda RBX: 00007f9af5826180 RCX: 00007f9af559e1d9 [ 1275.609327][T16857] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1275.617373][T16857] RBP: 00007f9af5635888 R08: 0000000000000000 R09: 0000000000000000 [ 1275.625396][T16857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1275.633409][T16857] R13: 00007f9af5826218 R14: 00007f9af5826180 R15: 00007ffd49823be8 [ 1275.641451][T16857] [ 1276.270263][T16858] loop1: detected capacity change from 0 to 512 [ 1276.330921][T16858] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1276.344728][T16858] ext4 filesystem being mounted at /72/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1277.986622][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1278.306355][T16866] bond1: option mode: unable to set because the bond device has slaves [ 1278.398787][T16866] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1278.582501][T16868] bond1: option mode: unable to set because the bond device has slaves [ 1278.776587][T16872] loop7: detected capacity change from 0 to 2048 [ 1278.827383][T16872] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1279.276243][T16876] loop7: detected capacity change from 0 to 512 [ 1279.599201][ T5842] IPVS: starting estimator thread 0... [ 1279.717718][T16876] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1279.730767][T16876] ext4 filesystem being mounted at /59/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1279.833481][T16880] IPVS: using max 16 ests per chain, 38400 per kthread [ 1280.023937][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1281.837106][T16889] netlink: 'syz.7.2492': attribute type 3 has an invalid length. [ 1283.436053][T16906] loop7: detected capacity change from 0 to 2048 [ 1283.459743][T16906] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1284.253165][T16911] loop7: detected capacity change from 0 to 512 [ 1284.718309][T16911] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1284.737743][T16911] ext4 filesystem being mounted at /61/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1284.812568][T16908] FAULT_INJECTION: forcing a failure. [ 1284.812568][T16908] name failslab, interval 1, probability 0, space 0, times 0 [ 1284.825340][T16908] CPU: 1 PID: 16908 Comm: syz.1.2495 Not tainted syzkaller #0 [ 1284.832865][T16908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1284.842987][T16908] Call Trace: [ 1284.846315][T16908] [ 1284.849301][T16908] dump_stack_lvl+0x18c/0x250 [ 1284.854047][T16908] ? show_regs_print_info+0x20/0x20 [ 1284.859313][T16908] ? load_image+0x420/0x420 [ 1284.863888][T16908] ? __might_sleep+0xe0/0xe0 [ 1284.868543][T16908] ? __lock_acquire+0x7eb0/0x7eb0 [ 1284.873643][T16908] should_fail_ex+0x394/0x4c0 [ 1284.878414][T16908] should_failslab+0x9/0x20 [ 1284.883016][T16908] slab_pre_alloc_hook+0x59/0x300 [ 1284.888103][T16908] kmem_cache_alloc+0x5a/0x2c0 [ 1284.892938][T16908] ? getname_flags+0xbb/0x500 [ 1284.897678][T16908] getname_flags+0xbb/0x500 [ 1284.902250][T16908] __x64_sys_symlinkat+0x7c/0xb0 [ 1284.907241][T16908] do_syscall_64+0x55/0xb0 [ 1284.911701][T16908] ? clear_bhb_loop+0x40/0x90 [ 1284.916430][T16908] ? clear_bhb_loop+0x40/0x90 [ 1284.921182][T16908] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1284.927137][T16908] RIP: 0033:0x7f97e839e1d9 [ 1284.931610][T16908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1284.951284][T16908] RSP: 002b:00007f97e927b028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 1284.959770][T16908] RAX: ffffffffffffffda RBX: 00007f97e8625fa0 RCX: 00007f97e839e1d9 [ 1284.967804][T16908] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 [ 1284.975924][T16908] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1284.983955][T16908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1284.991984][T16908] R13: 00007f97e8626038 R14: 00007f97e8625fa0 R15: 00007ffdf18c68c8 [ 1285.000039][T16908] [ 1285.140671][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1285.206611][T16918] sctp: [Deprecated]: syz.6.2494 (pid 16918) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1285.206611][T16918] Use struct sctp_sack_info instead [ 1285.473900][T16921] netlink: 'syz.7.2497': attribute type 3 has an invalid length. [ 1285.779159][T16924] bond1: option mode: unable to set because the bond device has slaves [ 1286.842918][T16930] loop7: detected capacity change from 0 to 2048 [ 1286.864876][T16930] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1287.200169][T16934] FAULT_INJECTION: forcing a failure. [ 1287.200169][T16934] name failslab, interval 1, probability 0, space 0, times 0 [ 1287.213040][T16934] CPU: 0 PID: 16934 Comm: syz.1.2500 Not tainted syzkaller #0 [ 1287.220557][T16934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1287.230651][T16934] Call Trace: [ 1287.233947][T16934] [ 1287.236889][T16934] dump_stack_lvl+0x18c/0x250 [ 1287.241582][T16934] ? show_regs_print_info+0x20/0x20 [ 1287.246788][T16934] ? load_image+0x420/0x420 [ 1287.251331][T16934] ? __lock_acquire+0x7eb0/0x7eb0 [ 1287.256451][T16934] should_fail_ex+0x394/0x4c0 [ 1287.261168][T16934] should_failslab+0x9/0x20 [ 1287.265696][T16934] slab_pre_alloc_hook+0x59/0x300 [ 1287.270746][T16934] ? nfs_init_fs_context+0x58/0xf60 [ 1287.275965][T16934] __kmem_cache_alloc_node+0x53/0x250 [ 1287.281395][T16934] ? nfs_init_fs_context+0x58/0xf60 [ 1287.286663][T16934] kmalloc_trace+0x2a/0xe0 [ 1287.291148][T16934] nfs_init_fs_context+0x58/0xf60 [ 1287.296241][T16934] alloc_fs_context+0x618/0x7a0 [ 1287.301163][T16934] __se_sys_fsopen+0xa0/0x2c0 [ 1287.305907][T16934] do_syscall_64+0x55/0xb0 [ 1287.310380][T16934] ? clear_bhb_loop+0x40/0x90 [ 1287.315118][T16934] ? clear_bhb_loop+0x40/0x90 [ 1287.319881][T16934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1287.325840][T16934] RIP: 0033:0x7f97e839e1d9 [ 1287.330310][T16934] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1287.349980][T16934] RSP: 002b:00007f97e925a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1287.358456][T16934] RAX: ffffffffffffffda RBX: 00007f97e8626090 RCX: 00007f97e839e1d9 [ 1287.366459][T16934] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1287.374466][T16934] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1287.382481][T16934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1287.390557][T16934] R13: 00007f97e8626128 R14: 00007f97e8626090 R15: 00007ffdf18c68c8 [ 1287.398564][T16934] [ 1287.932642][T16939] netlink: 'syz.7.2501': attribute type 3 has an invalid length. [ 1290.868193][T16959] FAULT_INJECTION: forcing a failure. [ 1290.868193][T16959] name failslab, interval 1, probability 0, space 0, times 0 [ 1290.880981][T16959] CPU: 1 PID: 16959 Comm: syz.7.2506 Not tainted syzkaller #0 [ 1290.888493][T16959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1290.898601][T16959] Call Trace: [ 1290.901927][T16959] [ 1290.904904][T16959] dump_stack_lvl+0x18c/0x250 [ 1290.909646][T16959] ? show_regs_print_info+0x20/0x20 [ 1290.914896][T16959] ? load_image+0x420/0x420 [ 1290.919462][T16959] ? __might_sleep+0xe0/0xe0 [ 1290.924119][T16959] ? __lock_acquire+0x7eb0/0x7eb0 [ 1290.929242][T16959] should_fail_ex+0x394/0x4c0 [ 1290.933985][T16959] should_failslab+0x9/0x20 [ 1290.938580][T16959] slab_pre_alloc_hook+0x59/0x300 [ 1290.943664][T16959] kmem_cache_alloc+0x5a/0x2c0 [ 1290.948497][T16959] ? getname_flags+0xbb/0x500 [ 1290.953234][T16959] getname_flags+0xbb/0x500 [ 1290.957794][T16959] __x64_sys_symlinkat+0x7c/0xb0 [ 1290.962787][T16959] do_syscall_64+0x55/0xb0 [ 1290.967257][T16959] ? clear_bhb_loop+0x40/0x90 [ 1290.972024][T16959] ? clear_bhb_loop+0x40/0x90 [ 1290.976755][T16959] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1290.982709][T16959] RIP: 0033:0x7fbbd999e1d9 [ 1290.987262][T16959] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1291.006931][T16959] RSP: 002b:00007fbbda7ca028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 1291.015414][T16959] RAX: ffffffffffffffda RBX: 00007fbbd9c25fa0 RCX: 00007fbbd999e1d9 [ 1291.023446][T16959] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 [ 1291.031469][T16959] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1291.039494][T16959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1291.047519][T16959] R13: 00007fbbd9c26038 R14: 00007fbbd9c25fa0 R15: 00007fff153cdbf8 [ 1291.055570][T16959] [ 1292.089337][T16966] netlink: 'syz.1.2508': attribute type 3 has an invalid length. [ 1293.800601][T16977] sctp: [Deprecated]: syz.1.2509 (pid 16977) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1293.800601][T16977] Use struct sctp_sack_info instead [ 1294.874744][T16980] FAULT_INJECTION: forcing a failure. [ 1294.874744][T16980] name failslab, interval 1, probability 0, space 0, times 0 [ 1294.887813][T16980] CPU: 0 PID: 16980 Comm: syz.1.2510 Not tainted syzkaller #0 [ 1294.895328][T16980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1294.905428][T16980] Call Trace: [ 1294.908741][T16980] [ 1294.911702][T16980] dump_stack_lvl+0x18c/0x250 [ 1294.916420][T16980] ? show_regs_print_info+0x20/0x20 [ 1294.921655][T16980] ? load_image+0x420/0x420 [ 1294.926204][T16980] ? __might_sleep+0xe0/0xe0 [ 1294.930858][T16980] ? __lock_acquire+0x7eb0/0x7eb0 [ 1294.935940][T16980] should_fail_ex+0x394/0x4c0 [ 1294.940775][T16980] should_failslab+0x9/0x20 [ 1294.945338][T16980] slab_pre_alloc_hook+0x59/0x300 [ 1294.950403][T16980] ? nfs_alloc_fhandle+0x4a/0x90 [ 1294.955425][T16980] __kmem_cache_alloc_node+0x53/0x250 [ 1294.960975][T16980] ? nfs_alloc_fhandle+0x4a/0x90 [ 1294.965990][T16980] kmalloc_trace+0x2a/0xe0 [ 1294.970653][T16980] nfs_alloc_fhandle+0x4a/0x90 [ 1294.975476][T16980] nfs_init_fs_context+0x69/0xf60 [ 1294.980554][T16980] alloc_fs_context+0x618/0x7a0 [ 1294.985466][T16980] __se_sys_fsopen+0xa0/0x2c0 [ 1294.990206][T16980] do_syscall_64+0x55/0xb0 [ 1294.994669][T16980] ? clear_bhb_loop+0x40/0x90 [ 1294.999392][T16980] ? clear_bhb_loop+0x40/0x90 [ 1295.004133][T16980] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1295.010093][T16980] RIP: 0033:0x7f97e839e1d9 [ 1295.014558][T16980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1295.035440][T16980] RSP: 002b:00007f97e925a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1295.043927][T16980] RAX: ffffffffffffffda RBX: 00007f97e8626090 RCX: 00007f97e839e1d9 [ 1295.051952][T16980] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1295.059971][T16980] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1295.067994][T16980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1295.076004][T16980] R13: 00007f97e8626128 R14: 00007f97e8626090 R15: 00007ffdf18c68c8 [ 1295.084034][T16980] [ 1295.641794][T16984] bond1: option mode: unable to set because the bond device has slaves [ 1295.768819][T16984] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1295.776840][T16987] netlink: 'syz.1.2512': attribute type 3 has an invalid length. [ 1297.069620][T16995] netlink: 'syz.6.2516': attribute type 3 has an invalid length. [ 1300.500984][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.507385][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1301.882575][T17019] netlink: 'syz.0.2520': attribute type 3 has an invalid length. [ 1302.667655][T17020] sctp: [Deprecated]: syz.7.2518 (pid 17020) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1302.667655][T17020] Use struct sctp_sack_info instead [ 1303.542945][T17034] sctp: [Deprecated]: syz.7.2522 (pid 17034) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1303.542945][T17034] Use struct sctp_sack_info instead [ 1304.645139][T17041] sctp: [Deprecated]: syz.0.2523 (pid 17041) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1304.645139][T17041] Use struct sctp_sack_info instead [ 1305.830363][T17046] netlink: 'syz.0.2525': attribute type 3 has an invalid length. [ 1309.898679][T17068] sctp: [Deprecated]: syz.7.2530 (pid 17068) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1309.898679][T17068] Use struct sctp_sack_info instead [ 1310.946803][T17076] sctp: [Deprecated]: syz.0.2532 (pid 17076) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1310.946803][T17076] Use struct sctp_sack_info instead [ 1311.071573][T17079] netlink: 'syz.6.2534': attribute type 3 has an invalid length. [ 1311.694188][T17080] loop7: detected capacity change from 0 to 2048 [ 1311.749979][T17080] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1312.566705][T17082] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1312.898862][T17089] netlink: 'syz.0.2535': attribute type 3 has an invalid length. [ 1313.373113][T17097] sctp: [Deprecated]: syz.1.2521 (pid 17097) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1313.373113][T17097] Use struct sctp_sack_info instead [ 1313.424900][T17098] loop7: detected capacity change from 0 to 512 [ 1314.590867][T17098] EXT4-fs: error -4 creating inode table initialization thread [ 1314.600331][T17098] EXT4-fs (loop7): mount failed [ 1315.074810][T17114] loop7: detected capacity change from 0 to 2048 [ 1315.089476][T17114] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1315.210929][T17121] sctp: [Deprecated]: syz.6.2537 (pid 17121) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1315.210929][T17121] Use struct sctp_sack_info instead [ 1315.478808][T17120] loop0: detected capacity change from 0 to 2048 [ 1315.563766][T17120] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1315.862265][T17100] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1316.230274][T17114] loop7: detected capacity change from 0 to 512 [ 1316.319841][T17114] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1316.334630][T17114] ext4 filesystem being mounted at /77/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1316.390020][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1316.794846][T17130] loop0: detected capacity change from 0 to 512 [ 1316.897724][T17134] sctp: [Deprecated]: syz.7.2541 (pid 17134) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1316.897724][T17134] Use struct sctp_sack_info instead [ 1317.088678][T17130] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1317.102174][T17130] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1317.828521][T17136] netlink: 'syz.7.2542': attribute type 3 has an invalid length. [ 1318.985203][T17142] sctp: [Deprecated]: syz.1.2543 (pid 17142) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1318.985203][T17142] Use struct sctp_sack_info instead [ 1319.954513][T17150] FAULT_INJECTION: forcing a failure. [ 1319.954513][T17150] name failslab, interval 1, probability 0, space 0, times 0 [ 1319.967413][T17150] CPU: 1 PID: 17150 Comm: syz.1.2544 Not tainted syzkaller #0 [ 1319.974925][T17150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1319.985019][T17150] Call Trace: [ 1319.988343][T17150] [ 1319.991318][T17150] dump_stack_lvl+0x18c/0x250 [ 1319.996049][T17150] ? show_regs_print_info+0x20/0x20 [ 1320.001292][T17150] ? load_image+0x420/0x420 [ 1320.005851][T17150] ? __might_sleep+0xe0/0xe0 [ 1320.010496][T17150] ? __lock_acquire+0x7eb0/0x7eb0 [ 1320.015572][T17150] should_fail_ex+0x394/0x4c0 [ 1320.020315][T17150] should_failslab+0x9/0x20 [ 1320.024876][T17150] slab_pre_alloc_hook+0x59/0x300 [ 1320.029981][T17150] ? nfs_alloc_fhandle+0x4a/0x90 [ 1320.034975][T17150] __kmem_cache_alloc_node+0x53/0x250 [ 1320.040410][T17150] ? nfs_alloc_fhandle+0x4a/0x90 [ 1320.045410][T17150] kmalloc_trace+0x2a/0xe0 [ 1320.049884][T17150] nfs_alloc_fhandle+0x4a/0x90 [ 1320.054707][T17150] nfs_init_fs_context+0x69/0xf60 [ 1320.059794][T17150] alloc_fs_context+0x618/0x7a0 [ 1320.064714][T17150] __se_sys_fsopen+0xa0/0x2c0 [ 1320.069459][T17150] do_syscall_64+0x55/0xb0 [ 1320.073921][T17150] ? clear_bhb_loop+0x40/0x90 [ 1320.078642][T17150] ? clear_bhb_loop+0x40/0x90 [ 1320.083380][T17150] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1320.089326][T17150] RIP: 0033:0x7f97e839e1d9 [ 1320.093793][T17150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1320.113450][T17150] RSP: 002b:00007f97e9239028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1320.121916][T17150] RAX: ffffffffffffffda RBX: 00007f97e8626180 RCX: 00007f97e839e1d9 [ 1320.129937][T17150] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1320.137948][T17150] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1320.145986][T17150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1320.154023][T17150] R13: 00007f97e8626218 R14: 00007f97e8626180 R15: 00007ffdf18c68c8 [ 1320.162066][T17150] [ 1321.399446][T17158] netlink: 'syz.1.2546': attribute type 3 has an invalid length. [ 1321.676342][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1322.027068][T17165] loop7: detected capacity change from 0 to 2048 [ 1322.707854][T17172] sctp: [Deprecated]: syz.0.2550 (pid 17172) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1322.707854][T17172] Use struct sctp_sack_info instead [ 1322.846034][T17165] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1323.280228][T17179] sctp: [Deprecated]: syz.1.2552 (pid 17179) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1323.280228][T17179] Use struct sctp_sack_info instead [ 1323.470902][T17181] loop7: detected capacity change from 0 to 512 [ 1323.614553][T17181] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1323.627486][T17181] ext4 filesystem being mounted at /82/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1323.724648][T17178] FAULT_INJECTION: forcing a failure. [ 1323.724648][T17178] name failslab, interval 1, probability 0, space 0, times 0 [ 1323.737474][T17178] CPU: 1 PID: 17178 Comm: syz.0.2551 Not tainted syzkaller #0 [ 1323.744950][T17178] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1323.755048][T17178] Call Trace: [ 1323.758356][T17178] [ 1323.761311][T17178] dump_stack_lvl+0x18c/0x250 [ 1323.766042][T17178] ? show_regs_print_info+0x20/0x20 [ 1323.771274][T17178] ? load_image+0x420/0x420 [ 1323.775819][T17178] ? __might_sleep+0xe0/0xe0 [ 1323.780436][T17178] ? __lock_acquire+0x7eb0/0x7eb0 [ 1323.785511][T17178] should_fail_ex+0x394/0x4c0 [ 1323.790235][T17178] should_failslab+0x9/0x20 [ 1323.794766][T17178] slab_pre_alloc_hook+0x59/0x300 [ 1323.799819][T17178] kmem_cache_alloc+0x5a/0x2c0 [ 1323.804630][T17178] ? getname_flags+0xbb/0x500 [ 1323.809371][T17178] getname_flags+0xbb/0x500 [ 1323.813921][T17178] __x64_sys_symlinkat+0x7c/0xb0 [ 1323.818908][T17178] do_syscall_64+0x55/0xb0 [ 1323.823417][T17178] ? clear_bhb_loop+0x40/0x90 [ 1323.828142][T17178] ? clear_bhb_loop+0x40/0x90 [ 1323.832845][T17178] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1323.838773][T17178] RIP: 0033:0x7fcff279e1d9 [ 1323.843227][T17178] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1323.862852][T17178] RSP: 002b:00007fcff364c028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 1323.871303][T17178] RAX: ffffffffffffffda RBX: 00007fcff2a25fa0 RCX: 00007fcff279e1d9 [ 1323.879305][T17178] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000 [ 1323.887295][T17178] RBP: 00007fcff2835888 R08: 0000000000000000 R09: 0000000000000000 [ 1323.895283][T17178] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1323.903272][T17178] R13: 00007fcff2a26038 R14: 00007fcff2a25fa0 R15: 00007ffe786ca4b8 [ 1323.911294][T17178] [ 1324.137748][T17188] loop1: detected capacity change from 0 to 2048 [ 1324.155587][T17188] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1326.461344][T17203] netlink: 'syz.1.2558': attribute type 3 has an invalid length. [ 1327.305763][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1327.629273][T17214] sctp: [Deprecated]: syz.0.2560 (pid 17214) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1327.629273][T17214] Use struct sctp_sack_info instead [ 1328.246215][T17219] netlink: 'syz.0.2563': attribute type 3 has an invalid length. [ 1328.528197][T17222] sctp: [Deprecated]: syz.7.2561 (pid 17222) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1328.528197][T17222] Use struct sctp_sack_info instead [ 1329.551688][T17231] FAULT_INJECTION: forcing a failure. [ 1329.551688][T17231] name failslab, interval 1, probability 0, space 0, times 0 [ 1329.564779][T17231] CPU: 0 PID: 17231 Comm: syz.1.2564 Not tainted syzkaller #0 [ 1329.572287][T17231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1329.582351][T17231] Call Trace: [ 1329.585639][T17231] [ 1329.588579][T17231] dump_stack_lvl+0x18c/0x250 [ 1329.593289][T17231] ? show_regs_print_info+0x20/0x20 [ 1329.598502][T17231] ? load_image+0x420/0x420 [ 1329.603026][T17231] ? __might_sleep+0xe0/0xe0 [ 1329.607633][T17231] ? __lock_acquire+0x7eb0/0x7eb0 [ 1329.612764][T17231] should_fail_ex+0x394/0x4c0 [ 1329.617517][T17231] should_failslab+0x9/0x20 [ 1329.622086][T17231] slab_pre_alloc_hook+0x59/0x300 [ 1329.627164][T17231] kmem_cache_alloc+0x5a/0x2c0 [ 1329.631983][T17231] ? getname_flags+0xbb/0x500 [ 1329.636715][T17231] getname_flags+0xbb/0x500 [ 1329.641274][T17231] __x64_sys_symlinkat+0x7c/0xb0 [ 1329.646272][T17231] do_syscall_64+0x55/0xb0 [ 1329.650741][T17231] ? clear_bhb_loop+0x40/0x90 [ 1329.655474][T17231] ? clear_bhb_loop+0x40/0x90 [ 1329.660201][T17231] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1329.666159][T17231] RIP: 0033:0x7f97e839e1d9 [ 1329.670629][T17231] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1329.690293][T17231] RSP: 002b:00007f97e927b028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 1329.698770][T17231] RAX: ffffffffffffffda RBX: 00007f97e8625fa0 RCX: 00007f97e839e1d9 [ 1329.706797][T17231] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000 [ 1329.714833][T17231] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1329.722874][T17231] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1329.730902][T17231] R13: 00007f97e8626038 R14: 00007f97e8625fa0 R15: 00007ffdf18c68c8 [ 1329.738943][T17231] [ 1329.994723][T17232] loop7: detected capacity change from 0 to 2048 [ 1330.003200][T17232] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1330.364696][T17238] loop7: detected capacity change from 0 to 512 [ 1331.007429][T17244] netlink: 'syz.1.2568': attribute type 3 has an invalid length. [ 1331.090431][T17238] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1331.103865][T17238] ext4 filesystem being mounted at /84/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1331.130402][T17243] IPv6: Can't replace route, no match found [ 1331.374073][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1331.995041][T17252] netlink: 'syz.0.2570': attribute type 3 has an invalid length. [ 1333.180406][T17269] loop6: detected capacity change from 0 to 2048 [ 1333.218230][T17269] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1335.358081][T17273] FAULT_INJECTION: forcing a failure. [ 1335.358081][T17273] name failslab, interval 1, probability 0, space 0, times 0 [ 1335.371243][T17273] CPU: 1 PID: 17273 Comm: syz.1.2574 Not tainted syzkaller #0 [ 1335.379068][T17273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1335.389141][T17273] Call Trace: [ 1335.392432][T17273] [ 1335.395369][T17273] dump_stack_lvl+0x18c/0x250 [ 1335.400064][T17273] ? show_regs_print_info+0x20/0x20 [ 1335.405362][T17273] ? load_image+0x420/0x420 [ 1335.409913][T17273] ? __might_sleep+0xe0/0xe0 [ 1335.414648][T17273] ? __lock_acquire+0x7eb0/0x7eb0 [ 1335.419716][T17273] should_fail_ex+0x394/0x4c0 [ 1335.424709][T17273] should_failslab+0x9/0x20 [ 1335.430152][T17273] slab_pre_alloc_hook+0x59/0x300 [ 1335.435288][T17273] kmem_cache_alloc+0x5a/0x2c0 [ 1335.440098][T17273] ? getname_flags+0xbb/0x500 [ 1335.444805][T17273] getname_flags+0xbb/0x500 [ 1335.449342][T17273] __x64_sys_symlinkat+0x7c/0xb0 [ 1335.454305][T17273] do_syscall_64+0x55/0xb0 [ 1335.458756][T17273] ? clear_bhb_loop+0x40/0x90 [ 1335.463451][T17273] ? clear_bhb_loop+0x40/0x90 [ 1335.468145][T17273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1335.474068][T17273] RIP: 0033:0x7f97e839e1d9 [ 1335.478501][T17273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1335.498142][T17273] RSP: 002b:00007f97e927b028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 1335.506595][T17273] RAX: ffffffffffffffda RBX: 00007f97e8625fa0 RCX: 00007f97e839e1d9 [ 1335.514597][T17273] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 [ 1335.522625][T17273] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1335.530698][T17273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1335.538711][T17273] R13: 00007f97e8626038 R14: 00007f97e8625fa0 R15: 00007ffdf18c68c8 [ 1335.546707][T17273] [ 1335.751231][T17280] FAULT_INJECTION: forcing a failure. [ 1335.751231][T17280] name failslab, interval 1, probability 0, space 0, times 0 [ 1335.764036][T17280] CPU: 1 PID: 17280 Comm: syz.7.2576 Not tainted syzkaller #0 [ 1335.771506][T17280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1335.781602][T17280] Call Trace: [ 1335.784892][T17280] [ 1335.787941][T17280] dump_stack_lvl+0x18c/0x250 [ 1335.792655][T17280] ? show_regs_print_info+0x20/0x20 [ 1335.797871][T17280] ? load_image+0x420/0x420 [ 1335.802461][T17280] ? __might_sleep+0xe0/0xe0 [ 1335.807089][T17280] ? __lock_acquire+0x7eb0/0x7eb0 [ 1335.812152][T17280] should_fail_ex+0x394/0x4c0 [ 1335.816877][T17280] should_failslab+0x9/0x20 [ 1335.821414][T17280] slab_pre_alloc_hook+0x59/0x300 [ 1335.826464][T17280] kmem_cache_alloc+0x5a/0x2c0 [ 1335.831259][T17280] ? getname_flags+0xbb/0x500 [ 1335.835958][T17280] getname_flags+0xbb/0x500 [ 1335.840495][T17280] __x64_sys_symlinkat+0x7c/0xb0 [ 1335.845452][T17280] do_syscall_64+0x55/0xb0 [ 1335.849885][T17280] ? clear_bhb_loop+0x40/0x90 [ 1335.854581][T17280] ? clear_bhb_loop+0x40/0x90 [ 1335.859295][T17280] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1335.865233][T17280] RIP: 0033:0x7fbbd999e1d9 [ 1335.869664][T17280] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1335.889463][T17280] RSP: 002b:00007fbbda7ca028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 1335.897913][T17280] RAX: ffffffffffffffda RBX: 00007fbbd9c25fa0 RCX: 00007fbbd999e1d9 [ 1335.905923][T17280] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000 [ 1335.913908][T17280] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1335.921899][T17280] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1335.929888][T17280] R13: 00007fbbd9c26038 R14: 00007fbbd9c25fa0 R15: 00007fff153cdbf8 [ 1335.937962][T17280] [ 1336.225902][T17285] loop6: detected capacity change from 0 to 512 [ 1337.406825][T17285] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1337.420486][T17285] ext4 filesystem being mounted at /167/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1337.665108][T17290] loop7: detected capacity change from 0 to 2048 [ 1337.689360][T17290] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1338.030648][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1339.199696][T17303] loop7: detected capacity change from 0 to 512 [ 1339.504102][T17303] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1339.517423][T17303] ext4 filesystem being mounted at /89/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1339.746883][T17307] netlink: 'syz.0.2582': attribute type 3 has an invalid length. [ 1339.847858][T17309] netlink: 'syz.1.2577': attribute type 3 has an invalid length. [ 1340.699058][T17315] tty tty23: ldisc open failed (-12), clearing slot 22 [ 1341.071289][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1341.083353][T17316] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1341.204696][T17322] loop1: detected capacity change from 0 to 512 [ 1341.357376][T17322] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1341.370838][T17322] ext4 filesystem being mounted at /97/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1341.883200][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1341.995526][T17328] netlink: 'syz.0.2586': attribute type 3 has an invalid length. [ 1342.243486][T17331] loop6: detected capacity change from 0 to 2048 [ 1342.279154][T17331] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1342.341802][T17100] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1342.690983][T17335] FAULT_INJECTION: forcing a failure. [ 1342.690983][T17335] name failslab, interval 1, probability 0, space 0, times 0 [ 1342.703987][T17335] CPU: 0 PID: 17335 Comm: syz.7.2585 Not tainted syzkaller #0 [ 1342.711537][T17335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1342.721646][T17335] Call Trace: [ 1342.725061][T17335] [ 1342.728039][T17335] dump_stack_lvl+0x18c/0x250 [ 1342.732776][T17335] ? show_regs_print_info+0x20/0x20 [ 1342.738031][T17335] ? load_image+0x420/0x420 [ 1342.742598][T17335] ? __lock_acquire+0x7eb0/0x7eb0 [ 1342.747680][T17335] should_fail_ex+0x394/0x4c0 [ 1342.752426][T17335] should_failslab+0x9/0x20 [ 1342.756991][T17335] slab_pre_alloc_hook+0x59/0x300 [ 1342.762081][T17335] ? nfs_init_fs_context+0x58/0xf60 [ 1342.767338][T17335] __kmem_cache_alloc_node+0x53/0x250 [ 1342.772864][T17335] ? nfs_init_fs_context+0x58/0xf60 [ 1342.778117][T17335] kmalloc_trace+0x2a/0xe0 [ 1342.782601][T17335] nfs_init_fs_context+0x58/0xf60 [ 1342.787717][T17335] alloc_fs_context+0x618/0x7a0 [ 1342.792633][T17335] __se_sys_fsopen+0xa0/0x2c0 [ 1342.797368][T17335] do_syscall_64+0x55/0xb0 [ 1342.801925][T17335] ? clear_bhb_loop+0x40/0x90 [ 1342.806657][T17335] ? clear_bhb_loop+0x40/0x90 [ 1342.811388][T17335] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1342.817346][T17335] RIP: 0033:0x7fbbd999e1d9 [ 1342.821810][T17335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1342.841516][T17335] RSP: 002b:00007fbbda788028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1342.850018][T17335] RAX: ffffffffffffffda RBX: 00007fbbd9c26180 RCX: 00007fbbd999e1d9 [ 1342.858046][T17335] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1342.866070][T17335] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1342.874094][T17335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1342.879792][T17336] bond1: option mode: unable to set because the bond device has slaves [ 1342.882096][T17335] R13: 00007fbbd9c26218 R14: 00007fbbd9c26180 R15: 00007fff153cdbf8 [ 1342.898401][T17335] [ 1343.703418][T17341] bond_slave_0: entered promiscuous mode [ 1343.709253][T17341] bond_slave_1: entered promiscuous mode [ 1343.715710][T17341] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1343.726437][T17341] bond2: (slave macvlan3): making interface the new active one [ 1343.743737][T17341] bond2: (slave macvlan3): Enslaving as an active interface with an up link [ 1343.754372][T17344] netlink: 'syz.1.2590': attribute type 3 has an invalid length. [ 1344.053587][T17346] loop0: detected capacity change from 0 to 2048 [ 1344.066350][T17346] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1344.351478][T17351] loop6: detected capacity change from 0 to 512 [ 1344.993062][T17351] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1345.007250][T17351] ext4 filesystem being mounted at /170/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1345.302661][T17362] netlink: 'syz.1.2592': attribute type 3 has an invalid length. [ 1345.325240][T17364] loop0: detected capacity change from 0 to 2048 [ 1345.340412][T17364] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1345.616175][T17100] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1345.920147][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1346.674252][T17375] netlink: 'syz.1.2595': attribute type 3 has an invalid length. [ 1346.687101][T17373] bond1: option mode: unable to set because the bond device has slaves [ 1346.752116][T17373] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1347.485165][T17383] loop0: detected capacity change from 0 to 512 [ 1347.693906][T17383] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1347.706644][T17383] ext4 filesystem being mounted at /32/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1347.989553][T17391] bond1: option mode: unable to set because the bond device has slaves [ 1348.293429][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1348.403030][T17399] loop1: detected capacity change from 0 to 512 [ 1348.514162][T17398] netlink: 'syz.7.2599': attribute type 3 has an invalid length. [ 1348.688695][T17399] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1348.702635][T17399] ext4 filesystem being mounted at /102/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1349.129796][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1349.275688][T17405] loop0: detected capacity change from 0 to 2048 [ 1349.293641][T17405] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1350.793528][T17421] loop1: detected capacity change from 0 to 512 [ 1351.008027][T17421] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1351.021585][T17421] ext4 filesystem being mounted at /104/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1351.504285][T17422] loop0: detected capacity change from 0 to 512 [ 1351.506247][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1351.604638][T17422] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1351.698179][T17422] ext4 filesystem being mounted at /33/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1352.061769][T17430] sctp: [Deprecated]: syz.1.2605 (pid 17430) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1352.061769][T17430] Use struct sctp_sack_info instead [ 1352.338636][T17438] FAULT_INJECTION: forcing a failure. [ 1352.338636][T17438] name failslab, interval 1, probability 0, space 0, times 0 [ 1352.351392][T17438] CPU: 0 PID: 17438 Comm: syz.1.2606 Not tainted syzkaller #0 [ 1352.358909][T17438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1352.369015][T17438] Call Trace: [ 1352.372347][T17438] [ 1352.375324][T17438] dump_stack_lvl+0x18c/0x250 [ 1352.380071][T17438] ? show_regs_print_info+0x20/0x20 [ 1352.385327][T17438] ? load_image+0x420/0x420 [ 1352.389892][T17438] ? __might_sleep+0xe0/0xe0 [ 1352.394555][T17438] ? __lock_acquire+0x7eb0/0x7eb0 [ 1352.399659][T17438] should_fail_ex+0x394/0x4c0 [ 1352.404502][T17438] should_failslab+0x9/0x20 [ 1352.409069][T17438] slab_pre_alloc_hook+0x59/0x300 [ 1352.414152][T17438] kmem_cache_alloc+0x5a/0x2c0 [ 1352.418997][T17438] ? getname_flags+0xbb/0x500 [ 1352.423729][T17438] getname_flags+0xbb/0x500 [ 1352.428286][T17438] __x64_sys_symlinkat+0x7c/0xb0 [ 1352.433289][T17438] do_syscall_64+0x55/0xb0 [ 1352.437754][T17438] ? clear_bhb_loop+0x40/0x90 [ 1352.442483][T17438] ? clear_bhb_loop+0x40/0x90 [ 1352.447218][T17438] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1352.453182][T17438] RIP: 0033:0x7f97e839e1d9 [ 1352.457655][T17438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1352.477331][T17438] RSP: 002b:00007f97e927b028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 1352.485817][T17438] RAX: ffffffffffffffda RBX: 00007f97e8625fa0 RCX: 00007f97e839e1d9 [ 1352.493932][T17438] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000 [ 1352.501960][T17438] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1352.509982][T17438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1352.518009][T17438] R13: 00007f97e8626038 R14: 00007f97e8625fa0 R15: 00007ffdf18c68c8 [ 1352.526057][T17438] [ 1352.924996][T17442] sctp: [Deprecated]: syz.7.2607 (pid 17442) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1352.924996][T17442] Use struct sctp_sack_info instead [ 1353.132910][T17446] loop1: detected capacity change from 0 to 512 [ 1353.339797][T17446] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1353.353047][T17446] ext4 filesystem being mounted at /107/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1353.601385][T16538] Bluetooth: hci2: command 0x0406 tx timeout [ 1353.797064][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1354.148963][T17453] loop1: detected capacity change from 0 to 2048 [ 1354.169516][T17453] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1354.486067][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1354.972602][T17456] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[17460] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[17456] [ 1355.691737][T17469] loop7: detected capacity change from 0 to 512 [ 1356.409204][T17466] netlink: 'syz.0.2613': attribute type 3 has an invalid length. [ 1356.429883][T17473] netlink: 'syz.6.2616': attribute type 3 has an invalid length. [ 1356.440305][T17469] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1356.453136][T17469] ext4 filesystem being mounted at /94/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1356.741285][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1357.615635][T17481] netlink: 'syz.7.2617': attribute type 3 has an invalid length. [ 1358.920187][T17472] tty tty21: ldisc open failed (-12), clearing slot 20 [ 1359.158700][T17491] loop6: detected capacity change from 0 to 2048 [ 1359.166539][T17491] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1359.817982][T17495] loop7: detected capacity change from 0 to 512 [ 1360.226738][T17501] netlink: 'syz.6.2622': attribute type 3 has an invalid length. [ 1360.235477][T17495] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1360.248357][T17495] ext4 filesystem being mounted at /96/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1361.393968][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1361.639569][T17515] loop6: detected capacity change from 0 to 2048 [ 1361.657579][T17515] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1361.726035][T17516] loop1: detected capacity change from 0 to 2048 [ 1361.758977][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.765390][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.859332][T17516] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1361.879529][T17519] bond1: option mode: unable to set because the bond device has slaves [ 1362.047371][T17520] loop0: detected capacity change from 0 to 512 [ 1362.388762][T17099] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1363.491962][T17523] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1363.691947][T17529] netlink: 'syz.6.2627': attribute type 3 has an invalid length. [ 1363.702271][T17520] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1363.715008][T17520] ext4 filesystem being mounted at /37/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1364.863615][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1365.389750][T17539] loop6: detected capacity change from 0 to 512 [ 1365.420628][T17537] FAULT_INJECTION: forcing a failure. [ 1365.420628][T17537] name failslab, interval 1, probability 0, space 0, times 0 [ 1365.433504][T17537] CPU: 1 PID: 17537 Comm: syz.7.2630 Not tainted syzkaller #0 [ 1365.441015][T17537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1365.451213][T17537] Call Trace: [ 1365.454537][T17537] [ 1365.457506][T17537] dump_stack_lvl+0x18c/0x250 [ 1365.462242][T17537] ? show_regs_print_info+0x20/0x20 [ 1365.467486][T17537] ? load_image+0x420/0x420 [ 1365.472055][T17537] ? __might_sleep+0xe0/0xe0 [ 1365.476699][T17537] ? __lock_acquire+0x7eb0/0x7eb0 [ 1365.481782][T17537] should_fail_ex+0x394/0x4c0 [ 1365.486532][T17537] should_failslab+0x9/0x20 [ 1365.491124][T17537] slab_pre_alloc_hook+0x59/0x300 [ 1365.496212][T17537] kmem_cache_alloc+0x5a/0x2c0 [ 1365.501038][T17537] ? getname_flags+0xbb/0x500 [ 1365.505763][T17537] getname_flags+0xbb/0x500 [ 1365.510319][T17537] __x64_sys_symlinkat+0x7c/0xb0 [ 1365.515307][T17537] do_syscall_64+0x55/0xb0 [ 1365.519791][T17537] ? clear_bhb_loop+0x40/0x90 [ 1365.524511][T17537] ? clear_bhb_loop+0x40/0x90 [ 1365.529239][T17537] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1365.535214][T17537] RIP: 0033:0x7fbbd999e1d9 [ 1365.539672][T17537] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1365.559325][T17537] RSP: 002b:00007fbbda7ca028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 1365.567792][T17537] RAX: ffffffffffffffda RBX: 00007fbbd9c25fa0 RCX: 00007fbbd999e1d9 [ 1365.575808][T17537] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000 [ 1365.583823][T17537] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1365.591845][T17537] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1365.599865][T17537] R13: 00007fbbd9c26038 R14: 00007fbbd9c25fa0 R15: 00007fff153cdbf8 [ 1365.607905][T17537] [ 1366.151823][T17539] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1366.165541][T17539] ext4 filesystem being mounted at /181/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1366.490210][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1367.593708][T17553] loop0: detected capacity change from 0 to 2048 [ 1367.857758][T17553] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1368.026658][T17554] loop6: detected capacity change from 0 to 2048 [ 1368.089569][T17554] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1368.470679][T17556] loop6: detected capacity change from 0 to 512 [ 1368.529182][T17556] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1368.597577][T17560] FAULT_INJECTION: forcing a failure. [ 1368.597577][T17560] name failslab, interval 1, probability 0, space 0, times 0 [ 1368.610554][T17560] CPU: 0 PID: 17560 Comm: syz.1.2631 Not tainted syzkaller #0 [ 1368.618068][T17560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1368.628162][T17560] Call Trace: [ 1368.631485][T17560] [ 1368.634454][T17560] dump_stack_lvl+0x18c/0x250 [ 1368.639185][T17560] ? show_regs_print_info+0x20/0x20 [ 1368.644429][T17560] ? load_image+0x420/0x420 [ 1368.649006][T17560] ? __might_sleep+0xe0/0xe0 [ 1368.653648][T17560] ? __lock_acquire+0x7eb0/0x7eb0 [ 1368.658732][T17560] should_fail_ex+0x394/0x4c0 [ 1368.663478][T17560] should_failslab+0x9/0x20 [ 1368.668046][T17560] slab_pre_alloc_hook+0x59/0x300 [ 1368.673126][T17560] ? nfs_alloc_fhandle+0x4a/0x90 [ 1368.678143][T17560] __kmem_cache_alloc_node+0x53/0x250 [ 1368.683582][T17560] ? nfs_alloc_fhandle+0x4a/0x90 [ 1368.688589][T17560] kmalloc_trace+0x2a/0xe0 [ 1368.693065][T17560] nfs_alloc_fhandle+0x4a/0x90 [ 1368.697897][T17560] nfs_init_fs_context+0x69/0xf60 [ 1368.702991][T17560] alloc_fs_context+0x618/0x7a0 [ 1368.707903][T17560] __se_sys_fsopen+0xa0/0x2c0 [ 1368.712640][T17560] do_syscall_64+0x55/0xb0 [ 1368.717102][T17560] ? clear_bhb_loop+0x40/0x90 [ 1368.721821][T17560] ? clear_bhb_loop+0x40/0x90 [ 1368.726543][T17560] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1368.732506][T17560] RIP: 0033:0x7f97e839e1d9 [ 1368.736979][T17560] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1368.756734][T17560] RSP: 002b:00007f97e9239028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1368.765207][T17560] RAX: ffffffffffffffda RBX: 00007f97e8626180 RCX: 00007f97e839e1d9 [ 1368.773256][T17560] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1368.781275][T17560] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1368.789295][T17560] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1368.797316][T17560] R13: 00007f97e8626218 R14: 00007f97e8626180 R15: 00007ffdf18c68c8 [ 1368.805356][T17560] [ 1368.809910][T17556] ext4 filesystem being mounted at /182/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1369.105048][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1369.157562][T17562] netlink: 'syz.7.2635': attribute type 3 has an invalid length. [ 1369.521364][T17566] bond1: option mode: unable to set because the bond device has slaves [ 1369.881779][T17566] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1370.073576][T17570] bond1: option mode: unable to set because the bond device has slaves [ 1370.101445][T17568] loop0: detected capacity change from 0 to 512 [ 1370.322877][T17574] loop6: detected capacity change from 0 to 2048 [ 1370.369359][T17574] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1370.391813][T17580] netlink: 'syz.1.2640': attribute type 3 has an invalid length. [ 1370.414246][T17578] netlink: 'syz.7.2641': attribute type 3 has an invalid length. [ 1371.541928][T17568] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1371.828128][T17568] ext4 filesystem being mounted at /39/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1371.896954][T17591] netlink: 'syz.7.2642': attribute type 3 has an invalid length. [ 1374.560606][T17606] bond1: option mode: unable to set because the bond device has slaves [ 1374.704808][T17608] netlink: 'syz.1.2647': attribute type 3 has an invalid length. [ 1377.656194][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1377.727561][T17626] loop6: detected capacity change from 0 to 2048 [ 1377.759475][T17626] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1377.847179][T17630] loop1: detected capacity change from 0 to 2048 [ 1377.855481][T17620] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1377.925057][T17630] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1378.116115][T17632] netlink: 'syz.0.2651': attribute type 3 has an invalid length. [ 1379.558677][T17640] bond2: option mode: unable to set because the bond device has slaves [ 1379.816247][T17644] loop6: detected capacity change from 0 to 512 [ 1379.959872][T17645] loop1: detected capacity change from 0 to 512 [ 1380.039418][T17644] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1380.161521][T17645] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1380.232685][T17644] ext4 filesystem being mounted at /185/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1380.258844][T17645] ext4 filesystem being mounted at /119/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1380.334516][T17652] netlink: 'syz.0.2654': attribute type 3 has an invalid length. [ 1382.128742][T17661] sctp: [Deprecated]: syz.0.2655 (pid 17661) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1382.128742][T17661] Use struct sctp_sack_info instead [ 1383.936044][T17667] loop0: detected capacity change from 0 to 2048 [ 1383.956558][T17667] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1385.125690][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1385.620621][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1385.704984][T17680] sctp: [Deprecated]: syz.7.2659 (pid 17680) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1385.704984][T17680] Use struct sctp_sack_info instead [ 1386.104853][T17682] sctp: [Deprecated]: syz.1.2660 (pid 17682) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1386.104853][T17682] Use struct sctp_sack_info instead [ 1386.380382][T17685] netlink: 'syz.6.2661': attribute type 3 has an invalid length. [ 1386.859307][T17691] sctp: [Deprecated]: syz.7.2662 (pid 17691) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1386.859307][T17691] Use struct sctp_sack_info instead [ 1387.072528][T17699] sctp: [Deprecated]: syz.1.2663 (pid 17699) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1387.072528][T17699] Use struct sctp_sack_info instead [ 1388.201991][T17706] loop7: detected capacity change from 0 to 2048 [ 1388.209544][T17708] bond1: option mode: unable to set because the bond device has slaves [ 1388.239686][T17706] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1388.260762][T17710] loop1: detected capacity change from 0 to 2048 [ 1388.304834][T17708] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1388.409234][T17710] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1388.515426][T17712] netlink: 'syz.0.2668': attribute type 3 has an invalid length. [ 1388.584343][T17615] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1389.323100][T17721] bond1: option mode: unable to set because the bond device has slaves [ 1390.012397][T17721] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1390.105621][T17725] loop0: detected capacity change from 0 to 2048 [ 1390.117078][T17725] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1390.606604][T17732] netlink: 'syz.7.2673': attribute type 3 has an invalid length. [ 1392.005105][T17740] loop0: detected capacity change from 0 to 512 [ 1392.134112][T17743] loop1: detected capacity change from 0 to 512 [ 1392.307044][T17740] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1392.307186][T17740] ext4 filesystem being mounted at /47/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1392.353286][T17743] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1392.353411][T17743] ext4 filesystem being mounted at /122/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1394.553859][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1394.809267][T17755] loop0: detected capacity change from 0 to 2048 [ 1394.852558][T17755] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1395.161852][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1395.206950][T17756] loop0: detected capacity change from 0 to 512 [ 1395.245215][T17756] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1395.258075][T17756] ext4 filesystem being mounted at /48/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1395.689064][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1395.951005][T17763] bond2: option mode: unable to set because the bond device has slaves [ 1395.981365][T17764] sctp: [Deprecated]: syz.1.2678 (pid 17764) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1395.981365][T17764] Use struct sctp_sack_info instead [ 1396.240167][T17763] bond2: (slave macvlan4): Error -98 calling set_mac_address [ 1397.337092][T17778] loop7: detected capacity change from 0 to 2048 [ 1397.346355][T17778] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1397.670442][T17778] loop7: detected capacity change from 0 to 512 [ 1397.738752][T17778] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1397.752160][T17778] ext4 filesystem being mounted at /116/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1397.757207][T17781] loop0: detected capacity change from 0 to 2048 [ 1397.809449][T17781] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1397.910323][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1397.952056][T17615] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1398.203530][T17781] loop0: detected capacity change from 0 to 512 [ 1398.267968][T17781] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1398.280731][T17781] ext4 filesystem being mounted at /50/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1398.431462][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1398.499951][T17791] loop7: detected capacity change from 0 to 2048 [ 1398.527013][T17791] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1398.600358][T17792] FAULT_INJECTION: forcing a failure. [ 1398.600358][T17792] name failslab, interval 1, probability 0, space 0, times 0 [ 1398.706132][T17792] CPU: 1 PID: 17792 Comm: syz.6.2681 Not tainted syzkaller #0 [ 1398.713705][T17792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1398.723823][T17792] Call Trace: [ 1398.727167][T17792] [ 1398.730140][T17792] dump_stack_lvl+0x18c/0x250 [ 1398.734913][T17792] ? show_regs_print_info+0x20/0x20 [ 1398.740175][T17792] ? load_image+0x420/0x420 [ 1398.744775][T17792] ? __might_sleep+0xe0/0xe0 [ 1398.749457][T17792] ? __lock_acquire+0x7eb0/0x7eb0 [ 1398.754559][T17792] should_fail_ex+0x394/0x4c0 [ 1398.759307][T17792] should_failslab+0x9/0x20 [ 1398.763874][T17792] slab_pre_alloc_hook+0x59/0x300 [ 1398.768991][T17792] ? nfs_alloc_fhandle+0x4a/0x90 [ 1398.774011][T17792] __kmem_cache_alloc_node+0x53/0x250 [ 1398.779457][T17792] ? nfs_alloc_fhandle+0x4a/0x90 [ 1398.784475][T17792] kmalloc_trace+0x2a/0xe0 [ 1398.789001][T17792] nfs_alloc_fhandle+0x4a/0x90 [ 1398.793827][T17792] nfs_init_fs_context+0x69/0xf60 [ 1398.798909][T17792] alloc_fs_context+0x618/0x7a0 [ 1398.803831][T17792] __se_sys_fsopen+0xa0/0x2c0 [ 1398.808570][T17792] do_syscall_64+0x55/0xb0 [ 1398.813044][T17792] ? clear_bhb_loop+0x40/0x90 [ 1398.817775][T17792] ? clear_bhb_loop+0x40/0x90 [ 1398.822507][T17792] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1398.828492][T17792] RIP: 0033:0x7f9af559e1d9 [ 1398.832963][T17792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1398.852650][T17792] RSP: 002b:00007f9af641d028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1398.861133][T17792] RAX: ffffffffffffffda RBX: 00007f9af5826180 RCX: 00007f9af559e1d9 [ 1398.869191][T17792] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1398.877222][T17792] RBP: 00007f9af5635888 R08: 0000000000000000 R09: 0000000000000000 [ 1398.885246][T17792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1398.893267][T17792] R13: 00007f9af5826218 R14: 00007f9af5826180 R15: 00007ffd49823be8 [ 1398.901323][T17792] [ 1399.008674][T17796] loop7: detected capacity change from 0 to 512 [ 1399.065114][T17796] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1399.078720][T17796] ext4 filesystem being mounted at /117/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1399.320789][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1399.508614][T17800] bond1: option mode: unable to set because the bond device has slaves [ 1399.576781][T17800] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1399.999436][T17805] sctp: [Deprecated]: syz.1.2687 (pid 17805) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1399.999436][T17805] Use struct sctp_sack_info instead [ 1400.959481][T17812] netlink: 'syz.1.2689': attribute type 3 has an invalid length. [ 1401.033193][T17813] sctp: [Deprecated]: syz.7.2688 (pid 17813) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1401.033193][T17813] Use struct sctp_sack_info instead [ 1402.733066][T17824] sctp: [Deprecated]: syz.6.2690 (pid 17824) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1402.733066][T17824] Use struct sctp_sack_info instead [ 1403.558306][T17835] sctp: [Deprecated]: syz.1.2692 (pid 17835) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1403.558306][T17835] Use struct sctp_sack_info instead [ 1404.188903][T17834] netlink: 'syz.6.2694': attribute type 3 has an invalid length. [ 1404.730840][T17845] netlink: 'syz.0.2697': attribute type 3 has an invalid length. [ 1404.812156][T17846] sctp: [Deprecated]: syz.7.2696 (pid 17846) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1404.812156][T17846] Use struct sctp_sack_info instead [ 1406.279344][T17857] sctp: [Deprecated]: syz.7.2698 (pid 17857) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1406.279344][T17857] Use struct sctp_sack_info instead [ 1406.339149][T17856] loop0: detected capacity change from 0 to 2048 [ 1406.501317][T17856] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1407.403379][T17863] loop0: detected capacity change from 0 to 512 [ 1407.431489][T17865] sctp: [Deprecated]: syz.7.2700 (pid 17865) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1407.431489][T17865] Use struct sctp_sack_info instead [ 1407.819846][T17863] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1407.835238][T17863] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1408.162695][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1408.813767][T17876] FAULT_INJECTION: forcing a failure. [ 1408.813767][T17876] name failslab, interval 1, probability 0, space 0, times 0 [ 1408.826519][T17876] CPU: 0 PID: 17876 Comm: syz.7.2702 Not tainted syzkaller #0 [ 1408.834026][T17876] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1408.844122][T17876] Call Trace: [ 1408.847442][T17876] [ 1408.850415][T17876] dump_stack_lvl+0x18c/0x250 [ 1408.855154][T17876] ? show_regs_print_info+0x20/0x20 [ 1408.860403][T17876] ? load_image+0x420/0x420 [ 1408.864958][T17876] ? __might_sleep+0xe0/0xe0 [ 1408.869604][T17876] ? __lock_acquire+0x7eb0/0x7eb0 [ 1408.874682][T17876] should_fail_ex+0x394/0x4c0 [ 1408.879427][T17876] should_failslab+0x9/0x20 [ 1408.884025][T17876] slab_pre_alloc_hook+0x59/0x300 [ 1408.889099][T17876] ? nfs_alloc_fhandle+0x4a/0x90 [ 1408.894103][T17876] __kmem_cache_alloc_node+0x53/0x250 [ 1408.899543][T17876] ? nfs_alloc_fhandle+0x4a/0x90 [ 1408.904552][T17876] kmalloc_trace+0x2a/0xe0 [ 1408.909041][T17876] nfs_alloc_fhandle+0x4a/0x90 [ 1408.913886][T17876] nfs_init_fs_context+0x69/0xf60 [ 1408.918972][T17876] alloc_fs_context+0x618/0x7a0 [ 1408.923888][T17876] __se_sys_fsopen+0xa0/0x2c0 [ 1408.928620][T17876] do_syscall_64+0x55/0xb0 [ 1408.933092][T17876] ? clear_bhb_loop+0x40/0x90 [ 1408.937840][T17876] ? clear_bhb_loop+0x40/0x90 [ 1408.942576][T17876] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1408.948532][T17876] RIP: 0033:0x7fbbd999e1d9 [ 1408.952990][T17876] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1408.972648][T17876] RSP: 002b:00007fbbda788028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1408.981124][T17876] RAX: ffffffffffffffda RBX: 00007fbbd9c26180 RCX: 00007fbbd999e1d9 [ 1408.989144][T17876] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1408.997155][T17876] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1409.005172][T17876] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1409.013194][T17876] R13: 00007fbbd9c26218 R14: 00007fbbd9c26180 R15: 00007fff153cdbf8 [ 1409.021241][T17876] [ 1409.096796][T17878] sctp: [Deprecated]: syz.0.2701 (pid 17878) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1409.096796][T17878] Use struct sctp_sack_info instead [ 1409.933701][T17883] netlink: 'syz.1.2703': attribute type 3 has an invalid length. [ 1410.240920][T17887] loop0: detected capacity change from 0 to 2048 [ 1410.698982][T17887] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1410.743007][T17867] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1411.460060][T17904] loop0: detected capacity change from 0 to 512 [ 1411.507474][T17901] FAULT_INJECTION: forcing a failure. [ 1411.507474][T17901] name failslab, interval 1, probability 0, space 0, times 0 [ 1411.520322][T17901] CPU: 1 PID: 17901 Comm: syz.7.2706 Not tainted syzkaller #0 [ 1411.527830][T17901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1411.537929][T17901] Call Trace: [ 1411.541251][T17901] [ 1411.544223][T17901] dump_stack_lvl+0x18c/0x250 [ 1411.548954][T17901] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1411.554638][T17901] ? show_regs_print_info+0x20/0x20 [ 1411.559884][T17901] ? load_image+0x420/0x420 [ 1411.564451][T17901] should_fail_ex+0x394/0x4c0 [ 1411.569191][T17901] should_failslab+0x9/0x20 [ 1411.573753][T17901] slab_pre_alloc_hook+0x59/0x300 [ 1411.578830][T17901] ? nfs_alloc_fhandle+0x4a/0x90 [ 1411.583826][T17901] __kmem_cache_alloc_node+0x53/0x250 [ 1411.589257][T17901] ? nfs_alloc_fhandle+0x4a/0x90 [ 1411.594268][T17901] kmalloc_trace+0x2a/0xe0 [ 1411.598777][T17901] nfs_alloc_fhandle+0x4a/0x90 [ 1411.603610][T17901] nfs_init_fs_context+0x69/0xf60 [ 1411.608699][T17901] alloc_fs_context+0x618/0x7a0 [ 1411.613611][T17901] __se_sys_fsopen+0xa0/0x2c0 [ 1411.618349][T17901] do_syscall_64+0x55/0xb0 [ 1411.622840][T17901] ? clear_bhb_loop+0x40/0x90 [ 1411.627561][T17901] ? clear_bhb_loop+0x40/0x90 [ 1411.632309][T17901] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1411.638270][T17901] RIP: 0033:0x7fbbd999e1d9 [ 1411.642734][T17901] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1411.662393][T17901] RSP: 002b:00007fbbda7ca028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1411.670869][T17901] RAX: ffffffffffffffda RBX: 00007fbbd9c25fa0 RCX: 00007fbbd999e1d9 [ 1411.678901][T17901] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1411.687002][T17901] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1411.695021][T17901] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1411.703034][T17901] R13: 00007fbbd9c26038 R14: 00007fbbd9c25fa0 R15: 00007fff153cdbf8 [ 1411.711067][T17901] [ 1411.996332][T17904] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1412.009094][T17904] ext4 filesystem being mounted at /55/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1412.295014][T17910] sctp: [Deprecated]: syz.1.2707 (pid 17910) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1412.295014][T17910] Use struct sctp_sack_info instead [ 1412.416799][T16486] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1413.019209][T17917] sctp: [Deprecated]: syz.6.2708 (pid 17917) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1413.019209][T17917] Use struct sctp_sack_info instead [ 1413.583498][T17920] netlink: 'syz.1.2711': attribute type 3 has an invalid length. [ 1414.516217][T17924] sctp: [Deprecated]: syz.7.2710 (pid 17924) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1414.516217][T17924] Use struct sctp_sack_info instead [ 1414.868185][T17934] FAULT_INJECTION: forcing a failure. [ 1414.868185][T17934] name failslab, interval 1, probability 0, space 0, times 0 [ 1414.881175][T17934] CPU: 1 PID: 17934 Comm: syz.0.2709 Not tainted syzkaller #0 [ 1414.888693][T17934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1414.898795][T17934] Call Trace: [ 1414.902120][T17934] [ 1414.905085][T17934] dump_stack_lvl+0x18c/0x250 [ 1414.909817][T17934] ? show_regs_print_info+0x20/0x20 [ 1414.915075][T17934] ? load_image+0x420/0x420 [ 1414.919647][T17934] ? __lock_acquire+0x7eb0/0x7eb0 [ 1414.924747][T17934] should_fail_ex+0x394/0x4c0 [ 1414.929498][T17934] should_failslab+0x9/0x20 [ 1414.934066][T17934] slab_pre_alloc_hook+0x59/0x300 [ 1414.939148][T17934] ? nfs_init_fs_context+0x58/0xf60 [ 1414.944417][T17934] __kmem_cache_alloc_node+0x53/0x250 [ 1414.949879][T17934] ? nfs_init_fs_context+0x58/0xf60 [ 1414.955132][T17934] kmalloc_trace+0x2a/0xe0 [ 1414.959609][T17934] nfs_init_fs_context+0x58/0xf60 [ 1414.964696][T17934] alloc_fs_context+0x618/0x7a0 [ 1414.969640][T17934] __se_sys_fsopen+0xa0/0x2c0 [ 1414.974388][T17934] do_syscall_64+0x55/0xb0 [ 1414.978856][T17934] ? clear_bhb_loop+0x40/0x90 [ 1414.983581][T17934] ? clear_bhb_loop+0x40/0x90 [ 1414.988309][T17934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1414.994267][T17934] RIP: 0033:0x7fcff279e1d9 [ 1414.998847][T17934] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1415.018515][T17934] RSP: 002b:00007fcff360a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1415.026997][T17934] RAX: ffffffffffffffda RBX: 00007fcff2a26180 RCX: 00007fcff279e1d9 [ 1415.035028][T17934] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1415.043081][T17934] RBP: 00007fcff2835888 R08: 0000000000000000 R09: 0000000000000000 [ 1415.051130][T17934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1415.059154][T17934] R13: 00007fcff2a26218 R14: 00007fcff2a26180 R15: 00007ffe786ca4b8 [ 1415.067229][T17934] [ 1415.084263][T17936] loop7: detected capacity change from 0 to 2048 [ 1415.092712][T17936] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1415.161250][T17938] bond1: option mode: unable to set because the bond device has slaves [ 1415.185688][T17938] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1415.497290][T17941] loop1: detected capacity change from 0 to 2048 [ 1415.533089][T17941] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1416.326173][T17947] sctp: [Deprecated]: syz.7.2716 (pid 17947) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1416.326173][T17947] Use struct sctp_sack_info instead [ 1416.757788][T17953] bond1: option mode: unable to set because the bond device has slaves [ 1416.822790][T17953] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1416.944012][T17955] loop1: detected capacity change from 0 to 2048 [ 1416.955028][T17955] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1417.024700][T17867] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1417.099683][T17957] sctp: [Deprecated]: syz.6.2717 (pid 17957) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1417.099683][T17957] Use struct sctp_sack_info instead [ 1417.866945][T17961] bond1: option mode: unable to set because the bond device has slaves [ 1418.036974][T17963] loop1: detected capacity change from 0 to 512 [ 1418.052537][T17961] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1418.276962][T17963] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1418.290336][T17963] ext4 filesystem being mounted at /132/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1418.587588][T17964] loop6: detected capacity change from 0 to 2048 [ 1418.639503][T17964] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1418.682176][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1418.728349][T17859] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1419.127526][T17971] loop6: detected capacity change from 0 to 512 [ 1419.166402][T17971] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1419.179591][T17971] ext4 filesystem being mounted at /200/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1419.554607][T17979] sctp: [Deprecated]: syz.7.2723 (pid 17979) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1419.554607][T17979] Use struct sctp_sack_info instead [ 1420.074024][T17972] loop1: detected capacity change from 0 to 2048 [ 1420.199390][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1420.226788][T17972] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1420.606639][T17988] loop6: detected capacity change from 0 to 2048 [ 1420.619342][T17859] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1420.701532][T17990] sctp: [Deprecated]: syz.0.2726 (pid 17990) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1420.701532][T17990] Use struct sctp_sack_info instead [ 1420.766787][T17989] FAULT_INJECTION: forcing a failure. [ 1420.766787][T17989] name failslab, interval 1, probability 0, space 0, times 0 [ 1420.789462][T17989] CPU: 0 PID: 17989 Comm: syz.7.2727 Not tainted syzkaller #0 [ 1420.797014][T17989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1420.807113][T17989] Call Trace: [ 1420.810442][T17989] [ 1420.813423][T17989] dump_stack_lvl+0x18c/0x250 [ 1420.818152][T17989] ? show_regs_print_info+0x20/0x20 [ 1420.823395][T17989] ? load_image+0x420/0x420 [ 1420.827979][T17989] ? __might_sleep+0xe0/0xe0 [ 1420.832625][T17989] ? __lock_acquire+0x7eb0/0x7eb0 [ 1420.837703][T17989] should_fail_ex+0x394/0x4c0 [ 1420.842445][T17989] should_failslab+0x9/0x20 [ 1420.847010][T17989] slab_pre_alloc_hook+0x59/0x300 [ 1420.852086][T17989] ? nfs_alloc_fhandle+0x4a/0x90 [ 1420.857106][T17989] __kmem_cache_alloc_node+0x53/0x250 [ 1420.862553][T17989] ? nfs_alloc_fhandle+0x4a/0x90 [ 1420.867556][T17989] kmalloc_trace+0x2a/0xe0 [ 1420.872051][T17989] nfs_alloc_fhandle+0x4a/0x90 [ 1420.876889][T17989] nfs_init_fs_context+0x69/0xf60 [ 1420.881978][T17989] alloc_fs_context+0x618/0x7a0 [ 1420.886916][T17989] __se_sys_fsopen+0xa0/0x2c0 [ 1420.891684][T17989] do_syscall_64+0x55/0xb0 [ 1420.896171][T17989] ? clear_bhb_loop+0x40/0x90 [ 1420.900909][T17989] ? clear_bhb_loop+0x40/0x90 [ 1420.905649][T17989] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1420.911611][T17989] RIP: 0033:0x7fbbd999e1d9 [ 1420.916094][T17989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1420.935845][T17989] RSP: 002b:00007fbbda7a9028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1420.944319][T17989] RAX: ffffffffffffffda RBX: 00007fbbd9c26090 RCX: 00007fbbd999e1d9 [ 1420.952338][T17989] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1420.960350][T17989] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1420.968363][T17989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1420.976378][T17989] R13: 00007fbbd9c26128 R14: 00007fbbd9c26090 R15: 00007fff153cdbf8 [ 1420.984415][T17989] [ 1421.347279][T17988] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1421.774874][T17996] loop1: detected capacity change from 0 to 512 [ 1421.917822][T17996] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1421.931344][T17996] ext4 filesystem being mounted at /133/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1422.443813][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1422.729377][T18007] sctp: [Deprecated]: syz.6.2729 (pid 18007) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1422.729377][T18007] Use struct sctp_sack_info instead [ 1422.833188][T18009] sctp: [Deprecated]: syz.0.2728 (pid 18009) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1422.833188][T18009] Use struct sctp_sack_info instead [ 1423.060407][T18006] bond1: option mode: unable to set because the bond device has slaves [ 1423.143442][T18006] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1423.188355][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.194802][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.423954][T18014] loop6: detected capacity change from 0 to 2048 [ 1423.449678][T18014] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1424.608781][T18017] bond1: option mode: unable to set because the bond device has slaves [ 1424.701853][T18017] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1424.730704][T18024] netlink: 'syz.1.2734': attribute type 3 has an invalid length. [ 1424.739360][T18023] bond1: option mode: unable to set because the bond device has slaves [ 1424.771432][T18023] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1425.171223][T18028] loop6: detected capacity change from 0 to 2048 [ 1425.204360][T18028] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1425.350345][T18030] sctp: [Deprecated]: syz.7.2736 (pid 18030) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1425.350345][T18030] Use struct sctp_sack_info instead [ 1425.511354][T17867] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1426.679409][T18038] loop6: detected capacity change from 0 to 512 [ 1426.905602][T18038] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1426.918523][T18038] ext4 filesystem being mounted at /205/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1427.012039][T18040] bond1: option mode: unable to set because the bond device has slaves [ 1427.232797][T18039] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[18044] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[18039] [ 1427.743798][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1427.797630][T18040] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1427.969543][T18048] loop6: detected capacity change from 0 to 2048 [ 1428.010106][T18048] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1428.094298][T17867] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1428.515985][T18052] loop6: detected capacity change from 0 to 512 [ 1429.248179][T18052] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1429.262615][T18052] ext4 filesystem being mounted at /206/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1430.029425][T13315] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1430.102431][T18063] bond1: option mode: unable to set because the bond device has slaves [ 1430.206816][T18063] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1431.007205][T18069] sctp: [Deprecated]: syz.0.2744 (pid 18069) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1431.007205][T18069] Use struct sctp_sack_info instead [ 1431.368987][T18075] bond2: option mode: unable to set because the bond device has slaves [ 1431.438447][T18074] bond1: option mode: unable to set because the bond device has slaves [ 1431.543331][T18077] loop7: detected capacity change from 0 to 2048 [ 1431.563826][T18074] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1431.588808][T18077] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1432.163317][T18082] loop7: detected capacity change from 0 to 512 [ 1432.584059][T18082] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1432.597389][T18082] ext4 filesystem being mounted at /141/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1435.168945][T18100] FAULT_INJECTION: forcing a failure. [ 1435.168945][T18100] name failslab, interval 1, probability 0, space 0, times 0 [ 1435.182189][T18100] CPU: 0 PID: 18100 Comm: syz.0.2752 Not tainted syzkaller #0 [ 1435.189711][T18100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1435.199816][T18100] Call Trace: [ 1435.203140][T18100] [ 1435.206122][T18100] dump_stack_lvl+0x18c/0x250 [ 1435.210859][T18100] ? show_regs_print_info+0x20/0x20 [ 1435.216105][T18100] ? load_image+0x420/0x420 [ 1435.220668][T18100] ? __might_sleep+0xe0/0xe0 [ 1435.225312][T18100] ? __lock_acquire+0x7eb0/0x7eb0 [ 1435.230402][T18100] should_fail_ex+0x394/0x4c0 [ 1435.235153][T18100] should_failslab+0x9/0x20 [ 1435.239736][T18100] slab_pre_alloc_hook+0x59/0x300 [ 1435.244811][T18100] ? call_usermodehelper_setup+0x8e/0x260 [ 1435.250587][T18100] __kmem_cache_alloc_node+0x53/0x250 [ 1435.256017][T18100] ? call_usermodehelper_setup+0x8e/0x260 [ 1435.261782][T18100] kmalloc_trace+0x2a/0xe0 [ 1435.266254][T18100] call_usermodehelper_setup+0x8e/0x260 [ 1435.271848][T18100] ? __request_module+0x600/0x600 [ 1435.276955][T18100] __request_module+0x3bb/0x600 [ 1435.281861][T18100] ? preempt_schedule+0xc0/0xd0 [ 1435.286874][T18100] ? module_enforce_rwx_sections+0x150/0x150 [ 1435.292909][T18100] ? preempt_schedule+0xc0/0xd0 [ 1435.297810][T18100] ? __lock_acquire+0x7eb0/0x7eb0 [ 1435.302893][T18100] ? preempt_schedule_thunk+0x1a/0x30 [ 1435.308383][T18100] get_fs_type+0x180/0x480 [ 1435.312872][T18100] __se_sys_fsopen+0x86/0x2c0 [ 1435.317603][T18100] do_syscall_64+0x55/0xb0 [ 1435.322070][T18100] ? clear_bhb_loop+0x40/0x90 [ 1435.326799][T18100] ? clear_bhb_loop+0x40/0x90 [ 1435.331532][T18100] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1435.337492][T18100] RIP: 0033:0x7fcff279e1d9 [ 1435.341979][T18100] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1435.361638][T18100] RSP: 002b:00007fcff360a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1435.370105][T18100] RAX: ffffffffffffffda RBX: 00007fcff2a26180 RCX: 00007fcff279e1d9 [ 1435.378137][T18100] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1435.386146][T18100] RBP: 00007fcff2835888 R08: 0000000000000000 R09: 0000000000000000 [ 1435.394158][T18100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1435.402171][T18100] R13: 00007fcff2a26218 R14: 00007fcff2a26180 R15: 00007ffe786ca4b8 [ 1435.410208][T18100] [ 1436.240804][T18104] FAULT_INJECTION: forcing a failure. [ 1436.240804][T18104] name failslab, interval 1, probability 0, space 0, times 0 [ 1436.254267][T18104] CPU: 0 PID: 18104 Comm: syz.6.2753 Not tainted syzkaller #0 [ 1436.261789][T18104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1436.271888][T18104] Call Trace: [ 1436.275231][T18104] [ 1436.278206][T18104] dump_stack_lvl+0x18c/0x250 [ 1436.282943][T18104] ? show_regs_print_info+0x20/0x20 [ 1436.288197][T18104] ? load_image+0x420/0x420 [ 1436.292760][T18104] ? __might_sleep+0xe0/0xe0 [ 1436.297396][T18104] ? __lock_acquire+0x7eb0/0x7eb0 [ 1436.302462][T18104] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1436.308523][T18104] should_fail_ex+0x394/0x4c0 [ 1436.313266][T18104] should_failslab+0x9/0x20 [ 1436.317823][T18104] slab_pre_alloc_hook+0x59/0x300 [ 1436.322902][T18104] ? lockdep_hardirqs_on+0x98/0x150 [ 1436.328155][T18104] ? nfs_alloc_fhandle+0x4a/0x90 [ 1436.333169][T18104] __kmem_cache_alloc_node+0x53/0x250 [ 1436.338604][T18104] ? nfs_alloc_fhandle+0x4a/0x90 [ 1436.343602][T18104] kmalloc_trace+0x2a/0xe0 [ 1436.348083][T18104] nfs_alloc_fhandle+0x4a/0x90 [ 1436.352917][T18104] nfs_init_fs_context+0x69/0xf60 [ 1436.357993][T18104] alloc_fs_context+0x618/0x7a0 [ 1436.362940][T18104] __se_sys_fsopen+0xa0/0x2c0 [ 1436.367695][T18104] do_syscall_64+0x55/0xb0 [ 1436.372158][T18104] ? clear_bhb_loop+0x40/0x90 [ 1436.376874][T18104] ? clear_bhb_loop+0x40/0x90 [ 1436.381693][T18104] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1436.387660][T18104] RIP: 0033:0x7f9af559e1d9 [ 1436.392118][T18104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1436.411768][T18104] RSP: 002b:00007f9af641d028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1436.420238][T18104] RAX: ffffffffffffffda RBX: 00007f9af5826180 RCX: 00007f9af559e1d9 [ 1436.428254][T18104] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1436.436282][T18104] RBP: 00007f9af5635888 R08: 0000000000000000 R09: 0000000000000000 [ 1436.444293][T18104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1436.452313][T18104] R13: 00007f9af5826218 R14: 00007f9af5826180 R15: 00007ffd49823be8 [ 1436.460353][T18104] [ 1437.314013][T18108] loop1: detected capacity change from 0 to 2048 [ 1437.359594][T18108] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1437.579679][T18113] FAULT_INJECTION: forcing a failure. [ 1437.579679][T18113] name failslab, interval 1, probability 0, space 0, times 0 [ 1437.592842][T18113] CPU: 0 PID: 18113 Comm: syz.0.2754 Not tainted syzkaller #0 [ 1437.600372][T18113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1437.610495][T18113] Call Trace: [ 1437.613829][T18113] [ 1437.616815][T18113] dump_stack_lvl+0x18c/0x250 [ 1437.621553][T18113] ? show_regs_print_info+0x20/0x20 [ 1437.626896][T18113] ? load_image+0x420/0x420 [ 1437.631468][T18113] ? __lock_acquire+0x7eb0/0x7eb0 [ 1437.636573][T18113] should_fail_ex+0x394/0x4c0 [ 1437.641333][T18113] should_failslab+0x9/0x20 [ 1437.645911][T18113] slab_pre_alloc_hook+0x59/0x300 [ 1437.651003][T18113] ? nfs_init_fs_context+0x58/0xf60 [ 1437.656259][T18113] __kmem_cache_alloc_node+0x53/0x250 [ 1437.661708][T18113] ? nfs_init_fs_context+0x58/0xf60 [ 1437.666973][T18113] kmalloc_trace+0x2a/0xe0 [ 1437.671470][T18113] nfs_init_fs_context+0x58/0xf60 [ 1437.676562][T18113] alloc_fs_context+0x618/0x7a0 [ 1437.681484][T18113] __se_sys_fsopen+0xa0/0x2c0 [ 1437.686245][T18113] do_syscall_64+0x55/0xb0 [ 1437.690725][T18113] ? clear_bhb_loop+0x40/0x90 [ 1437.695457][T18113] ? clear_bhb_loop+0x40/0x90 [ 1437.700192][T18113] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1437.706160][T18113] RIP: 0033:0x7fcff279e1d9 [ 1437.710627][T18113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1437.730296][T18113] RSP: 002b:00007fcff360a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1437.738775][T18113] RAX: ffffffffffffffda RBX: 00007fcff2a26180 RCX: 00007fcff279e1d9 [ 1437.746800][T18113] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1437.754827][T18113] RBP: 00007fcff2835888 R08: 0000000000000000 R09: 0000000000000000 [ 1437.762903][T18113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1437.770947][T18113] R13: 00007fcff2a26218 R14: 00007fcff2a26180 R15: 00007ffe786ca4b8 [ 1437.779023][T18113] [ 1438.037896][T18115] loop1: detected capacity change from 0 to 512 [ 1438.207698][T18115] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1438.220974][T18115] ext4 filesystem being mounted at /136/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1438.450305][T18110] bond1: option mode: unable to set because the bond device has slaves [ 1438.659794][T15180] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1438.926369][T15359] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1438.999223][T18122] netlink: 'syz.1.2757': attribute type 3 has an invalid length. [ 1440.217164][T18133] IPv6: Can't replace route, no match found [ 1440.408871][T18137] netlink: 'syz.1.2760': attribute type 3 has an invalid length. [ 1442.010251][T18152] netlink: 'syz.7.2762': attribute type 3 has an invalid length. [ 1443.469837][T18151] bond1: option mode: unable to set because the bond device has slaves [ 1443.482022][T18166] netlink: 'syz.7.2764': attribute type 3 has an invalid length. [ 1444.611992][T18151] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1445.026859][T18176] netlink: 'syz.1.2766': attribute type 3 has an invalid length. [ 1446.250458][T18180] FAULT_INJECTION: forcing a failure. [ 1446.250458][T18180] name failslab, interval 1, probability 0, space 0, times 0 [ 1446.263350][T18180] CPU: 0 PID: 18180 Comm: syz.7.2767 Not tainted syzkaller #0 [ 1446.270875][T18180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1446.280980][T18180] Call Trace: [ 1446.284310][T18180] [ 1446.287289][T18180] dump_stack_lvl+0x18c/0x250 [ 1446.292018][T18180] ? show_regs_print_info+0x20/0x20 [ 1446.297233][T18180] ? load_image+0x420/0x420 [ 1446.301770][T18180] ? __lock_acquire+0x7eb0/0x7eb0 [ 1446.306881][T18180] should_fail_ex+0x394/0x4c0 [ 1446.311608][T18180] should_failslab+0x9/0x20 [ 1446.316147][T18180] slab_pre_alloc_hook+0x59/0x300 [ 1446.321191][T18180] ? nfs_init_fs_context+0x58/0xf60 [ 1446.326415][T18180] __kmem_cache_alloc_node+0x53/0x250 [ 1446.331827][T18180] ? nfs_init_fs_context+0x58/0xf60 [ 1446.337046][T18180] kmalloc_trace+0x2a/0xe0 [ 1446.341492][T18180] nfs_init_fs_context+0x58/0xf60 [ 1446.346544][T18180] alloc_fs_context+0x618/0x7a0 [ 1446.351443][T18180] __se_sys_fsopen+0xa0/0x2c0 [ 1446.356155][T18180] do_syscall_64+0x55/0xb0 [ 1446.360594][T18180] ? clear_bhb_loop+0x40/0x90 [ 1446.365313][T18180] ? clear_bhb_loop+0x40/0x90 [ 1446.370040][T18180] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1446.375988][T18180] RIP: 0033:0x7fbbd999e1d9 [ 1446.380455][T18180] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1446.400118][T18180] RSP: 002b:00007fbbda7a9028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1446.408574][T18180] RAX: ffffffffffffffda RBX: 00007fbbd9c26090 RCX: 00007fbbd999e1d9 [ 1446.416656][T18180] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 1446.424652][T18180] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1446.432653][T18180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1446.440669][T18180] R13: 00007fbbd9c26128 R14: 00007fbbd9c26090 R15: 00007fff153cdbf8 [ 1446.448723][T18180] [ 1447.017181][T18182] bond1: option mode: unable to set because the bond device has slaves [ 1447.458190][T18189] netlink: 'syz.7.2769': attribute type 3 has an invalid length. [ 1448.663897][T18195] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1448.928669][T18198] netlink: 'syz.7.2770': attribute type 3 has an invalid length. [ 1450.166052][T18204] netlink: 'syz.0.2771': attribute type 3 has an invalid length. [ 1451.381816][T18211] bond1: option mode: unable to set because the bond device has slaves [ 1451.453161][T18212] bond1: option mode: unable to set because the bond device has slaves [ 1451.554130][T18212] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1451.598219][T18215] netlink: 'syz.0.2774': attribute type 3 has an invalid length. [ 1452.623016][T18216] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1453.095416][T18224] netlink: 'syz.0.2775': attribute type 3 has an invalid length. [ 1454.299922][T18233] bond1: option mode: unable to set because the bond device has slaves [ 1454.377816][T18237] netlink: 'syz.1.2779': attribute type 3 has an invalid length. [ 1454.599211][T18235] netlink: 'syz.0.2778': attribute type 3 has an invalid length. [ 1455.519608][T18238] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1456.021254][T18249] netlink: 'syz.6.2780': attribute type 3 has an invalid length. [ 1456.133010][T18254] netlink: 'syz.0.2782': attribute type 3 has an invalid length. [ 1456.352546][T18256] bond1: option mode: unable to set because the bond device has slaves [ 1457.459375][T18256] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1457.635515][T18267] netlink: 'syz.7.2783': attribute type 3 has an invalid length. [ 1457.705687][T18269] netlink: 'syz.6.2785': attribute type 3 has an invalid length. [ 1459.355219][T18278] bond2: option mode: unable to set because the bond device has slaves [ 1459.407402][T18285] bond1: option mode: unable to set because the bond device has slaves [ 1459.796023][T18291] FAULT_INJECTION: forcing a failure. [ 1459.796023][T18291] name failslab, interval 1, probability 0, space 0, times 0 [ 1460.099334][T18294] FAULT_INJECTION: forcing a failure. [ 1460.099334][T18294] name failslab, interval 1, probability 0, space 0, times 0 [ 1460.113097][T18294] CPU: 1 PID: 18294 Comm: syz.7.2786 Not tainted syzkaller #0 [ 1460.120611][T18294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1460.130713][T18294] Call Trace: [ 1460.134036][T18294] [ 1460.137007][T18294] dump_stack_lvl+0x18c/0x250 [ 1460.141766][T18294] ? show_regs_print_info+0x20/0x20 [ 1460.147006][T18294] ? load_image+0x420/0x420 [ 1460.151569][T18294] ? __might_sleep+0xe0/0xe0 [ 1460.156206][T18294] ? __lock_acquire+0x7eb0/0x7eb0 [ 1460.161289][T18294] should_fail_ex+0x394/0x4c0 [ 1460.166032][T18294] should_failslab+0x9/0x20 [ 1460.170588][T18294] slab_pre_alloc_hook+0x59/0x300 [ 1460.175661][T18294] ? __request_module+0x2ed/0x600 [ 1460.180746][T18294] ? __request_module+0x2ed/0x600 [ 1460.185820][T18294] __kmem_cache_alloc_node+0x53/0x250 [ 1460.191257][T18294] ? __request_module+0x2ed/0x600 [ 1460.196338][T18294] __kmalloc_node_track_caller+0xa4/0x230 [ 1460.202126][T18294] kstrdup+0x3b/0x80 [ 1460.206085][T18294] __request_module+0x2ed/0x600 [ 1460.210999][T18294] ? module_enforce_rwx_sections+0x150/0x150 [ 1460.217033][T18294] ? __lock_acquire+0x7eb0/0x7eb0 [ 1460.222111][T18294] ? __virt_addr_valid+0x10c/0x380 [ 1460.227316][T18294] get_fs_type+0x180/0x480 [ 1460.231907][T18294] __se_sys_fsopen+0x86/0x2c0 [ 1460.236646][T18294] do_syscall_64+0x55/0xb0 [ 1460.241111][T18294] ? clear_bhb_loop+0x40/0x90 [ 1460.245831][T18294] ? clear_bhb_loop+0x40/0x90 [ 1460.250578][T18294] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1460.256534][T18294] RIP: 0033:0x7fbbd999e1d9 [ 1460.260992][T18294] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1460.280659][T18294] RSP: 002b:00007fbbd77f4028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1460.289139][T18294] RAX: ffffffffffffffda RBX: 00007fbbd9c26270 RCX: 00007fbbd999e1d9 [ 1460.297157][T18294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1460.305173][T18294] RBP: 00007fbbd9a35888 R08: 0000000000000000 R09: 0000000000000000 [ 1460.313196][T18294] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1460.321221][T18294] R13: 00007fbbd9c26308 R14: 00007fbbd9c26270 R15: 00007fff153cdbf8 [ 1460.329283][T18294] [ 1460.353002][T18291] CPU: 1 PID: 18291 Comm: syz.1.2788 Not tainted syzkaller #0 [ 1460.360558][T18291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1460.370667][T18291] Call Trace: [ 1460.374001][T18291] [ 1460.376986][T18291] dump_stack_lvl+0x18c/0x250 [ 1460.381729][T18291] ? show_regs_print_info+0x20/0x20 [ 1460.386991][T18291] ? load_image+0x420/0x420 [ 1460.391558][T18291] ? __might_sleep+0xe0/0xe0 [ 1460.396205][T18291] ? __lock_acquire+0x7eb0/0x7eb0 [ 1460.401309][T18291] should_fail_ex+0x394/0x4c0 [ 1460.406061][T18291] should_failslab+0x9/0x20 [ 1460.410623][T18291] slab_pre_alloc_hook+0x59/0x300 [ 1460.415707][T18291] ? call_usermodehelper_setup+0x8e/0x260 [ 1460.421503][T18291] __kmem_cache_alloc_node+0x53/0x250 [ 1460.426941][T18291] ? call_usermodehelper_setup+0x8e/0x260 [ 1460.432720][T18291] kmalloc_trace+0x2a/0xe0 [ 1460.437227][T18291] call_usermodehelper_setup+0x8e/0x260 [ 1460.442843][T18291] ? __request_module+0x600/0x600 [ 1460.447926][T18291] __request_module+0x3bb/0x600 [ 1460.452871][T18291] ? module_enforce_rwx_sections+0x150/0x150 [ 1460.458916][T18291] ? __lock_acquire+0x7eb0/0x7eb0 [ 1460.463996][T18291] ? __virt_addr_valid+0x10c/0x380 [ 1460.469159][T18291] get_fs_type+0x180/0x480 [ 1460.473625][T18291] __se_sys_fsopen+0x86/0x2c0 [ 1460.478345][T18291] do_syscall_64+0x55/0xb0 [ 1460.482800][T18291] ? clear_bhb_loop+0x40/0x90 [ 1460.487500][T18291] ? clear_bhb_loop+0x40/0x90 [ 1460.492216][T18291] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1460.498157][T18291] RIP: 0033:0x7f97e839e1d9 [ 1460.502626][T18291] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1460.522276][T18291] RSP: 002b:00007f97e9239028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1460.530912][T18291] RAX: ffffffffffffffda RBX: 00007f97e8626180 RCX: 00007f97e839e1d9 [ 1460.538918][T18291] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1460.546926][T18291] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1460.554922][T18291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1460.562917][T18291] R13: 00007f97e8626218 R14: 00007f97e8626180 R15: 00007ffdf18c68c8 [ 1460.570931][T18291] [ 1460.764684][T18288] bond2: (slave macvlan4): Error -98 calling set_mac_address [ 1460.884189][T18297] netlink: 'syz.7.2790': attribute type 3 has an invalid length. [ 1460.914268][T18287] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1461.984894][T18301] bond1: option mode: unable to set because the bond device has slaves [ 1462.048656][T18307] bond2: option mode: unable to set because the bond device has slaves [ 1462.096557][T18299] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1462.337162][T18310] bond2: (slave macvlan4): Error -98 calling set_mac_address [ 1463.743036][T18321] netlink: 'syz.1.2794': attribute type 3 has an invalid length. [ 1463.791305][T18325] netlink: 'syz.0.2795': attribute type 3 has an invalid length. [ 1463.803860][T18323] netlink: 'syz.7.2796': attribute type 3 has an invalid length. [ 1465.767701][T18336] bond1: option mode: unable to set because the bond device has slaves [ 1465.865826][T18342] netlink: 'syz.1.2798': attribute type 3 has an invalid length. [ 1466.173786][T18336] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1469.116988][T18372] netlink: 'syz.0.2803': attribute type 3 has an invalid length. [ 1469.848915][T18371] tty tty35: ldisc open failed (-12), clearing slot 34 [ 1470.316393][T18377] netlink: 'syz.6.2804': attribute type 3 has an invalid length. [ 1470.554707][T18384] netlink: 'syz.1.2806': attribute type 3 has an invalid length. [ 1470.571380][T18381] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1470.688369][T18388] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2807'. [ 1471.941342][T18400] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2808'. [ 1472.658903][T18393] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1472.986715][T18410] bond2: option mode: unable to set because the bond device has slaves [ 1473.037582][T18410] bond2: (slave macvlan4): Error -98 calling set_mac_address [ 1473.347670][T18415] netlink: 'syz.6.2813': attribute type 3 has an invalid length. [ 1474.436394][T18427] bond2: option mode: unable to set because the bond device has slaves [ 1474.519633][T18427] bond2: (slave macvlan4): Error -98 calling set_mac_address [ 1474.533341][T18430] netlink: 'syz.7.2815': attribute type 3 has an invalid length. [ 1475.126360][T18435] netlink: 'syz.0.2816': attribute type 3 has an invalid length. [ 1475.881389][T18438] netlink: 'syz.6.2817': attribute type 3 has an invalid length. [ 1477.136215][T18452] netlink: 'syz.1.2818': attribute type 3 has an invalid length. [ 1477.171080][T18457] netlink: 'syz.7.2819': attribute type 3 has an invalid length. [ 1477.455947][T18454] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2820'. [ 1477.477714][T18458] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2821'. [ 1477.493801][T18454] bond2: (slave macvlan4): Error -98 calling set_mac_address [ 1478.198244][T18458] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1478.650516][T18468] netlink: 'syz.7.2822': attribute type 3 has an invalid length. [ 1479.942884][T18480] bond2: option mode: unable to set because the bond device has slaves [ 1480.009289][T18480] bond2: (slave macvlan4): Error -98 calling set_mac_address [ 1480.252232][T18484] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1480.333654][T18486] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1480.358456][T18490] netlink: 'syz.0.2829': attribute type 3 has an invalid length. [ 1480.614746][T18495] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1480.649073][T18498] bond1: option mode: unable to set because the bond device has slaves [ 1480.682513][T18498] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1480.840362][T18501] bond1: option mode: unable to set because the bond device has slaves [ 1480.911330][T18501] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1480.925773][T18504] netlink: 'syz.1.2834': attribute type 3 has an invalid length. [ 1482.072989][T18506] bond1: option mode: unable to set because the bond device has slaves [ 1482.251278][T18506] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1482.277942][T18517] netlink: 'syz.0.2836': attribute type 3 has an invalid length. [ 1482.302387][T18519] bond1: option mode: unable to set because the bond device has slaves [ 1482.336924][T18519] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1482.363797][T18518] bond1: option mode: unable to set because the bond device has slaves [ 1482.443993][T18518] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1482.568151][T18522] bond1: option mode: unable to set because the bond device has slaves [ 1482.591721][T18522] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1483.521189][T18528] netlink: 'syz.7.2841': attribute type 3 has an invalid length. [ 1483.808560][T18529] bond1: option mode: unable to set because the bond device has slaves [ 1483.827969][T18532] bond1: option mode: unable to set because the bond device has slaves [ 1484.295075][T18537] sctp: [Deprecated]: syz.0.2843 (pid 18537) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1484.295075][T18537] Use struct sctp_sack_info instead [ 1484.641255][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.641378][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.780311][T18529] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1484.874847][T18544] netlink: 'syz.0.2844': attribute type 3 has an invalid length. [ 1484.949240][T18541] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1485.016370][T18546] loop7: detected capacity change from 0 to 2048 [ 1485.032760][T18546] UDF-fs: bad mount option "ÿÿÿÿÿÿ" or missing value [ 1488.129183][T18572] netlink: 'syz.7.2850': attribute type 3 has an invalid length. [ 1489.679767][T18581] bond1: option mode: unable to set because the bond device has slaves [ 1489.702511][T18585] bond1: option mode: unable to set because the bond device has slaves [ 1489.781808][T18586] sctp: [Deprecated]: syz.6.2852 (pid 18586) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1489.781808][T18586] Use struct sctp_sack_info instead [ 1490.252061][T18582] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1490.329911][T18587] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1490.525633][T18589] bond1: option mode: unable to set because the bond device has slaves [ 1490.559175][T18589] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1490.702328][T18593] netlink: 'syz.7.2857': attribute type 3 has an invalid length. [ 1490.710971][T18591] bond1: option mode: unable to set because the bond device has slaves [ 1490.939631][T18591] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1491.004859][T18596] bond1: option mode: unable to set because the bond device has slaves [ 1491.031525][T18596] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1491.986390][T18604] netlink: 'syz.1.2860': attribute type 3 has an invalid length. [ 1493.145477][T18608] bond1: option mode: unable to set because the bond device has slaves [ 1493.274571][T18608] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1493.892615][T18624] sctp: [Deprecated]: syz.1.2864 (pid 18624) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1493.892615][T18624] Use struct sctp_sack_info instead [ 1494.815725][T18626] bond1: option mode: unable to set because the bond device has slaves [ 1494.866812][T18626] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1494.897158][T18630] bond1: option mode: unable to set because the bond device has slaves [ 1494.908394][T18628] bond1: option mode: unable to set because the bond device has slaves [ 1494.947566][T18630] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1495.000430][T18628] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 1495.774584][T18643] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2870'. [ 1495.784165][T18643] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2870'. [ 1495.793533][T18643] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2870'. [ 1498.641248][T18663] sctp: [Deprecated]: syz.0.2874 (pid 18663) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1498.641248][T18663] Use struct sctp_sack_info instead [ 1503.616532][T18697] Console: switching to colour VGA+ 80x25 [ 1504.438451][T18686] ================================================================== [ 1504.438539][T18686] BUG: KASAN: slab-out-of-bounds in fbcon_prepare_logo+0x4e2/0xa70 [ 1504.438626][T18686] Read of size 218 at addr ffff88806c7354aa by task syz.1.2884/18686 [ 1504.438676][T18686] [ 1504.438713][T18686] CPU: 0 PID: 18686 Comm: syz.1.2884 Not tainted syzkaller #0 [ 1504.438764][T18686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1504.438778][T18686] Call Trace: [ 1504.438787][T18686] [ 1504.438797][T18686] dump_stack_lvl+0x18c/0x250 [ 1504.438823][T18686] ? __lock_acquire+0x7eb0/0x7eb0 [ 1504.438851][T18686] ? show_regs_print_info+0x20/0x20 [ 1504.438873][T18686] ? load_image+0x420/0x420 [ 1504.438903][T18686] ? atomic_notifier_call_chain+0x26/0x180 [ 1504.438940][T18686] ? __virt_addr_valid+0x10c/0x380 [ 1504.438969][T18686] ? __virt_addr_valid+0x10c/0x380 [ 1504.438998][T18686] ? __virt_addr_valid+0x10c/0x380 [ 1504.439030][T18686] print_report+0xa8/0x210 [ 1504.439060][T18686] ? fbcon_prepare_logo+0x4e2/0xa70 [ 1504.439092][T18686] kasan_report+0x117/0x150 [ 1504.439122][T18686] ? fbcon_prepare_logo+0x4e2/0xa70 [ 1504.439158][T18686] kasan_check_range+0x241/0x290 [ 1504.439186][T18686] ? fbcon_prepare_logo+0x4e2/0xa70 [ 1504.439219][T18686] __asan_memcpy+0x29/0x70 [ 1504.439251][T18686] fbcon_prepare_logo+0x4e2/0xa70 [ 1504.439291][T18686] fbcon_init+0x1380/0x2460 [ 1504.439332][T18686] visual_init+0x2dd/0x650 [ 1504.439387][T18686] do_bind_con_driver+0x859/0x1030 [ 1504.439422][T18686] ? sysfs_kf_read+0x360/0x360 [ 1504.439458][T18686] store_bind+0x798/0xa20 [ 1504.439482][T18686] ? sysfs_kf_read+0x360/0x360 [ 1504.439503][T18686] kernfs_fop_write_iter+0x3a4/0x520 [ 1504.439528][T18686] vfs_write+0x474/0x9a0 [ 1504.439562][T18686] ? file_end_write+0x250/0x250 [ 1504.439596][T18686] ? __fget_files+0x3fc/0x460 [ 1504.439632][T18686] ? __fdget_pos+0x2a3/0x330 [ 1504.439661][T18686] ? ksys_write+0x74/0x260 [ 1504.439693][T18686] ksys_write+0x151/0x260 [ 1504.439725][T18686] ? __ia32_sys_read+0x90/0x90 [ 1504.439758][T18686] ? lockdep_hardirqs_on+0x98/0x150 [ 1504.439786][T18686] do_syscall_64+0x55/0xb0 [ 1504.439806][T18686] ? clear_bhb_loop+0x40/0x90 [ 1504.439829][T18686] ? clear_bhb_loop+0x40/0x90 [ 1504.439852][T18686] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1504.439887][T18686] RIP: 0033:0x7f97e839e1d9 [ 1504.439907][T18686] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1504.439934][T18686] RSP: 002b:00007f97e927b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1504.439960][T18686] RAX: ffffffffffffffda RBX: 00007f97e8625fa0 RCX: 00007f97e839e1d9 [ 1504.439977][T18686] RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000003 [ 1504.439993][T18686] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1504.440007][T18686] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1504.440022][T18686] R13: 00007f97e8626038 R14: 00007f97e8625fa0 R15: 00007ffdf18c68c8 [ 1504.440047][T18686] [ 1504.440055][T18686] [ 1504.440060][T18686] Allocated by task 18686: [ 1504.440102][T18686] kasan_set_track+0x4e/0x70 [ 1504.440127][T18686] __kasan_kmalloc+0x8f/0xa0 [ 1504.440153][T18686] __kmalloc+0xb7/0x240 [ 1504.440181][T18686] vc_do_resize+0x357/0x17f0 [ 1504.440208][T18686] fbcon_init+0x1399/0x2460 [ 1504.440236][T18686] visual_init+0x2dd/0x650 [ 1504.440262][T18686] do_bind_con_driver+0x859/0x1030 [ 1504.440290][T18686] store_bind+0x798/0xa20 [ 1504.440306][T18686] kernfs_fop_write_iter+0x3a4/0x520 [ 1504.440326][T18686] vfs_write+0x474/0x9a0 [ 1504.440353][T18686] ksys_write+0x151/0x260 [ 1504.440380][T18686] do_syscall_64+0x55/0xb0 [ 1504.440398][T18686] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1504.440430][T18686] [ 1504.440435][T18686] The buggy address belongs to the object at ffff88806c734000 [ 1504.440435][T18686] which belongs to the cache kmalloc-4k of size 4096 [ 1504.440481][T18686] The buggy address is located 2020 bytes to the right of [ 1504.440481][T18686] allocated 3270-byte region [ffff88806c734000, ffff88806c734cc6) [ 1504.440531][T18686] [ 1504.440536][T18686] The buggy address belongs to the physical page: [ 1504.440578][T18686] page:ffffea0001b1cc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6c730 [ 1504.440603][T18686] head:ffffea0001b1cc00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1504.440623][T18686] ksm flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 1504.440643][T18686] page_type: 0xffffffff() [ 1504.440668][T18686] raw: 00fff00000000840 ffff888018842140 ffffea0001a5fa00 dead000000000003 [ 1504.440688][T18686] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 1504.440699][T18686] page dumped because: kasan: bad access detected [ 1504.440715][T18686] page_owner tracks the page as allocated [ 1504.440723][T18686] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 17243, tgid 17241 (syz.6.2567), ts 1331165401703, free_ts 1325350695351 [ 1504.440763][T18686] post_alloc_hook+0x1c1/0x200 [ 1504.440782][T18686] get_page_from_freelist+0x2181/0x22a0 [ 1504.440804][T18686] __alloc_pages+0x1f0/0x460 [ 1504.440823][T18686] alloc_slab_page+0x5d/0x180 [ 1504.440844][T18686] new_slab+0x87/0x2d0 [ 1504.440862][T18686] ___slab_alloc+0xc5c/0x12f0 [ 1504.440880][T18686] __kmem_cache_alloc_node+0x11f/0x250 [ 1504.440911][T18686] __kmalloc_node_track_caller+0xa4/0x230 [ 1504.440949][T18686] kmalloc_reserve+0x116/0x240 [ 1504.441042][T18686] __alloc_skb+0x138/0x2c0 [ 1504.441067][T18686] netlink_dump+0x1ee/0xec0 [ 1504.441134][T18686] __netlink_dump_start+0x57c/0x7a0 [ 1504.441158][T18686] unix_diag_handler_dump+0x1ab/0x900 [ 1504.441195][T18686] sock_diag_rcv_msg+0x3d3/0x5f0 [ 1504.441240][T18686] netlink_rcv_skb+0x235/0x4c0 [ 1504.441264][T18686] sock_diag_rcv+0x2a/0x40 [ 1504.441284][T18686] page last free stack trace: [ 1504.441292][T18686] free_unref_page_prepare+0x7d7/0x8f0 [ 1504.441312][T18686] free_unref_page+0x32/0x2e0 [ 1504.441330][T18686] __unfreeze_partials+0x1cf/0x210 [ 1504.441351][T18686] put_cpu_partial+0x17c/0x250 [ 1504.441371][T18686] __slab_free+0x319/0x400 [ 1504.441390][T18686] qlist_free_all+0x75/0xd0 [ 1504.441420][T18686] kasan_quarantine_reduce+0x143/0x160 [ 1504.441450][T18686] __kasan_slab_alloc+0x22/0x80 [ 1504.441474][T18686] slab_post_alloc_hook+0x6a/0x4d0 [ 1504.441492][T18686] kmem_cache_alloc+0x17e/0x2c0 [ 1504.441520][T18686] ptlock_alloc+0x20/0x70 [ 1504.441539][T18686] pte_alloc_one+0xcc/0x540 [ 1504.441563][T18686] handle_mm_fault+0x2f72/0x4a50 [ 1504.441582][T18686] __get_user_pages+0x604/0x1580 [ 1504.441609][T18686] populate_vma_page_range+0x2c1/0x380 [ 1504.441657][T18686] __mm_populate+0x260/0x390 [ 1504.441685][T18686] [ 1504.441690][T18686] Memory state around the buggy address: [ 1504.441734][T18686] ffff88806c735380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1504.441750][T18686] ffff88806c735400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1504.441765][T18686] >ffff88806c735480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1504.441776][T18686] ^ [ 1504.441788][T18686] ffff88806c735500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1504.441803][T18686] ffff88806c735580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1504.441814][T18686] ================================================================== [ 1504.447434][T18686] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1504.447451][T18686] CPU: 0 PID: 18686 Comm: syz.1.2884 Not tainted syzkaller #0 [ 1504.447476][T18686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1504.447489][T18686] Call Trace: [ 1504.447498][T18686] [ 1504.447507][T18686] dump_stack_lvl+0x18c/0x250 [ 1504.447537][T18686] ? show_regs_print_info+0x20/0x20 [ 1504.447559][T18686] ? load_image+0x420/0x420 [ 1504.447596][T18686] panic+0x2ca/0x720 [ 1504.447626][T18686] ? bpf_jit_dump+0xd0/0xd0 [ 1504.447655][T18686] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 1504.447754][T18686] ? _raw_spin_unlock+0x40/0x40 [ 1504.447783][T18686] ? print_memory_metadata+0x314/0x400 [ 1504.447820][T18686] ? fbcon_prepare_logo+0x4e2/0xa70 [ 1504.447852][T18686] check_panic_on_warn+0x84/0xa0 [ 1504.447881][T18686] ? fbcon_prepare_logo+0x4e2/0xa70 [ 1504.447912][T18686] end_report+0x6f/0x130 [ 1504.447948][T18686] kasan_report+0x128/0x150 [ 1504.447976][T18686] ? fbcon_prepare_logo+0x4e2/0xa70 [ 1504.448013][T18686] kasan_check_range+0x241/0x290 [ 1504.448041][T18686] ? fbcon_prepare_logo+0x4e2/0xa70 [ 1504.448075][T18686] __asan_memcpy+0x29/0x70 [ 1504.448107][T18686] fbcon_prepare_logo+0x4e2/0xa70 [ 1504.448147][T18686] fbcon_init+0x1380/0x2460 [ 1504.448187][T18686] visual_init+0x2dd/0x650 [ 1504.448218][T18686] do_bind_con_driver+0x859/0x1030 [ 1504.448252][T18686] ? sysfs_kf_read+0x360/0x360 [ 1504.448276][T18686] store_bind+0x798/0xa20 [ 1504.448299][T18686] ? sysfs_kf_read+0x360/0x360 [ 1504.448320][T18686] kernfs_fop_write_iter+0x3a4/0x520 [ 1504.448344][T18686] vfs_write+0x474/0x9a0 [ 1504.448378][T18686] ? file_end_write+0x250/0x250 [ 1504.448411][T18686] ? __fget_files+0x3fc/0x460 [ 1504.448446][T18686] ? __fdget_pos+0x2a3/0x330 [ 1504.448475][T18686] ? ksys_write+0x74/0x260 [ 1504.448507][T18686] ksys_write+0x151/0x260 [ 1504.448538][T18686] ? __ia32_sys_read+0x90/0x90 [ 1504.448571][T18686] ? lockdep_hardirqs_on+0x98/0x150 [ 1504.448599][T18686] do_syscall_64+0x55/0xb0 [ 1504.448618][T18686] ? clear_bhb_loop+0x40/0x90 [ 1504.448640][T18686] ? clear_bhb_loop+0x40/0x90 [ 1504.448662][T18686] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1504.448697][T18686] RIP: 0033:0x7f97e839e1d9 [ 1504.448716][T18686] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1504.448736][T18686] RSP: 002b:00007f97e927b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1504.448760][T18686] RAX: ffffffffffffffda RBX: 00007f97e8625fa0 RCX: 00007f97e839e1d9 [ 1504.448777][T18686] RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000003 [ 1504.448792][T18686] RBP: 00007f97e8435888 R08: 0000000000000000 R09: 0000000000000000 [ 1504.448806][T18686] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1504.448819][T18686] R13: 00007f97e8626038 R14: 00007f97e8625fa0 R15: 00007ffdf18c68c8 [ 1504.448845][T18686] [ 1504.449431][T18686] Kernel Offset: disabled