last executing test programs: 45.764447862s ago: executing program 4 (id=385): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x11, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 45.763229563s ago: executing program 4 (id=386): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) 45.738039569s ago: executing program 4 (id=387): r0 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @remote}, 0x10) 45.723060515s ago: executing program 4 (id=388): syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f0000000340)={[{@noload}, {@nolazytime}, {@discard}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@data_err_ignore}, {@noblock_validity}]}, 0xff, 0x456, &(0x7f0000002380)="$eJzs3M+PU0UcAPDve+0uv91V8QcIuopG4o+FXX4evGA08aCJiR4wntbdhSCFVXZNhBBFD3g0JN6NRxP/Ak96MerJxKveDQkxXECNyTPv9XUppV22bJci/XySV2b6psx8O2/a6Uy7AQyssfwmidgYEb9FxEg9e32Bsfo/Vy+fnf7r8tnpJLLsjT+TotyVy2enG0Ubj9tQz2RZmV/Tpt7zb0dM1Wqzp8r8roUT7+2aP33m+WMnpo7OHp09OXnw4N4924f3T+7rSZx5XFe2fjS3bcsrb114bfrwhXd++iZv78byfHMcPbJurP7stvVUjyvrt01N6aTax4bQlUpE5N01VIz/kajEusVzI/Hyp31tHLCqsizL2r0/l85lwF0siX63AOiPxht9/vm3cdymqccd4dKhiPcP1OO/Wh71M9VIyzJDLZ9ve2ksIg6f+/vL/IjVWYcAALjOd4ci4rl28780Hmwqd0+5hzIaEfdGxH0RcX9EbI6IByKKsg9FxMNd1t+6Q3Lj/Ce9eEuBLVM+/3uh3NtanP/9mxXxl0YrZW5TEf9QcuRYbXZ3+ZzsjKE1eX5iiTq+f+nXzzuda57/5Udef2MuWJderLYs0M1MLUytMOxFlz6J2Fptib+QRGMbJ4mILRGxtav/OcvS4jbi2DNfb+tU6ubxL6EH+0zZVxFP1/v/XLTE35B03J+cOLB/ct+utVGb3f1PlmXFVXGjn385/3qn+lcUfw/k/b++9fovLMY/mqyNmD995nixXzsfrTvEN3X+9886fqa51et/OHmzSA+X9304tbBwaiJiOHn1xvsnrz22zFeb49+5o138afEa14j2kYjIL+LtEfFoRDxWtv3xiHgiInYsEf+PLz75bvfxL7Eq30N5/DM36/9o7v/uE5XjP3zbffwNef/vLVI7y3uW8/q33Aau5LkDAACA/4u0+A58ko4vptN0fLz+Hf7NsT6tzc0vPHtk7oOTM/Xvyo/GUNpY/xxpWg+dKNeGG/nJa0swRX5PuW78RWVdkR+fnqvN9Dl2GHQbOoz/3B+VfrcOWHV+rwWDy/iHwWX8w+Ay/mFwGf8wuNqN/4/70A7g9vP+D4PL+IfBZfzD4DL+YSB1/G18uqKf/Evc9YlIu39UNfra5qSLPwxx5ySqq93mNW1P9fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+CwAA//8VTuic") truncate(&(0x7f0000000040)='./file2\x00', 0xffff) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000, 0x2, &(0x7f0000239000/0x1000)=nil) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, &(0x7f0000001080)='\x00', 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="595325bd7000fddbdf256b00000008000300f56fc649b437cc53550289000000ffd405e1277dd3ce3472d1eceaaa44d3450751efe2ff09de040462d6716b32ce786f1e04c62dbd2a4e9e40c647a4a18ca68fcfb8da360dcdc745630e946a4eb77e64480f0ae270991d70e5bd9b3cd4bcabbdb9ed28021425b3725ff049a98f0c079f9c6469392d0c013a8821477cd4ecc32c5d8099176bb9b8d220ed161c36f2e6a577341a30170c896d1e47353e9618e589d5500e0e9622577b124c0c7c1aa2", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8441}, 0x2004000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x54}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, 0x0, 0x240008c4) request_key(&(0x7f00000010c0)='dns_resolver\x00', &(0x7f0000001100)={'syz', 0x2}, 0x0, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) vmsplice(0xffffffffffffffff, &(0x7f00000014c0)=[{0x0}], 0x1, 0x0) sendmmsg$sock(r1, 0x0, 0x0, 0x20000044) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000040)=0x1e) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 44.837010594s ago: executing program 4 (id=392): r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r0, r1, 0x0, 0x2000fb) 44.562601003s ago: executing program 4 (id=393): syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)={0x20000002}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0xc800001a}) bind$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x1}, 0x6e) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r4) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) r5 = getpid() r6 = syz_open_procfs(r5, &(0x7f0000000340)='timerslack_ns\x00') setresuid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) cachestat(r6, &(0x7f0000000000)={0x264, 0x1}, 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000100)=0x3) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="040302"], 0x4) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) ioctl$EVIOCGPROP(r7, 0x40047438, &(0x7f0000000180)=""/246) 44.561782079s ago: executing program 32 (id=393): syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)={0x20000002}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0xc800001a}) bind$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x1}, 0x6e) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r4) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) r5 = getpid() r6 = syz_open_procfs(r5, &(0x7f0000000340)='timerslack_ns\x00') setresuid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) cachestat(r6, &(0x7f0000000000)={0x264, 0x1}, 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000100)=0x3) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="040302"], 0x4) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) ioctl$EVIOCGPROP(r7, 0x40047438, &(0x7f0000000180)=""/246) 36.822662464s ago: executing program 1 (id=517): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffa) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, r0, 0x0) getsockopt(r0, 0x8, 0x4, &(0x7f0000000280)=""/77, &(0x7f0000000300)=0x4d) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5f7, @name="ac2ad54970138065d4b1a10a14b7e65642722c3da99ba40f000026e78ffc1e0a"}) mount(0x0, &(0x7f0000001000)='./sys\x00', &(0x7f0000002000)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000007000)='./sys/bus/acpi/devices/QEMU0002:00/status\x00', 0x0, 0x48) read(r5, &(0x7f0000008000)=""/10, 0xa) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/consoles\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000008140)={0x2020}, 0x2020) pread64(r6, &(0x7f00000000c0)=""/208, 0xd0, 0x8d35) r7 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc/sys/kernel/printk_devkmsg\x00', 0x2, 0x0) write(r7, &(0x7f0000000400)='off\n', 0x4) read$FUSE(r7, &(0x7f0000002280)={0x2020}, 0x2020) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x7) ioctl$TIOCSPGRP(r6, 0x5410, &(0x7f0000000180)=r8) add_key$keyring(&(0x7f0000000140), &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, r1) socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) 35.796147019s ago: executing program 1 (id=535): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='usb1', 0x4) 35.698722122s ago: executing program 1 (id=538): syz_open_dev$vim2m(&(0x7f0000000580), 0x80000, 0x2) prlimit64(0x0, 0x8, &(0x7f0000000240)={0x1000d1e2, 0x46fffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001000)=@abs={0x0, 0x0, 0xce27}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x0, 0x80) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) socket$netlink(0x10, 0x3, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x2, 0x3}}, 0x10) socket$tipc(0x1e, 0x5, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x89a1, &(0x7f0000000040)={'syzkaller0\x00'}) 34.624194792s ago: executing program 1 (id=564): syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000000)='./file1\x00', 0x2000494, &(0x7f0000000440)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c00484516000000000037c015c57600912233eefc80e89be5a1ef2c27ebf5171169dcfa4805d89c7e1f70d73d649ba4afab8b2194a9e8b537ad2ed68f8319883b84237da3bf9213365872b3f3"], 0x1, 0x2ca, &(0x7f0000000500)="$eJzs3E9rE2sUx/HTpk3TlDa5cLlwBfWgG92ENr4ADdKCGFBqU9SFMLUTDRmTMhMqEbHZiFtfR3HpTlBfgN2IG3HrrgiCmy7Ekc6fmrRpzZ+2SdvvB8o8mWd+PKfTaTlTmFm//fJRMe+k8kZFBmMqgyI12RBJbo4CA8F20BtHpV5NLo79+Hz61p271zPZ7PSs6kxm7lJaVSfOvn389NW595Wx+dcTb0ZkLXlv/Xv669p/a/+v/5p7WHCGxdFSuaKGLpTLFWPBMnWx4BRTqjct03BMLZQc026Yz1vlpaWqGqXF8fiSbTqOGqWqFs2qVspasatqPDAKJU2lUjoel5Mi0XTvUAvJ3OrsrJHZddqNdFEVemC02U7bztSaT+ZWD6EmAADQZ/bu//1ef/f+Pzvvbzvq/7WwW/8v0nX//yF6+OfyKKg1fPpL/x9qfoMR27eicKBsO2PEg9/fRvT/AAAAAAAAAAAAAAAAAAAAAAAcBRuum3BdNxFuw6+R4AGP8HOv68TBaPPnH74Q4HIPS8Y+qntwLyZivVjOLef8rT+fyUtBLDFlUhLy07seAv545lp2elI9SXlnrQT5leVcRDavoUxUCluLJcP8gPcYmp8/88+Un9fG/LDE69dPS0L+bb5+umk+KhfO1+VTkpCP96UsliyKfAkuaC//bEr16o3stvzo5nEAAAAAABwLKd2y4/7dm/cOiMnOeT/fxv8Htt1fD8mpVl5RCQAAAAAAuuZUnxQNyzLtDgYjItJF/LgOItIXZWwbXBGRTuLxfii+/UFMRPw92kn821a8pZTbwjFDItLz09LGoNd/mQAAAADstz9NfxuhT88PsCIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6eVt8HFh6/Yyqc2CNet1zk0L9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoI/8DgAA///REBf+") syz_mount_image$fuse(0x0, &(0x7f0000000580)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81000) renameat2(r0, &(0x7f00000002c0)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r0, &(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1) syz_clone3(&(0x7f0000000400)={0x1000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)=0x0, {0x3a}, &(0x7f00000000c0)=""/43, 0x2b, &(0x7f00000002c0)=""/245, &(0x7f00000003c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x6}, 0x58) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_procfs(r1, &(0x7f0000000480)='projid_map\x00') r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x85f613c7c6c96a1f, 0x4) r4 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000280)=@urb_type_iso={0x0, {0x1, 0x1}, 0xfffc, 0x1, 0x0, 0x52, 0xfffffffd, 0x0, 0x0, 0xfffc, 0x1, 0x0}) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0x12) fsconfig$FSCONFIG_SET_BINARY(r2, 0x2, &(0x7f0000000100)='sysfs\x00', &(0x7f00000004c0)="396306100e4054a5dbf56421fd0b85382a40118b2b8d377a00c1bca050b525de7889cf42e0d39edff4af3cf662838b57591afd3221c94ca0d70dd7fa6143dbd711df01edda10421bbdb936c60630", 0x4e) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000880)={r2, 0x20, &(0x7f0000000840)={&(0x7f0000000640)=""/208, 0xd0, 0x0, &(0x7f0000000740)=""/202, 0xca}}, 0x10) r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r6, &(0x7f0000008e00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008c40)=""/19, 0x13}, 0x8}], 0x1, 0x2, 0x0) r7 = openat(r2, &(0x7f00000008c0)='./sys\x00', 0x402181, 0x51) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x20, 0x3, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x1000}}, &(0x7f0000000540)='syzkaller\x00', 0xfb1, 0x1d, &(0x7f0000000580)=""/29, 0x41000, 0x25, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000600)={0x1, 0x8, 0x80000001, 0xfffffff8}, 0x10, r5, 0xffffffffffffffff, 0x3, &(0x7f0000000900)=[r2, r2, r7, r2, r2, r2], &(0x7f0000000940)=[{0x4, 0x4, 0x2, 0xc}, {0x2, 0x2, 0x10, 0x6}, {0x4, 0x5, 0x2, 0x2}], 0x10, 0x7}, 0x94) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/vtconsole/vtcon1/bind\x00', 0x1, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ip_vs\x00') preadv(r9, &(0x7f0000000680)=[{&(0x7f0000001180)=""/4113, 0x1011}], 0x1, 0x8c, 0xfffffff9) write(r8, &(0x7f0000000280)='1', 0x1) 34.469822945s ago: executing program 1 (id=567): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)) sendmsg$NFC_CMD_DEV_UP(r1, 0x0, 0x4008054) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES8=r1, @ANYRES16], 0x14) 33.826859614s ago: executing program 1 (id=577): syz_emit_ethernet(0x46, &(0x7f0000000140)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c6dd00", 0x10, 0x3a, 0xff, @remote={0xfe, 0xe0}, @mcast2, {[], @ndisc_ra={0x89, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xffffffff}}}}}}, 0x0) 33.784892902s ago: executing program 33 (id=577): syz_emit_ethernet(0x46, &(0x7f0000000140)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c6dd00", 0x10, 0x3a, 0xff, @remote={0xfe, 0xe0}, @mcast2, {[], @ndisc_ra={0x89, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xffffffff}}}}}}, 0x0) 24.548490972s ago: executing program 3 (id=732): bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = landlock_create_ruleset(&(0x7f0000000300)={0x7f2e, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0xe) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xa, 0x8, 0xfff, 0x7}, 0x50) r3 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000480)=@filter={'filter\x00', 0x42, 0x4, 0x410, 0xffffffff, 0x210, 0x2a8, 0x0, 0xffffffff, 0xffffffff, 0x378, 0x378, 0x378, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @multicast2, 0xff000000, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {0xff}, 0x84, 0x2, 0x2}, 0x0, 0x1e8, 0x210, 0x0, {0x100000000000000}, [@common=@inet=@sctp={{0x148}, {[0x4e21, 0x4e20], [0x4e22, 0x4e24], [0x40, 0x3, 0x6, 0x8, 0x34, 0x0, 0x0, 0x5, 0x8000, 0x81, 0xfffffffd, 0xfffffffe, 0x8000, 0x7ff, 0x44, 0x58639972, 0x9, 0x10, 0x8, 0x3ff, 0xfffffff2, 0x91, 0x9, 0x1, 0x1ca8, 0xb96d, 0x100, 0x9, 0x80000000, 0x8, 0xe, 0x6, 0x26c, 0xb9ae, 0x80, 0x400, 0x99d8, 0x1, 0x10000, 0x7, 0x6, 0x3, 0x9, 0x5, 0xad3, 0x6, 0xff, 0x8, 0x8, 0x1, 0x0, 0x7, 0xb, 0xd, 0x6, 0xc, 0x5, 0x40000000, 0x10, 0x3, 0x3, 0x78, 0x9, 0x9], 0x0, [{0x0, 0x0, 0xd5}, {0x0, 0x51, 0x6}, {0x3, 0x3, 0xa}, {0x8, 0x80, 0x8}], 0x0, 0x1d}}, @common=@unspec=@connmark={{0x30}}]}, @REJECT={0x28}}, {{@ip={@loopback, @broadcast, 0xffffff00, 0xff000000, 'geneve0\x00', 'macvlan0\x00', {0xff}, {}, 0x2, 0x0, 0x4}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@private=0xa010103, @loopback, 0xff000000, 0xffffff00, 'bond0\x00', 'dvmrp0\x00', {}, {}, 0x62, 0x1, 0x1}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0xd, 0x8, [0x8, 0x27, 0x2a, 0xa, 0x13, 0xe, 0x2d, 0x21, 0x6, 0x31, 0x3f, 0x20, 0x28, 0x18, 0x22, 0x1e], 0x0, 0x0, 0x6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000f00)={{r2}, &(0x7f0000000e80), &(0x7f0000000ec0)}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r4, 0x2000300, 0xe, 0x0, &(0x7f0000001080)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) ioctl$USBDEVFS_RESET(0xffffffffffffffff, 0x5514) setsockopt$inet_opts(r0, 0x0, 0xc, &(0x7f0000000400)="001ca73e", 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getsockopt$inet_opts(r0, 0x0, 0x400000000000009, &(0x7f0000000040)=""/16, &(0x7f0000000080)=0x10) 24.391697722s ago: executing program 3 (id=739): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfs\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='127.0.0.1:/\x00', &(0x7f0000000200)='./nfs\x00', &(0x7f0000000300)='nfs4\x00', 0x0, &(0x7f0000000400)='addr=127.0.0.1,port=2050\x00') 24.302004909s ago: executing program 3 (id=744): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = socket(0x3d, 0x2, 0x10) getsockopt$inet6_tcp_int(r0, 0x6, 0x2, 0x0, &(0x7f00000002c0)) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='md0', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='rai', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='4', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0) write(r4, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r5, &(0x7f0000000480)='1:0', 0x3) write(r5, 0x0, 0x0) write(r5, &(0x7f0000000540)='1:', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/dev-ram0/slot\x00', 0x201, 0x0) write(r6, &(0x7f00000005c0), 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000), 0x13f, 0x4}}, 0x20) r7 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) close(r3) write(r7, &(0x7f00000007c0)='active', 0x6) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) 24.166333434s ago: executing program 3 (id=750): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) mmap$xdp(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x300000b, 0x11, r1, 0x180000000) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff8000/0x4000)=nil, 0x4000}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) syz_mount_image$ext4(&(0x7f0000000280)='ext3\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc0ed000e, &(0x7f0000000300)={[{@min_batch_time={'min_batch_time', 0x3d, 0xff}}, {@jqfmt_vfsv0}, {@min_batch_time={'min_batch_time', 0x3d, 0x3ff}}, {@noload}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x61}}, {@noblock_validity}, {@resgid}, {@inlinecrypt}, {@errors_continue}]}, 0xfa, 0x49f, &(0x7f0000000940)="$eJzs3M9vFFUcAPDvbLulgNiC+AMEqaKR+KOl5YccvGg04aCJiR4wnmpbSKVQQ2sihEjxgEdD4p149S8wnvRi1IsmXvVuSIjhwg8va2ZnhpZ2d7uFLVu6n0+y2/dmXmfed2bezJt50wbQsQbSryTikYj4KyL6suzdBQayHzevnx+7df38WBKVyvv/JtVyN66fHyuKFr+3OctUKnl+Q431XvooYnRqauJMnh+aPfXp0MzZc69Onho9MXFi4vTIkSMHD+zuOTxyqCVxpnHd2PnF9K4dRz+8/O7Yscsf/5qUIos7FsXRKgPZ1q3phVavrM22LEgn3el3b57b8/v8nFpHAu3UFRHp7ipX239fdMXGO/P64u0v21o5YFVVKpVKg7PyXAVYx5Jodw2A9igu9On9b/F5QF2PNeHaG9kNUBr3zfyTzemOUpbYU150f9tKAxFxbO72lfQTq/QcAgBgoR/T/s8rtfp/pXgiS/SkX4/mYyj9EbH1YsS2iHgsIrZHxOMR1bJPRsRTK1z/4hGSpf2f0tV7Dq4Jaf/v9Xxs6+7+X6ko0t+V57ZU4y8nxyenJvbn22RflDccn0wmhhus46e3/vy63rxq/6/ojM/dvpKuv+gL5vW42r3oAd346Ozo/cS80LWLETu7a8WfVMcFIh/X2xERO1ey4N755ORL3XWLLez/HqsZfwP1F9u0yrcRL2b7fy4WxV9I6o5PDr92eOTQUG9MTewfKo6KpX7749J79dY/EHHhnuNvgXT/b6p5/N+Jvz/pjZg5e+5kdbx2pvll38rvLy/9/VXde5rl9/9dx//RLfnx35N8UJ3Qk8/4fHR29sxwRE/yztLpI/NLK/JF+TT+fXtrt/9tMb8lno6IXRGxOyKeSW8K87o/GxHPRcTeBtvhlzef/2Tl8dd+Kl9usJ57kcY/vtz+j4X7f+WJrpM//7B8/OkJo97+P1hN7cunNHP+a7aC97PtAAAA4GGRvQOflAbn08ngYPYO//bYVJqanpl9+fj0Z6fHs3fl+6NcKp509S14HjqcPxsu8iOL8gciYmtEfNO1sZofHJueGm938NDhNi9p/6VS2v5T/3S1u3bAqmvBOBrwkNL+oXNp/9CZkmXbf6tfOQLWEtd/6Fy12v+FuqUHv1/VygAPlOs/dK4m2v9c9qN+rwB4OLn+Q+fS/qEj1f3b+NJ9/cl/SxO7v8vq2qjMf/m/UFkrdV7/iSitiWqs/0R30//Mol6ivLQtV/qyNpVO2VDzt9p6WgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGiZ/wMAAP//whjqbQ==") mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2390024, 0x0) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000080)={0x8}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/fib_triestat\x00') preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000040)=""/208, 0xd0}], 0x1, 0x2a, 0xd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, &(0x7f00000002c0)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f0000001540)={0x801, 0x2, &(0x7f0000000580)=[0x0, 0x0], &(0x7f00000005c0)=[0x6, 0xfffff0a7, 0x0], &(0x7f00000014c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001500)=[0xb8, 0xd64, 0x4, 0x6, 0x0, 0xffffffffffffff81, 0x9], 0x0, 0x1}) write$cgroup_subtree(r6, &(0x7f00000000c0)=ANY=[], 0x6a) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000001c0)=0xf) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz0\x00', 0x200002, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000200)={{0x80000000, 0x0, 0x3, [0x6, 0x1]}, {0x80000000, 0x0, 0x3, [0xfffffff7, 0x100009]}, 0x10000000, [0x5, 0x80000000]}) ioctl$MEDIA_IOC_SETUP_LINK(r4, 0xc0347c03, &(0x7f0000000e40)={{0x80000000, 0x0, 0x5, [0x1, 0x400]}, {0x80000000, 0x0, 0x7, [0x6, 0x2]}, 0x4, [0x101, 0x200]}) r8 = openat$cgroup_procs(r7, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb011018"], &(0x7f00000000c0)=""/16, 0x46, 0x10, 0x1}, 0x28) write$cgroup_subtree(r8, &(0x7f00000001c0)=ANY=[@ANYBLOB='-4'], 0xc) ioctl$TCFLSH(r2, 0x800455c9, 0xffffffffffffffff) 23.969865964s ago: executing program 3 (id=759): openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r0 = syz_io_uring_setup(0x3a5a, &(0x7f0000000400)={0x0, 0x5b52, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x4110}, 0x1}) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x4, 0x5, &(0x7f00000007c0)=ANY=[@ANYBLOB="180200000200000000000000000000008500000028000000850000005600000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x7, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, &(0x7f0000003140)={0x0, {0x2, 0x4e21, @multicast1}, {0x2, 0x4625, @private=0xa010102}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x36, 0x0, 0x0, 0x0, 0xce, 0x0, 0x1, 0x1, 0x9}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x20}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r6, 0x400454c9, 0x1f) ioctl$TUNSETLINK(r5, 0x400454cc, 0xfdfffffffffffffe) 23.80671847s ago: executing program 2 (id=766): getpeername(0xffffffffffffffff, 0x0, &(0x7f000000c240)) 23.753717107s ago: executing program 2 (id=767): socket$inet6_mptcp(0xa, 0x1, 0x106) 23.730804638s ago: executing program 2 (id=769): setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='nv', 0x2) 23.475875748s ago: executing program 3 (id=770): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c000780080012400000000505000500020000000500040001000000110003"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) 23.474873752s ago: executing program 2 (id=772): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) mmap$xdp(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x300000b, 0x11, r1, 0x180000000) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff8000/0x4000)=nil, 0x4000}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) syz_mount_image$ext4(&(0x7f0000000280)='ext3\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc0ed000e, &(0x7f0000000300)={[{@min_batch_time={'min_batch_time', 0x3d, 0xff}}, {@jqfmt_vfsv0}, {@min_batch_time={'min_batch_time', 0x3d, 0x3ff}}, {@noload}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x61}}, {@noblock_validity}, {@resgid}, {@inlinecrypt}, {@errors_continue}]}, 0xfa, 0x49f, &(0x7f0000000940)="$eJzs3M9vFFUcAPDvbLulgNiC+AMEqaKR+KOl5YccvGg04aCJiR4wnmpbSKVQQ2sihEjxgEdD4p149S8wnvRi1IsmXvVuSIjhwg8va2ZnhpZ2d7uFLVu6n0+y2/dmXmfed2bezJt50wbQsQbSryTikYj4KyL6suzdBQayHzevnx+7df38WBKVyvv/JtVyN66fHyuKFr+3OctUKnl+Q431XvooYnRqauJMnh+aPfXp0MzZc69Onho9MXFi4vTIkSMHD+zuOTxyqCVxpnHd2PnF9K4dRz+8/O7Yscsf/5qUIos7FsXRKgPZ1q3phVavrM22LEgn3el3b57b8/v8nFpHAu3UFRHp7ipX239fdMXGO/P64u0v21o5YFVVKpVKg7PyXAVYx5Jodw2A9igu9On9b/F5QF2PNeHaG9kNUBr3zfyTzemOUpbYU150f9tKAxFxbO72lfQTq/QcAgBgoR/T/s8rtfp/pXgiS/SkX4/mYyj9EbH1YsS2iHgsIrZHxOMR1bJPRsRTK1z/4hGSpf2f0tV7Dq4Jaf/v9Xxs6+7+X6ko0t+V57ZU4y8nxyenJvbn22RflDccn0wmhhus46e3/vy63rxq/6/ojM/dvpKuv+gL5vW42r3oAd346Ozo/cS80LWLETu7a8WfVMcFIh/X2xERO1ey4N755ORL3XWLLez/HqsZfwP1F9u0yrcRL2b7fy4WxV9I6o5PDr92eOTQUG9MTewfKo6KpX7749J79dY/EHHhnuNvgXT/b6p5/N+Jvz/pjZg5e+5kdbx2pvll38rvLy/9/VXde5rl9/9dx//RLfnx35N8UJ3Qk8/4fHR29sxwRE/yztLpI/NLK/JF+TT+fXtrt/9tMb8lno6IXRGxOyKeSW8K87o/GxHPRcTeBtvhlzef/2Tl8dd+Kl9usJ57kcY/vtz+j4X7f+WJrpM//7B8/OkJo97+P1hN7cunNHP+a7aC97PtAAAA4GGRvQOflAbn08ngYPYO//bYVJqanpl9+fj0Z6fHs3fl+6NcKp509S14HjqcPxsu8iOL8gciYmtEfNO1sZofHJueGm938NDhNi9p/6VS2v5T/3S1u3bAqmvBOBrwkNL+oXNp/9CZkmXbf6tfOQLWEtd/6Fy12v+FuqUHv1/VygAPlOs/dK4m2v9c9qN+rwB4OLn+Q+fS/qEj1f3b+NJ9/cl/SxO7v8vq2qjMf/m/UFkrdV7/iSitiWqs/0R30//Mol6ivLQtV/qyNpVO2VDzt9p6WgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGiZ/wMAAP//whjqbQ==") mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2390024, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000080)={0x8}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/fib_triestat\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000040)=""/208, 0xd0}], 0x1, 0x2a, 0xd) 23.403838531s ago: executing program 34 (id=770): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c000780080012400000000505000500020000000500040001000000110003"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) 23.321954597s ago: executing program 2 (id=776): setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000e80)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x22}}, @in={0x2, 0x4e24, @loopback}], 0x20) 22.957636848s ago: executing program 2 (id=784): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x74) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000016c0)={0x29, 0x0, [{0x2, 0x28, &(0x7f0000000080)=""/40}, {0xd100828e98ba2273, 0xef, &(0x7f00000015c0)=""/239}]}) 22.772822392s ago: executing program 35 (id=784): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x74) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000016c0)={0x29, 0x0, [{0x2, 0x28, &(0x7f0000000080)=""/40}, {0xd100828e98ba2273, 0xef, &(0x7f00000015c0)=""/239}]}) 1.127947698s ago: executing program 8 (id=1431): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, 0x0, 0x0, r0) 1.126891048s ago: executing program 8 (id=1432): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_START_POLL(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x24, r1, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_TM_PROTOCOLS={0x8, 0xe, 0x7a}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x40) 1.0639917s ago: executing program 8 (id=1437): syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) 977.848177ms ago: executing program 8 (id=1442): getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000140)=""/151, &(0x7f0000000200)=0x97) 931.347655ms ago: executing program 8 (id=1444): r0 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xe825, 0x3400, 0x401, 0x3c3}, 0x0, 0x0, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r1, 0x3b8d, &(0x7f0000000280)={0x20, 0x0, 0x0}) syz_clone(0x2b00b100, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000000040)=ANY=[@ANYRES64=r0], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd2d4508c23f25bc9, '\x00', 0x0, @sched_cls=0x2f}, 0x94) r3 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) write(r3, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000180)=ANY=[@ANYRES32=r2, @ANYRES32=r2, @ANYBLOB="2f00b6943b2600000000611fd626b90c00"/31, @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000002340)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4509c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a900d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a3c0db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848022e8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0000000000000000000000000001545f0ec539c3b58facd2f62dc3307a6c91d6b"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000003e00)=ANY=[@ANYRES32=r4, @ANYRES32=r2, @ANYBLOB="2f00000004009b00000000005b2beca554"], 0x20) pselect6(0x40, &(0x7f0000000100)={0x2, 0x0, 0xfffffffffffffff8, 0x0, 0x1, 0x10}, 0x0, &(0x7f0000000240)={0x1f, 0xc, 0x715, 0x8000000000000000, 0x0, 0x80000000000000, 0x800, 0x20000}, 0x0, 0x0) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0) accept(r5, 0x0, 0x0) 488.662329ms ago: executing program 5 (id=1472): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, 0x0, 0x0) 451.646629ms ago: executing program 7 (id=1473): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newtfilter={0xc4, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x4}, {}, {0x6, 0x8}}, [@filter_kind_options=@f_u32={{0x8}, {0x98, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x0, 0x6, 0x8, 0x101, 0x4, 0xe, 0x7, 0x7, [{0x8e5, 0x8b39, 0x3a, 0x40}, {0x8, 0x3, 0x9, 0x2d}, {0xffffff8a, 0x0, 0x2, 0x10000}, {0x9, 0xc, 0x8, 0x8}, {0x0, 0x1, 0x3b7, 0x5}, {0x553e3387, 0x5, 0x8000, 0x2}, {0x8001, 0x4, 0x1}, {0x1000, 0xa8c, 0xfffffff8, 0xd}]}}]}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r3, {0xc, 0x10}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r7, 0x89f6, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0x31, "2a161d2d71db37f20a8f1597f02515fcead4e1f5cad54790db5c4e0999e060075afd258fef16d5f349155f669fd5d425de"}}) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xf, 0xf}, {}, {0xffff, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) 420.46682ms ago: executing program 5 (id=1476): r0 = fanotify_init(0x1a, 0x800) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) fanotify_mark(r0, 0x441, 0x4800001a, r1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=@newqdisc={0xa8, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2a, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x78, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcd}]}]}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0x30}]}}]}, 0xa8}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x440, 0x0) 392.588722ms ago: executing program 6 (id=1478): r0 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NFC_CMD_START_POLL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, r0, 0x1, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40) 390.803275ms ago: executing program 7 (id=1479): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r0, &(0x7f000000a540), 0x0, 0x41) 361.424515ms ago: executing program 6 (id=1480): r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = landlock_create_ruleset(&(0x7f0000000300)={0x7f2e, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0xe) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000002d01000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000f00)={{}, &(0x7f0000000e80), &(0x7f0000000ec0)=r2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r3, 0x2000300, 0xe, 0x0, &(0x7f0000001080)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) ioctl$USBDEVFS_RESET(0xffffffffffffffff, 0x5514) setsockopt$inet_opts(r0, 0x0, 0xc, &(0x7f0000000400)="001ca73e", 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getsockopt$inet_opts(r0, 0x0, 0x400000000000009, &(0x7f0000000040)=""/16, &(0x7f0000000080)=0x10) 337.150836ms ago: executing program 7 (id=1482): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d0020073f0000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a"], 0x44}}, 0x2000040) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) ptrace(0x11, r2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008804}, 0x20040040) 335.790928ms ago: executing program 5 (id=1483): syz_mount_image$squashfs(&(0x7f0000000180), &(0x7f0000000280)='./file1\x00', 0xc01c, &(0x7f0000000040)=ANY=[], 0x6, 0x21c, &(0x7f0000000500)="$eJzsVb9rFEEU/mZvNpvTEwN2th4mjSa3AbG2Mb1WVh6XNQb3/JE90TsCnjZpFMR/IiD+CYIWivYWIqJNLBS0iFglyMmbeTM3x+26OTit5oPlffN+znu7M3s1u5VFAH7vbrYwBwWBGj4KAQlgXmjd3oyWP1kOGF+lXjdY/5TlF5ZZt/fuoaa9a800TTay7t9JBAGMmzgfcqLGVedePDqmNc+OFoYpckkXk47p7YNRH4HyTaepkOU+0yadim5u3PR4RBPl+XAs3ISv6U1eKOu0cJhTIPtHJnCuosj0qwa4mm9T3GpI0wzzhyDERN96DqEEigDWtF9DYaeGfHiiK+f6VDi8itGxlBI6df/vey4mdBcpEkwUnoHfR3b+foAfAgjxfnezRdrLfIuReVU/5kioKFq8cnyOS6APiAoGKinlkew7D2Cx0765mHV7p9bbzbVkLbkex8tnlt4c5iM6uAesp8mSUNvQ4QERCQs6p1XHTl/a56G9DwdCbc3ciggdtU1pLueFE45LFQictowc5n1p60esu521cREnMQvgTp/MMQ+oDsomcYVaW4FAhRcN6W4IewgwqwynWzfS1S0ICBO2DWlzNHYQ2kW8g0/POU2yfNa2v8WyznKF5fawnoJ5neafJFWG77xa6AMzuNvsdDbUz0sz0tmhal08ZysHXNX8DU2xeoQD4tBBHT08PDw8PDw8/hH+BAAA///OuTMg") r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x115) getdents64(r0, 0x0, 0x0) 315.292649ms ago: executing program 7 (id=1485): r0 = syz_open_dev$vim2m(0x0, 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff}) mmap(&(0x7f00008a9000/0x13000)=nil, 0x13000, 0x1000001, 0x11, r1, 0x2000) 264.64835ms ago: executing program 5 (id=1486): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$BTRFS_IOC_SCRUB_CANCEL(r1, 0x941c, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00') write$vhost_msg(r2, &(0x7f0000000840)={0x796e6564, {0x0, 0x0, 0x0}}, 0x7) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000200)=0x3) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x5, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000600a8000600200002400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000080)={0x0, 0x0}) r4 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000080)={0x8, 0x9, 0x2, 0xd8}, 0xffffffffffffff39) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) 242.238033ms ago: executing program 0 (id=1487): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, 0x0, 0x0) 240.141252ms ago: executing program 6 (id=1488): bpf$PROG_LOAD(0x5, &(0x7f0000001000)={0x6, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000b7020000000004007b2af8ff000000007b2af0ff000000007b2ae8ff000000007b2ae0ff000000007b2ad8ff000000007b2ad0ff000000007b2ac8ff000000007b2ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac4ff00000000180200000a0000010000000000000000632accff00000000180200000a0000020000000000000000632ac0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000200000095"], &(0x7f00000011c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$fuse(0x0, &(0x7f0000000340)='./file0\x00', 0x2888004, 0x0, 0x1, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80, 0x0) fcntl$notify(r0, 0x402, 0x1a) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) chdir(&(0x7f0000000000)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000b00)='./file1\x00', 0x42142, 0x190) 205.317566ms ago: executing program 7 (id=1489): socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) openat$smackfs_relabel_self(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x74) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x20, 0x14, 0x503, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, r4}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x0) bind$packet(r0, &(0x7f00000001c0)={0x11, 0x15, r4, 0x1, 0x2}, 0x14) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r6, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) 204.385705ms ago: executing program 0 (id=1490): r0 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NFC_CMD_START_POLL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, r0, 0x1, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40) 174.461025ms ago: executing program 6 (id=1491): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x118) mount$fuse(0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=0x0]) mount(0x0, 0x0, &(0x7f0000000280)='autofs\x00', 0x201000c, &(0x7f0000000040)) 150.863493ms ago: executing program 0 (id=1492): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r0, &(0x7f000000a540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x41) 150.510176ms ago: executing program 7 (id=1493): syz_mount_image$vfat(&(0x7f0000000380), &(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000002, &(0x7f0000000480)=ANY=[@ANYBLOB="726f6469722c6e6f6e756d7461696c3d302c726f6469722c756e695f786c6174653d312c73686f72746e616d653d6c6f7765722c696f636861727365743d63703733372c696f636847567365743d69736f383835392d31342c636f6465706167653d3836322c73686f72746e616d653d6c6f7765720200686f72746e616d653d77696e39352c696f636861727365743d69736f383835392d392c726f6469722c757466383d302c666d61736b3d30303030303030303030303030303030303030333737372c666c7573682c73686f72746e616d653df6696e6e742c00"], 0x81, 0x2d1, &(0x7f0000000880)="$eJzs3c1qJFUUAOBTneqkWwfSC1ciWKALV2FmniBBIgxmpdRCNzo4PSDdzUAaGvzBntnoXnDlO7jzAXwAN76BD6C4cxZiSXV19U+lk0zG/OjwfZs6XfeeuufeviShoW8+fm00ePBo/PDJl79Gp5NEaz/242kSvWhF7XGs+fpWAAD/Z0+LIv4oKuf13V57lbausi4A4Oo88+//rWsrCQC4Yu9/8OG7B0dHh+9lWSdi9M0kT6K6Vu0HD+PTGEY/bsdu/BVRLFTxrXtHh5FmWf1hwKQbecToo5/nrw9+i5jl34nd6DXz608Uspl4czSd5OXI5bUdLyURB0VSdbkbu/FKRNGO+UOqyzv3jg7vZo38sph8O9564/t5/X/3Yy9245dP4lEM48HsEcv8r+5k2dvFd39+Uc0gj0imk3xn1m+p8BcQAAAAAAAAAAAAAAAAAAAAAACXZi9b6K2ev1OfBri312xP84jfR3X+8nyg/ZidDzQ/4We6cr7O7SzL6mN8Jnk7qvN90ng1jfSm5g0AAAAAAAAAAAAAAAAAAAD/JePPPh/cHw77x2vBT0UZdM/s0wzSlTv11/rPz9ocDH6IuHhWGWyf0ye25qUNkxNDJHVTM6soiuKUB/54ylg7Fym+u2nQaJ22hukwquK/vfj6vL5xgv8qiEiiDHrLUuvdNbhfNc1W/vF8dYf9nZX0zuZNsrLr6m14PE7O2JDdxp1iZenqYOu5t80zb7+Xnze9G5uayhm3F4u5ntWpFnNxp32J72n5fjUkl/uDBwAAAAAAAAAAAAAAAAAAOGH5pd/YPtH45EZKAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBrt/z//4sges07zWA6T57daZ3deed4vGHY3jVPEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgBfcPwEAAP//1rdOEQ==") (async) syz_mount_image$vfat(&(0x7f0000000380), &(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000002, &(0x7f0000000480)=ANY=[@ANYBLOB="726f6469722c6e6f6e756d7461696c3d302c726f6469722c756e695f786c6174653d312c73686f72746e616d653d6c6f7765722c696f636861727365743d63703733372c696f636847567365743d69736f383835392d31342c636f6465706167653d3836322c73686f72746e616d653d6c6f7765720200686f72746e616d653d77696e39352c696f636861727365743d69736f383835392d392c726f6469722c757466383d302c666d61736b3d30303030303030303030303030303030303030333737372c666c7573682c73686f72746e616d653df6696e6e742c00"], 0x81, 0x2d1, &(0x7f0000000880)="$eJzs3c1qJFUUAOBTneqkWwfSC1ciWKALV2FmniBBIgxmpdRCNzo4PSDdzUAaGvzBntnoXnDlO7jzAXwAN76BD6C4cxZiSXV19U+lk0zG/OjwfZs6XfeeuufeviShoW8+fm00ePBo/PDJl79Gp5NEaz/242kSvWhF7XGs+fpWAAD/Z0+LIv4oKuf13V57lbausi4A4Oo88+//rWsrCQC4Yu9/8OG7B0dHh+9lWSdi9M0kT6K6Vu0HD+PTGEY/bsdu/BVRLFTxrXtHh5FmWf1hwKQbecToo5/nrw9+i5jl34nd6DXz608Uspl4czSd5OXI5bUdLyURB0VSdbkbu/FKRNGO+UOqyzv3jg7vZo38sph8O9564/t5/X/3Yy9245dP4lEM48HsEcv8r+5k2dvFd39+Uc0gj0imk3xn1m+p8BcQAAAAAAAAAAAAAAAAAAAAAACXZi9b6K2ev1OfBri312xP84jfR3X+8nyg/ZidDzQ/4We6cr7O7SzL6mN8Jnk7qvN90ng1jfSm5g0AAAAAAAAAAAAAAAAAAAD/JePPPh/cHw77x2vBT0UZdM/s0wzSlTv11/rPz9ocDH6IuHhWGWyf0ye25qUNkxNDJHVTM6soiuKUB/54ylg7Fym+u2nQaJ22hukwquK/vfj6vL5xgv8qiEiiDHrLUuvdNbhfNc1W/vF8dYf9nZX0zuZNsrLr6m14PE7O2JDdxp1iZenqYOu5t80zb7+Xnze9G5uayhm3F4u5ntWpFnNxp32J72n5fjUkl/uDBwAAAAAAAAAAAAAAAAAAOGH5pd/YPtH45EZKAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBrt/z//4sges07zWA6T57daZ3deed4vGHY3jVPEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgBfcPwEAAP//1rdOEQ==") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x58342, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x88) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x9, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000631124000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb}) write$binfmt_register(0xffffffffffffffff, 0x0, 0x0) (async) write$binfmt_register(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000880)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000600)={0x30, 0x30, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000007c0)={0x4c, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000007c0)={0x4c, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) getdents64(r0, &(0x7f0000002f80)=""/145, 0x91) 149.669836ms ago: executing program 5 (id=1494): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) 136.557344ms ago: executing program 0 (id=1495): r0 = fanotify_init(0x1a, 0x800) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) fanotify_mark(r0, 0x441, 0x4800001a, r1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=@newqdisc={0xa8, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2a, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x78, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcd}]}]}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0x30}]}}]}, 0xa8}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x440, 0x0) 116.567597ms ago: executing program 6 (id=1496): syz_mount_image$squashfs(&(0x7f0000000180), &(0x7f0000000280)='./file1\x00', 0xc01c, &(0x7f0000000040)=ANY=[], 0x6, 0x21c, &(0x7f0000000500)="$eJzsVb9rFEEU/mZvNpvTEwN2th4mjSa3AbG2Mb1WVh6XNQb3/JE90TsCnjZpFMR/IiD+CYIWivYWIqJNLBS0iFglyMmbeTM3x+26OTit5oPlffN+znu7M3s1u5VFAH7vbrYwBwWBGj4KAQlgXmjd3oyWP1kOGF+lXjdY/5TlF5ZZt/fuoaa9a800TTay7t9JBAGMmzgfcqLGVedePDqmNc+OFoYpckkXk47p7YNRH4HyTaepkOU+0yadim5u3PR4RBPl+XAs3ISv6U1eKOu0cJhTIPtHJnCuosj0qwa4mm9T3GpI0wzzhyDERN96DqEEigDWtF9DYaeGfHiiK+f6VDi8itGxlBI6df/vey4mdBcpEkwUnoHfR3b+foAfAgjxfnezRdrLfIuReVU/5kioKFq8cnyOS6APiAoGKinlkew7D2Cx0765mHV7p9bbzbVkLbkex8tnlt4c5iM6uAesp8mSUNvQ4QERCQs6p1XHTl/a56G9DwdCbc3ciggdtU1pLueFE45LFQictowc5n1p60esu521cREnMQvgTp/MMQ+oDsomcYVaW4FAhRcN6W4IewgwqwynWzfS1S0ICBO2DWlzNHYQ2kW8g0/POU2yfNa2v8WyznKF5fawnoJ5neafJFWG77xa6AMzuNvsdDbUz0sz0tmhal08ZysHXNX8DU2xeoQD4tBBHT08PDw8PDw8/hH+BAAA///OuTMg") r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x115) getdents64(r0, 0x0, 0x0) 94.525909ms ago: executing program 0 (id=1497): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, 0x0, 0x0) (fail_nth: 1) 73.209034ms ago: executing program 5 (id=1498): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_ublk_setup_io_uring(0x2a45, &(0x7f0000000340)={0x0, 0xbeea, 0x1, 0x1, 0x214}, &(0x7f0000000700), &(0x7f0000000740)=0x0, &(0x7f0000000780)) syz_io_uring_setup(0x602f, &(0x7f00000007c0)={0x0, 0xb6c2, 0x4000, 0x2, 0x16b, 0x0, r1}, &(0x7f0000000840), &(0x7f0000000880), &(0x7f00000008c0)) r3 = getpid() process_vm_readv(r3, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000006180)=""/152, 0x98}, {&(0x7f0000001980)=""/4089, 0x1000}], 0x3, &(0x7f0000008640)=[{&(0x7f00000003c0)=""/95, 0xffffff1a}], 0x1, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000), 0x3a}, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000240), 0x0, 0x0) ioctl$EVIOCSFF(r4, 0x40304580, 0x0) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r6 = syz_open_dev$vim2m(&(0x7f0000000080), 0x0, 0x2) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="0a00000005000000020000000400000000000000", @ANYRES32, @ANYBLOB="0100000000000000000000000000c5a62c4e6e758e2e77e98f2b52e600000000bc40ceafa297379735c259dcdf5ae9c62fd7cbc4d9cdc651fdfeb25d886262d647bb318973d6742f6aae2f", @ANYRES32=0x0, @ANYRES64=r2, @ANYBLOB="000000000000000000000000000000fdff000000010600000000000000a1fe42ea89f7e86f4567e3c419c8fbb91b20863ad649ce791cb092a4568c91928c236991b8aec9c140ec085a2727c5da2907d35c6c61fa18a1f10ad9536fa5f2ffb65c87d6c840367f9c051214a8739bccf2d487b3a5c6c8c1fd21a2306885a7b2d75f2cbdd68bb7484aa234aa18d7f980b9206e1a7c00a5091ddd51190dc6d59b7af9205060"], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002240)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r7}, &(0x7f0000000000), &(0x7f0000000080)='%-5lx \x00'}, 0x20) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000080)={0x24, 0x5e, 0xe25, 0x0, 0x3, "", [@typed={0x8, 0xa3, 0x0, 0x0, @u32=0x9}, @nested={0xc, 0xea, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x3}]}]}, 0x24}], 0x1}, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r9, 0x1, 0x32, &(0x7f00000000c0)=r12, 0x4) sendmsg$unix(r10, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f00000000c0)={0x990a22, 0xfffffffd}) r13 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r13, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x60) r14 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r14, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x7, 0x0, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x10000000000001}, 0x60) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0x0) sendmsg$nfc_llcp(r13, &(0x7f00000006c0)={&(0x7f0000000100)={0x27, r15, 0xffffffffffffffff, 0x1, 0x8, 0xa, "56627cfafa2ff109acf7891b9983b0c49e6a4016141ce5b9557daf08f5865481b653a1e2274437b4d195d66cc5834b07d6d959e82bab1c07bf1006354f2852", 0x10}, 0x60, &(0x7f0000000580)=[{&(0x7f0000000200)="00b9e46a203a74e47895af08b5cd8414f3e3a6eaed2411d4bafecc53977baf8c548f777273ffa4ad13f45cb00ecbc58271fb1a85b08a776ecae345033db2e601d44f0ca60fd3d992c42af810ab8f88a98a126eafdc4ad4ed12662252bb6f272e676dfc62b662a180c09be7c69666b202a57d44a9e564a162987242c2073dee9682fd71b84a52fb0af7d6a1f115aa271254a369b4ff0534f8e4e4042ed7588b23e16deb7ed11fc244afbc58c339d84cfd9a28a3684d9246f216536318f400804f966796609b0d9ed38a", 0xc9}, {&(0x7f0000000440)="98604de01bbd46f354e544ff6ff682f7c211885a055e1185cc161161383ee2b6321038b8f2b5ba44078498b242f8f900e481f2b1ba0ecb5eb1d37826802a6ccec70e35659bb34e1371f278a4f3fb50ec6d89cf0d2be69a5dabe36cf9bf31e556e609262800637fc11d9359c545d953f165684ae4dbf6e633f611da3b35c32d040501f9a2f4e0304eaf5b236d8837360bf1b507e9b39cc71b0210d88f0fec04eb8dbd7a185269223b654141", 0xab}, {&(0x7f0000000500)="c79914b84c1f6c3b2ef4c1ebb9f2716542f276ab158b98376c0f4c05ef6c86a169db50a2dc9e2d35c956b1931580a993a0f510d13b1ad5b90ec18522995ef933bb09ae6bc45a603fdaee6f1184de885523409953537758c135992b9bf5776f0c3d9ef4b2cdc90b85733312f6b42a13c7ff5d83b6c0eb", 0x76}], 0x3, &(0x7f00000005c0)={0xd8, 0x11, 0x9, "751c37ddae3cbb60823810ab85268b5b39c7014cb2710736f4217b595dd87305be803437ffd7105cb9ba071835a6c2067e15206ceede62370ddce7761d0ab79ffc95c6e6cbc8f36db2ad70846ff82478501a2a1e38cea4bbaf32172f3b22d0cbf95bd84b518823409c03383febd876cafbcd5a86b54013e5938edb3f9c663d4acfa7c9dc953a0aef55b10427d664d93bbe1a86c0de7e385a84d6b76880a55dadeadaa4de7ce32697b3977fb2156bd94b67b19be4a6a0858027e7cbe55b6438ffa388d21cc42326a2"}, 0xd8, 0x20000040}, 0x0) r16 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r16, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x7, 0x0, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x1000000000003f}, 0x60) connect$bt_rfcomm(r5, 0x0, 0x0) 43.322478ms ago: executing program 8 (id=1499): r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = landlock_create_ruleset(&(0x7f0000000300)={0x7f2e, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0xe) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000002d01000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000f00)={{}, &(0x7f0000000e80), &(0x7f0000000ec0)=r2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r3, 0x2000300, 0xe, 0x0, &(0x7f0000001080)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) ioctl$USBDEVFS_RESET(0xffffffffffffffff, 0x5514) setsockopt$inet_opts(r0, 0x0, 0xc, &(0x7f0000000400)="001ca73e", 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getsockopt$inet_opts(r0, 0x0, 0x400000000000009, &(0x7f0000000040)=""/16, &(0x7f0000000080)=0x10) 1.149747ms ago: executing program 0 (id=1500): r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff}) mmap(&(0x7f00008a9000/0x13000)=nil, 0x13000, 0x1000001, 0x11, r1, 0x2000) 0s ago: executing program 6 (id=1501): bpf$PROG_LOAD(0x5, &(0x7f0000001000)={0x6, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000b7020000000004007b2af8ff000000007b2af0ff000000007b2ae8ff000000007b2ae0ff000000007b2ad8ff000000007b2ad0ff000000007b2ac8ff000000007b2ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac4ff00000000180200000a0000010000000000000000632accff00000000180200000a0000020000000000000000632ac0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000200000095"], &(0x7f00000011c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$fuse(0x0, &(0x7f0000000340)='./file0\x00', 0x2888004, 0x0, 0x1, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80, 0x0) fcntl$notify(r0, 0x402, 0x1a) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) chdir(&(0x7f0000000000)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000b00)='./file1\x00', 0x42142, 0x190) kernel console output (not intermixed with test programs): 23.687122][ T5249] net_ratelimit: 119 callbacks suppressed [ 123.717058][ T6773] netlink: 5 bytes leftover after parsing attributes in process `syz.5.574'. [ 123.717192][ T6773] 0{X: renamed from gretap0 (while UP) [ 123.737405][ T4711] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 123.743213][ T6773] 0{X: entered allmulticast mode [ 123.747396][ T6773] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 123.782236][ T6776] syzkaller0: entered promiscuous mode [ 123.782251][ T6776] syzkaller0: entered allmulticast mode [ 123.885372][ T50] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 123.886591][ T50] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 123.887132][ T50] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 123.888594][ T50] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 123.889061][ T50] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 124.127058][ T6824] nbd: must specify a size in bytes for the device [ 124.417243][ T6830] EXT4-fs: Ignoring removed orlov option [ 124.417259][ T6830] EXT4-fs: Ignoring removed nobh option [ 124.447467][ T6830] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 124.447837][ T6830] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #13: comm syz.3.592: invalid indirect mapped block 2683928664 (level 1) [ 124.447856][ T6830] loop3: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 124.448134][ T6830] EXT4-fs (loop3): 1 truncate cleaned up [ 124.448547][ T6830] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 124.458207][ T6830] FAULT_INJECTION: forcing a failure. [ 124.458207][ T6830] name failslab, interval 1, probability 0, space 0, times 0 [ 124.460521][ T6830] CPU: 0 UID: 0 PID: 6830 Comm: syz.3.592 Not tainted syzkaller #0 PREEMPT [ 124.460541][ T6830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 124.460555][ T6830] Call trace: [ 124.460560][ T6830] show_stack+0x2c/0x3c (C) [ 124.460584][ T6830] __dump_stack+0x30/0x40 [ 124.460596][ T6830] dump_stack_lvl+0xd8/0x12c [ 124.460611][ T6830] dump_stack+0x1c/0x28 [ 124.460621][ T6830] should_fail_ex+0x41c/0x590 [ 124.460630][ T6830] should_failslab+0xc4/0x120 [ 124.460639][ T6830] __kmalloc_noprof+0x108/0x6b8 [ 124.460648][ T6830] tomoyo_encode2+0x10c/0x330 [ 124.460657][ T6830] tomoyo_encode+0x34/0x50 [ 124.460666][ T6830] tomoyo_realpath_from_path+0x488/0x4dc [ 124.460674][ T6830] tomoyo_path_number_perm+0x1f0/0x500 [ 124.460682][ T6830] tomoyo_file_ioctl+0x2c/0x3c [ 124.460691][ T6830] security_file_ioctl+0xdc/0x2b0 [ 124.460699][ T6830] __arm64_sys_ioctl+0xb0/0x1cc [ 124.460711][ T6830] invoke_syscall+0x98/0x244 [ 124.460721][ T6830] el0_svc_common+0xec/0x23c [ 124.460731][ T6830] do_el0_svc+0x4c/0x5c [ 124.460741][ T6830] el0_svc+0x64/0x260 [ 124.460750][ T6830] el0t_64_sync_handler+0x44/0x104 [ 124.460758][ T6830] el0t_64_sync+0x198/0x19c [ 124.484665][ T6830] ERROR: Out of memory at tomoyo_realpath_from_path. [ 124.497056][ T5236] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 124.499481][ T6840] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 124.540366][ T4723] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 124.595125][ T6846] netlink: 52 bytes leftover after parsing attributes in process `syz.0.597'. [ 124.600533][ T6846] netlink: 448 bytes leftover after parsing attributes in process `syz.0.597'. [ 124.676009][ T6854] vfat: Unknown parameter 'iocharset' [ 124.750379][ T6862] nbd: must specify a size in bytes for the device [ 124.756089][ T6860] EXT4-fs: Ignoring removed orlov option [ 124.756109][ T6860] EXT4-fs: Ignoring removed nobh option [ 124.771296][ T6860] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 124.771491][ T6860] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #13: comm syz.0.603: invalid indirect mapped block 2683928664 (level 1) [ 124.771510][ T6860] loop0: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 124.771882][ T6860] EXT4-fs (loop0): 1 truncate cleaned up [ 124.773246][ T6860] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 125.073792][ T50] Bluetooth: hci0: command 0x0c1a tx timeout [ 125.074298][ T4715] Bluetooth: hci3: command 0x0c1a tx timeout [ 125.074334][ T4715] Bluetooth: hci4: command 0x0c1a tx timeout [ 125.074360][ T4715] Bluetooth: hci2: command 0x0c1a tx timeout [ 125.117892][ T6869] set_capacity_and_notify: 6 callbacks suppressed [ 125.120356][ T6869] loop3: detected capacity change from 0 to 512 [ 125.147873][ T4719] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 125.156349][ T6869] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 125.202678][ T4723] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 125.233335][ T6878] overlayfs: failed to resolve './bus': -2 [ 125.400111][ T6789] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.401720][ T6789] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.403318][ T6789] bridge_slave_0: entered allmulticast mode [ 125.409103][ T6789] bridge_slave_0: entered promiscuous mode [ 125.415688][ T6789] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.419807][ T6789] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.419970][ T6789] bridge_slave_1: entered allmulticast mode [ 125.420508][ T6789] bridge_slave_1: entered promiscuous mode [ 125.820592][ T6789] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 125.823047][ T6909] loop5: detected capacity change from 0 to 256 [ 125.827815][ T6789] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 125.848406][ T6912] netlink: 12 bytes leftover after parsing attributes in process `syz.5.620'. [ 125.849708][ T6909] netlink: 12 bytes leftover after parsing attributes in process `syz.5.620'. [ 125.881572][ T6789] team0: Port device team_slave_0 added [ 125.884226][ T6789] team0: Port device team_slave_1 added [ 125.920902][ T6916] FAULT_INJECTION: forcing a failure. [ 125.920902][ T6916] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 125.920927][ T6916] CPU: 0 UID: 0 PID: 6916 Comm: syz.2.622 Tainted: G L syzkaller #0 PREEMPT [ 125.920941][ T6916] Tainted: [L]=SOFTLOCKUP [ 125.920945][ T6916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 125.920958][ T6916] Call trace: [ 125.920962][ T6916] show_stack+0x2c/0x3c (C) [ 125.920977][ T6916] __dump_stack+0x30/0x40 [ 125.920988][ T6916] dump_stack_lvl+0xd8/0x12c [ 125.920998][ T6916] dump_stack+0x1c/0x28 [ 125.921007][ T6916] should_fail_ex+0x41c/0x590 [ 125.921016][ T6916] should_fail_alloc_page+0xec/0x10c [ 125.921024][ T6916] prepare_alloc_pages+0x194/0x4a4 [ 125.921033][ T6916] __alloc_frozen_pages_noprof+0x134/0x320 [ 125.921042][ T6916] alloc_pages_mpol+0x1ec/0x3c0 [ 125.921051][ T6916] alloc_frozen_pages_noprof+0xc4/0x10c [ 125.921060][ T6916] alloc_pages_noprof+0x30/0x148 [ 125.921069][ T6916] __pmd_alloc+0x54/0x75c [ 125.921076][ T6916] handle_mm_fault+0x1820/0x2514 [ 125.921084][ T6916] do_page_fault+0x4b0/0xb88 [ 125.921094][ T6916] do_translation_fault+0xc4/0x114 [ 125.921103][ T6916] do_mem_abort+0x70/0x194 [ 125.921112][ T6916] el1_abort+0x50/0x74 [ 125.921121][ T6916] el1h_64_sync_handler+0xdc/0x130 [ 125.921129][ T6916] el1h_64_sync+0x6c/0x70 [ 125.921137][ T6916] __arch_copy_from_user+0x114/0x23c (P) [ 125.921147][ T6916] move_addr_to_kernel+0x88/0x168 [ 125.921157][ T6916] __sys_bind+0x12c/0x268 [ 125.921165][ T6916] __arm64_sys_bind+0x84/0x9c [ 125.921174][ T6916] invoke_syscall+0x98/0x244 [ 125.921184][ T6916] el0_svc_common+0xec/0x23c [ 125.921194][ T6916] do_el0_svc+0x4c/0x5c [ 125.921204][ T6916] el0_svc+0x64/0x260 [ 125.921212][ T6916] el0t_64_sync_handler+0x44/0x104 [ 125.921220][ T6916] el0t_64_sync+0x198/0x19c [ 125.935744][ T6789] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 125.935751][ T6789] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 125.935764][ T6789] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 125.945502][ T1596] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.945528][ T1596] ieee802154 phy1 wpan1: encryption failed: -22 [ 125.947562][ T6789] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 125.947569][ T6789] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 125.947583][ T6789] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 125.951010][ T6918] overlayfs: failed to resolve './bus': -2 [ 125.951839][ T50] Bluetooth: hci1: command tx timeout [ 126.038306][ T6928] netlink: 52 bytes leftover after parsing attributes in process `syz.2.624'. [ 126.041641][ T6928] netlink: 448 bytes leftover after parsing attributes in process `syz.2.624'. [ 126.059006][ T6933] loop0: detected capacity change from 0 to 512 [ 126.065597][ T6933] loop0: detected capacity change from 0 to 256 [ 126.066032][ T6933] vfat: Unknown parameter 'iocharset' [ 126.140088][ T6789] hsr_slave_0: entered promiscuous mode [ 126.145493][ T6789] hsr_slave_1: entered promiscuous mode [ 126.150226][ T6789] debugfs: 'hsr0' already exists in 'hsr' [ 126.150242][ T6789] Cannot create hsr debugfs directory [ 126.150731][ T6928] batman_adv: batadv0: Adding interface: veth0 [ 126.150737][ T6928] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.151034][ T6928] batman_adv: batadv0: Interface activated: veth0 [ 126.154535][ T6935] batman_adv: batadv0: Interface deactivated: veth0 [ 126.154557][ T6935] batman_adv: batadv0: Removing interface: veth0 [ 126.582419][ T6949] FAULT_INJECTION: forcing a failure. [ 126.582419][ T6949] name failslab, interval 1, probability 0, space 0, times 0 [ 126.582457][ T6949] CPU: 0 UID: 0 PID: 6949 Comm: syz.2.630 Tainted: G L syzkaller #0 PREEMPT [ 126.582471][ T6949] Tainted: [L]=SOFTLOCKUP [ 126.582476][ T6949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 126.582489][ T6949] Call trace: [ 126.582492][ T6949] show_stack+0x2c/0x3c (C) [ 126.582509][ T6949] __dump_stack+0x30/0x40 [ 126.582520][ T6949] dump_stack_lvl+0xd8/0x12c [ 126.582530][ T6949] dump_stack+0x1c/0x28 [ 126.582540][ T6949] should_fail_ex+0x41c/0x590 [ 126.582548][ T6949] should_failslab+0xc4/0x120 [ 126.582556][ T6949] kmem_cache_alloc_node_noprof+0x98/0x5f8 [ 126.582565][ T6949] __alloc_skb+0x1f0/0x610 [ 126.582575][ T6949] rtmsg_ifa+0xe8/0x1d8 [ 126.582582][ T6949] __inet_del_ifa+0x5a4/0xca0 [ 126.582590][ T6949] devinet_ioctl+0x99c/0x1788 [ 126.582597][ T6949] inet_ioctl+0x304/0x42c [ 126.582610][ T6949] packet_ioctl+0x1c8/0x404 [ 126.582620][ T6949] sock_do_ioctl+0x100/0x254 [ 126.582633][ T6949] sock_ioctl+0x55c/0x7ec [ 126.582643][ T6949] __arm64_sys_ioctl+0x154/0x1cc [ 126.582654][ T6949] invoke_syscall+0x98/0x244 [ 126.582665][ T6949] el0_svc_common+0xec/0x23c [ 126.582675][ T6949] do_el0_svc+0x4c/0x5c [ 126.582684][ T6949] el0_svc+0x64/0x260 [ 126.582693][ T6949] el0t_64_sync_handler+0x44/0x104 [ 126.582701][ T6949] el0t_64_sync+0x198/0x19c [ 126.691952][ T6789] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 126.737268][ T6789] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 126.737577][ T6789] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 126.769872][ T6789] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 126.772859][ T6789] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 127.066897][ T6789] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 127.067256][ T6789] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 127.075939][ T6789] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 127.119377][ T6979] netlink: 52 bytes leftover after parsing attributes in process `syz.0.640'. [ 127.119669][ T6979] netlink: 448 bytes leftover after parsing attributes in process `syz.0.640'. [ 127.153764][ T50] Bluetooth: hci0: command 0x0c1a tx timeout [ 127.208537][ T6789] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.225774][ T6789] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.251686][ T5249] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.251719][ T5249] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.260267][ T5249] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.260298][ T5249] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.278465][ T6789] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 127.301454][ T6997] loop0: detected capacity change from 0 to 4096 [ 127.312100][ T6997] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 127.318639][ T6997] sctp: [Deprecated]: syz.0.646 (pid 6997) Use of int in maxseg socket option. [ 127.318639][ T6997] Use struct sctp_assoc_value instead [ 127.350994][ T4719] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 127.356623][ T7008] loop3: detected capacity change from 0 to 512 [ 127.361228][ T7008] loop3: detected capacity change from 0 to 256 [ 127.361638][ T7008] vfat: Unknown parameter 'iocharset' [ 127.474258][ T6789] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 127.925253][ T6789] veth0_vlan: entered promiscuous mode [ 127.932504][ T6789] veth1_vlan: entered promiscuous mode [ 127.959388][ T6789] veth0_macvtap: entered promiscuous mode [ 127.967160][ T6789] veth1_macvtap: entered promiscuous mode [ 127.982431][ T6789] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 127.988104][ T6789] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 128.024600][ T50] Bluetooth: hci1: command tx timeout [ 128.044374][ T5236] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.044415][ T5236] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.044438][ T5236] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.044454][ T5236] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.065988][ T7049] netlink: 52 bytes leftover after parsing attributes in process `syz.2.655'. [ 128.066279][ T7049] netlink: 448 bytes leftover after parsing attributes in process `syz.2.655'. [ 128.098959][ T5223] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.098982][ T5223] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.150364][ T5236] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.150388][ T5236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.272700][ T7059] loop5: detected capacity change from 0 to 512 [ 128.273552][ T7059] EXT4-fs: Ignoring removed nomblk_io_submit option [ 128.273636][ T7059] /dev/loop5: Can't open blockdev [ 128.286519][ T7059] netlink: 16 bytes leftover after parsing attributes in process `syz.5.657'. [ 128.286550][ T7059] netlink: 16 bytes leftover after parsing attributes in process `syz.5.657'. [ 128.654792][ T7068] loop6: detected capacity change from 0 to 4096 [ 128.655199][ T7068] EXT4-fs: Ignoring removed bh option [ 128.660119][ T7068] EXT4-fs (loop6): Test dummy encryption mode enabled [ 128.663839][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 128.668267][ T7081] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 128.670038][ T7081] team0: Device macvlan2 is up. Set it down before adding it as a team port [ 128.673435][ T7068] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 128.787540][ T6789] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 128.823724][ C1] net_ratelimit: 385 callbacks suppressed [ 128.833009][ T7097] loop2: detected capacity change from 0 to 512 [ 128.854351][ T7097] vfat: Unknown parameter 'iocharset' [ 128.883595][ T7103] batman_adv: batadv0: Adding interface: veth0 [ 128.885181][ T7103] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 128.890322][ T7103] batman_adv: batadv0: Interface activated: veth0 [ 128.893197][ T7103] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.894817][ T7103] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.921559][ T7103] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.921573][ T7103] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.940298][ T7103] batman_adv: batadv0: Interface deactivated: veth0 [ 128.940312][ T7103] batman_adv: batadv0: Removing interface: veth0 [ 128.945013][ T7110] FAULT_INJECTION: forcing a failure. [ 128.945013][ T7110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 128.945044][ T7110] CPU: 0 UID: 0 PID: 7110 Comm: syz.5.672 Tainted: G L syzkaller #0 PREEMPT [ 128.945061][ T7110] Tainted: [L]=SOFTLOCKUP [ 128.945065][ T7110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 128.945079][ T7110] Call trace: [ 128.945082][ T7110] show_stack+0x2c/0x3c (C) [ 128.945101][ T7110] __dump_stack+0x30/0x40 [ 128.945113][ T7110] dump_stack_lvl+0xd8/0x12c [ 128.945123][ T7110] dump_stack+0x1c/0x28 [ 128.945133][ T7110] should_fail_ex+0x41c/0x590 [ 128.945141][ T7110] should_fail+0x14/0x24 [ 128.945148][ T7110] should_fail_usercopy+0x20/0x30 [ 128.945156][ T7110] _inline_copy_from_user+0x3c/0x188 [ 128.945167][ T7110] memdup_user+0x78/0xec [ 128.945175][ T7110] strndup_user+0x78/0xe0 [ 128.945183][ T7110] __arm64_sys_mount+0xdc/0x388 [ 128.945194][ T7110] invoke_syscall+0x98/0x244 [ 128.945205][ T7110] el0_svc_common+0xec/0x23c [ 128.945215][ T7110] do_el0_svc+0x4c/0x5c [ 128.945224][ T7110] el0_svc+0x64/0x260 [ 128.945234][ T7110] el0t_64_sync_handler+0x44/0x104 [ 128.945242][ T7110] el0t_64_sync+0x198/0x19c [ 129.223806][ T50] Bluetooth: hci0: command 0x0c1a tx timeout [ 129.302482][ T7120] No control pipe specified [ 129.602397][ T50] Bluetooth: hci4: ACL packet for unknown connection handle 200 [ 129.734130][ T7145] FAULT_INJECTION: forcing a failure. [ 129.734130][ T7145] name failslab, interval 1, probability 0, space 0, times 0 [ 129.736730][ T7145] CPU: 1 UID: 0 PID: 7145 Comm: syz.2.682 Tainted: G L syzkaller #0 PREEMPT [ 129.736752][ T7145] Tainted: [L]=SOFTLOCKUP [ 129.736756][ T7145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 129.736771][ T7145] Call trace: [ 129.736776][ T7145] show_stack+0x2c/0x3c (C) [ 129.736800][ T7145] __dump_stack+0x30/0x40 [ 129.736813][ T7145] dump_stack_lvl+0xd8/0x12c [ 129.736823][ T7145] dump_stack+0x1c/0x28 [ 129.736833][ T7145] should_fail_ex+0x41c/0x590 [ 129.736841][ T7145] should_failslab+0xc4/0x120 [ 129.736850][ T7145] __kmalloc_noprof+0x108/0x6b8 [ 129.736859][ T7145] tomoyo_realpath_from_path+0xbc/0x4dc [ 129.736869][ T7145] tomoyo_path_number_perm+0x1f0/0x500 [ 129.736877][ T7145] tomoyo_file_ioctl+0x2c/0x3c [ 129.736885][ T7145] security_file_ioctl+0xdc/0x2b0 [ 129.736894][ T7145] __arm64_sys_ioctl+0xb0/0x1cc [ 129.736905][ T7145] invoke_syscall+0x98/0x244 [ 129.736915][ T7145] el0_svc_common+0xec/0x23c [ 129.736925][ T7145] do_el0_svc+0x4c/0x5c [ 129.736935][ T7145] el0_svc+0x64/0x260 [ 129.736944][ T7145] el0t_64_sync_handler+0x44/0x104 [ 129.736953][ T7145] el0t_64_sync+0x198/0x19c [ 129.782374][ T7145] ERROR: Out of memory at tomoyo_realpath_from_path. [ 130.144304][ T50] Bluetooth: hci1: command tx timeout [ 130.228918][ T7168] No control pipe specified [ 130.743397][ T7205] set_capacity_and_notify: 1 callbacks suppressed [ 130.748318][ T7205] loop3: detected capacity change from 0 to 512 [ 130.940648][ T7203] loop2: detected capacity change from 0 to 512 [ 130.945409][ T7203] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 130.965368][ T7203] EXT4-fs (loop2): can't mount with journal_async_commit, fs mounted w/o journal [ 131.322983][ T50] Bluetooth: hci0: command 0x0c1a tx timeout [ 131.335245][ T7217] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 131.338934][ T7217] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 131.339097][ T7217] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 131.339235][ T7217] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 131.339378][ T7217] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 131.339433][ T7217] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 131.354120][ T7217] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 132.049858][ T7257] __nla_validate_parse: 4 callbacks suppressed [ 132.049894][ T7257] netlink: 16 bytes leftover after parsing attributes in process `syz.6.704'. [ 132.081711][ T7259] loop3: detected capacity change from 0 to 1024 [ 132.151032][ T7259] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 132.168640][ T7259] netlink: 8 bytes leftover after parsing attributes in process `syz.3.706'. [ 132.210981][ T4723] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 132.270299][ T7285] loop6: detected capacity change from 0 to 512 [ 132.285127][ T7285] loop6: detected capacity change from 0 to 256 [ 132.285553][ T7285] vfat: Unknown parameter 'iocharset' [ 132.475206][ T7295] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 132.475402][ T7295] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 132.475548][ T7295] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 132.475698][ T7295] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 132.480407][ T7295] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 132.530801][ T7317] FAULT_INJECTION: forcing a failure. [ 132.530801][ T7317] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 132.533271][ T7317] CPU: 0 UID: 0 PID: 7317 Comm: syz.6.721 Tainted: G L syzkaller #0 PREEMPT [ 132.533290][ T7317] Tainted: [L]=SOFTLOCKUP [ 132.533293][ T7317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 132.533307][ T7317] Call trace: [ 132.533311][ T7317] show_stack+0x2c/0x3c (C) [ 132.533330][ T7317] __dump_stack+0x30/0x40 [ 132.533343][ T7317] dump_stack_lvl+0xd8/0x12c [ 132.533353][ T7317] dump_stack+0x1c/0x28 [ 132.533363][ T7317] should_fail_ex+0x41c/0x590 [ 132.533371][ T7317] should_fail+0x14/0x24 [ 132.533378][ T7317] should_fail_usercopy+0x20/0x30 [ 132.533385][ T7317] _inline_copy_from_user+0x3c/0x174 [ 132.533397][ T7317] move_addr_to_kernel+0x88/0x168 [ 132.533406][ T7317] __sys_bind+0x12c/0x268 [ 132.533415][ T7317] __arm64_sys_bind+0x84/0x9c [ 132.533424][ T7317] invoke_syscall+0x98/0x244 [ 132.533434][ T7317] el0_svc_common+0xec/0x23c [ 132.533444][ T7317] do_el0_svc+0x4c/0x5c [ 132.533454][ T7317] el0_svc+0x64/0x260 [ 132.533463][ T7317] el0t_64_sync_handler+0x44/0x104 [ 132.533472][ T7317] el0t_64_sync+0x198/0x19c [ 132.604543][ T7315] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 132.604774][ T7315] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 132.605417][ T7315] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 132.605632][ T7315] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 132.611834][ T7315] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 132.740204][ T7345] loop3: detected capacity change from 0 to 512 [ 132.772359][ T7345] loop3: detected capacity change from 0 to 256 [ 132.774403][ T7345] vfat: Unknown parameter 'iocharset' [ 133.126732][ T7368] FAULT_INJECTION: forcing a failure. [ 133.126732][ T7368] name failslab, interval 1, probability 0, space 0, times 0 [ 133.129874][ T7368] CPU: 1 UID: 0 PID: 7368 Comm: syz.2.733 Tainted: G L syzkaller #0 PREEMPT [ 133.129897][ T7368] Tainted: [L]=SOFTLOCKUP [ 133.129902][ T7368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 133.129917][ T7368] Call trace: [ 133.129921][ T7368] show_stack+0x2c/0x3c (C) [ 133.129944][ T7368] __dump_stack+0x30/0x40 [ 133.129957][ T7368] dump_stack_lvl+0xd8/0x12c [ 133.129968][ T7368] dump_stack+0x1c/0x28 [ 133.129979][ T7368] should_fail_ex+0x41c/0x590 [ 133.129988][ T7368] should_failslab+0xc4/0x120 [ 133.129997][ T7368] __kmalloc_noprof+0x108/0x6b8 [ 133.130007][ T7368] tomoyo_encode2+0x10c/0x330 [ 133.130017][ T7368] tomoyo_encode+0x34/0x50 [ 133.130025][ T7368] tomoyo_realpath_from_path+0x488/0x4dc [ 133.130034][ T7368] tomoyo_path_number_perm+0x1f0/0x500 [ 133.130042][ T7368] tomoyo_file_ioctl+0x2c/0x3c [ 133.130051][ T7368] security_file_ioctl+0xdc/0x2b0 [ 133.130060][ T7368] __arm64_sys_ioctl+0xb0/0x1cc [ 133.130071][ T7368] invoke_syscall+0x98/0x244 [ 133.130081][ T7368] el0_svc_common+0xec/0x23c [ 133.130091][ T7368] do_el0_svc+0x4c/0x5c [ 133.130101][ T7368] el0_svc+0x64/0x260 [ 133.130111][ T7368] el0t_64_sync_handler+0x44/0x104 [ 133.130119][ T7368] el0t_64_sync+0x198/0x19c [ 133.147406][ T7368] ERROR: Out of memory at tomoyo_realpath_from_path. [ 133.160478][ T7365] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 133.160672][ T7365] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 133.160779][ T7365] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 133.160878][ T7365] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 133.162445][ T7365] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 133.240518][ T7382] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 133.306246][ T7377] bridge1: entered promiscuous mode [ 133.307434][ T7377] bridge1: entered allmulticast mode [ 133.333332][ T7398] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 133.404242][ T7398] md: could not open device unknown-block(1,0). [ 133.435040][ T7398] md: personality for level rai is not loaded! [ 133.471447][ T7415] loop3: detected capacity change from 0 to 512 [ 133.473496][ T7415] EXT4-fs: inline encryption not supported [ 133.479958][ T7415] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 133.480719][ T4713] Bluetooth: hci2: unexpected event for opcode 0x0c26 [ 133.492996][ T7415] EXT4-fs error (device loop3): ext4_iget_extra_inode:5180: inode #15: comm syz.3.750: corrupted in-inode xattr: e_value size too large [ 133.497461][ T7415] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 133.501878][ T7415] EXT4-fs error (device loop3): ext4_orphan_get:1404: comm syz.3.750: couldn't read orphan inode 15 (err -117) [ 133.501912][ T7415] loop3: lost filesystem error report for type 5 error -117 [ 133.504475][ C0] EXT4-fs (loop3): error count since last fsck: 2 [ 133.504486][ C0] EXT4-fs (loop3): initial error at time 133: ext4_iget_extra_inode:5180: inode 15 [ 133.504502][ C0] EXT4-fs (loop3): last error at time 133: ext4_orphan_get:1404 [ 133.511247][ T7415] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 133.565732][ T7415] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 133.573373][ T7415] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 133.574240][ T7415] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 133.613340][ T7415] EXT4-fs error (device loop3): ext4_iget_extra_inode:5180: inode #15: comm syz.3.750: corrupted in-inode xattr: e_value size too large [ 133.671543][ T4723] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.700493][ T7436] FAULT_INJECTION: forcing a failure. [ 133.700493][ T7436] name failslab, interval 1, probability 0, space 0, times 0 [ 133.703317][ T7436] CPU: 0 UID: 0 PID: 7436 Comm: syz.6.757 Tainted: G L syzkaller #0 PREEMPT [ 133.703340][ T7436] Tainted: [L]=SOFTLOCKUP [ 133.703346][ T7436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 133.703364][ T7436] Call trace: [ 133.703369][ T7436] show_stack+0x2c/0x3c (C) [ 133.703387][ T7436] __dump_stack+0x30/0x40 [ 133.703398][ T7436] dump_stack_lvl+0xd8/0x12c [ 133.703409][ T7436] dump_stack+0x1c/0x28 [ 133.703419][ T7436] should_fail_ex+0x41c/0x590 [ 133.703427][ T7436] should_failslab+0xc4/0x120 [ 133.703436][ T7436] __kmalloc_noprof+0x108/0x6b8 [ 133.703445][ T7436] tomoyo_realpath_from_path+0xbc/0x4dc [ 133.703454][ T7436] tomoyo_path_number_perm+0x1f0/0x500 [ 133.703462][ T7436] tomoyo_file_ioctl+0x2c/0x3c [ 133.703471][ T7436] security_file_ioctl+0xdc/0x2b0 [ 133.703480][ T7436] __arm64_sys_ioctl+0xb0/0x1cc [ 133.703491][ T7436] invoke_syscall+0x98/0x244 [ 133.703501][ T7436] el0_svc_common+0xec/0x23c [ 133.703511][ T7436] do_el0_svc+0x4c/0x5c [ 133.703520][ T7436] el0_svc+0x64/0x260 [ 133.703530][ T7436] el0t_64_sync_handler+0x44/0x104 [ 133.703538][ T7436] el0t_64_sync+0x198/0x19c [ 133.727736][ T7436] ERROR: Out of memory at tomoyo_realpath_from_path. [ 133.729710][ T7436] syzkaller0: tun_chr_ioctl cmd 1074025676 [ 133.731003][ T7436] syzkaller0: owner set to 4294967294 [ 133.767267][ T4713] Bluetooth: hci3: unexpected event for opcode 0x0c26 [ 133.771622][ T4723] bridge0: port 4(syz_tun) entered disabled state [ 133.827709][ T4723] syz_tun (unregistering): left allmulticast mode [ 133.827728][ T4723] syz_tun (unregistering): left promiscuous mode [ 133.827761][ T4723] bridge0: port 4(syz_tun) entered disabled state [ 134.149019][ T5237] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 134.149058][ T5237] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.188117][ T4401] net_ratelimit: 26922 callbacks suppressed [ 134.195897][ T7469] loop2: detected capacity change from 0 to 512 [ 134.198878][ T7469] EXT4-fs: inline encryption not supported [ 134.201749][ T7469] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 134.206609][ T7469] EXT4-fs error (device loop2): ext4_iget_extra_inode:5180: inode #15: comm syz.2.772: corrupted in-inode xattr: e_value size too large [ 134.209776][ T7469] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 134.210467][ T7469] EXT4-fs error (device loop2): ext4_orphan_get:1404: comm syz.2.772: couldn't read orphan inode 15 (err -117) [ 134.214713][ C1] EXT4-fs (loop2): error count since last fsck: 1 [ 134.214726][ C1] EXT4-fs (loop2): initial error at time 134: ext4_iget_extra_inode:5180: inode 15 [ 134.214744][ C1] EXT4-fs (loop2): last error at time 134: ext4_iget_extra_inode:5180: inode 15 [ 134.220476][ T7469] loop2: lost filesystem error report for type 5 error -117 [ 134.228279][ T7469] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 134.241108][ T5237] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 134.241147][ T5237] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.255724][ T7469] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 134.259853][ T7469] EXT4-fs (loop2): warning: mounting fs with errors, running e2fsck is recommended [ 134.262493][ T7469] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 134.287969][ T4713] Bluetooth: hci1: unexpected event for opcode 0x0c26 [ 134.308222][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 134.311084][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 134.312822][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 134.328599][ T4718] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.331657][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 134.334745][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 134.335543][ T5237] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 134.335563][ T5237] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.345978][ T7479] netlink: 52 bytes leftover after parsing attributes in process `syz.5.777'. [ 134.346205][ T7479] netlink: 448 bytes leftover after parsing attributes in process `syz.5.777'. [ 134.353172][ T7479] batman_adv: batadv0: Adding interface: veth0 [ 134.354981][ T7479] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 134.359823][ T7479] batman_adv: batadv0: Interface activated: veth0 [ 134.363687][ T7479] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 134.365276][ T7479] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 134.369412][ T7479] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 134.369432][ T7479] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 134.376413][ T7479] batman_adv: batadv0: Interface deactivated: veth0 [ 134.376445][ T7479] batman_adv: batadv0: Removing interface: veth0 [ 134.431703][ T7489] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 134.433554][ T7489] team0: Device macvlan2 is up. Set it down before adding it as a team port [ 134.468185][ T5237] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 134.468224][ T5237] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.650779][ T7501] loop5: detected capacity change from 0 to 128 [ 134.651267][ T7501] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 134.651538][ T7501] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 134.815014][ T5237] macvlan2: left allmulticast mode [ 134.815031][ T5237] ip6gretap0: left allmulticast mode [ 134.816424][ T5237] macvlan2: left promiscuous mode [ 134.816535][ T5237] bridge0: port 3(macvlan2) entered disabled state [ 134.821888][ T5237] bridge_slave_1: left allmulticast mode [ 134.821910][ T5237] bridge_slave_1: left promiscuous mode [ 134.821973][ T5237] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.835360][ T5237] bridge_slave_0: left allmulticast mode [ 134.835378][ T5237] bridge_slave_0: left promiscuous mode [ 134.835448][ T5237] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.887105][ T4713] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 134.888030][ T4713] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 134.888801][ T4713] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 134.893954][ T4713] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 134.895134][ T4713] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 135.030078][ T7535] netlink: 52 bytes leftover after parsing attributes in process `syz.5.791'. [ 135.081415][ T7542] netlink: 448 bytes leftover after parsing attributes in process `syz.5.791'. [ 135.180548][ T5237] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 135.190155][ T5237] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 135.223747][ T4713] Bluetooth: hci0: command 0x0c1a tx timeout [ 135.225356][ T5237] bond0 (unregistering): Released all slaves [ 135.444632][ T7574] FAULT_INJECTION: forcing a failure. [ 135.444632][ T7574] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 135.444656][ T7574] CPU: 1 UID: 0 PID: 7574 Comm: syz.0.795 Tainted: G L syzkaller #0 PREEMPT [ 135.444670][ T7574] Tainted: [L]=SOFTLOCKUP [ 135.444673][ T7574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 135.444685][ T7574] Call trace: [ 135.444688][ T7574] show_stack+0x2c/0x3c (C) [ 135.444707][ T7574] __dump_stack+0x30/0x40 [ 135.444718][ T7574] dump_stack_lvl+0xd8/0x12c [ 135.444728][ T7574] dump_stack+0x1c/0x28 [ 135.444737][ T7574] should_fail_ex+0x41c/0x590 [ 135.444746][ T7574] should_fail+0x14/0x24 [ 135.444752][ T7574] should_fail_usercopy+0x20/0x30 [ 135.444760][ T7574] simple_read_from_buffer+0xc4/0x238 [ 135.444771][ T7574] proc_fail_nth_read+0x1a8/0x248 [ 135.444779][ T7574] vfs_read+0x230/0x8c8 [ 135.444787][ T7574] ksys_read+0x12c/0x228 [ 135.444794][ T7574] __arm64_sys_read+0x84/0x98 [ 135.444801][ T7574] invoke_syscall+0x98/0x244 [ 135.444811][ T7574] el0_svc_common+0xec/0x23c [ 135.444821][ T7574] do_el0_svc+0x4c/0x5c [ 135.444831][ T7574] el0_svc+0x64/0x260 [ 135.444840][ T7574] el0t_64_sync_handler+0x44/0x104 [ 135.444849][ T7574] el0t_64_sync+0x198/0x19c [ 135.831183][ T4401] 8021q: adding VLAN 0 to HW filter on device eth4 [ 135.879146][ T7595] netlink: 5 bytes leftover after parsing attributes in process `syz.6.798'. [ 135.969718][ T7595] 0{X: renamed from gretap0 (while UP) [ 136.206556][ T7595] 0{X: entered allmulticast mode [ 136.271398][ T7603] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 136.288335][ T5237] hsr_slave_0: left promiscuous mode [ 136.290948][ T5237] hsr_slave_1: left promiscuous mode [ 136.293054][ T5237] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 136.293072][ T5237] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 136.294534][ T5237] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 136.294543][ T5237] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 136.299715][ T5237] veth1_macvtap: left promiscuous mode [ 136.300518][ T5237] veth0_macvtap: left promiscuous mode [ 136.300568][ T5237] veth1_vlan: left promiscuous mode [ 136.300642][ T5237] veth0_vlan: left promiscuous mode [ 136.423763][ T4713] Bluetooth: hci4: command tx timeout [ 136.495487][ T5237] team0 (unregistering): Port device team_slave_1 removed [ 136.508729][ T5237] team0 (unregistering): Port device team_slave_0 removed [ 136.685095][ T7476] bridge0: port 1(bridge_slave_0) entered blocking state [ 136.686858][ T7476] bridge0: port 1(bridge_slave_0) entered disabled state [ 136.688466][ T7476] bridge_slave_0: entered allmulticast mode [ 136.690355][ T7476] bridge_slave_0: entered promiscuous mode [ 136.715072][ T7601] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 136.715241][ T7601] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 136.715384][ T7601] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 136.715524][ T7601] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 136.715576][ T7601] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 136.729600][ T7601] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 136.749894][ T7601] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 136.749949][ T7601] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 136.754210][ T7601] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 136.777266][ T7476] bridge0: port 2(bridge_slave_1) entered blocking state [ 136.778696][ T7476] bridge0: port 2(bridge_slave_1) entered disabled state [ 136.778829][ T7476] bridge_slave_1: entered allmulticast mode [ 136.779455][ T7476] bridge_slave_1: entered promiscuous mode [ 136.837471][ T7476] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 136.845977][ T7476] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 136.993989][ T4401] 8021q: adding VLAN 0 to HW filter on device eth5 [ 136.996639][ T7476] team0: Port device team_slave_0 added [ 137.003310][ T7476] team0: Port device team_slave_1 added [ 137.089904][ T7476] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 137.089922][ T7476] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 137.089940][ T7476] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 137.090591][ T7476] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 137.090597][ T7476] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 137.090616][ T7476] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 137.137053][ T7646] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 137.180830][ T5237] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.243256][ T7476] hsr_slave_0: entered promiscuous mode [ 137.247900][ T7476] hsr_slave_1: entered promiscuous mode [ 137.251455][ T7476] debugfs: 'hsr0' already exists in 'hsr' [ 137.252898][ T7476] Cannot create hsr debugfs directory [ 137.257199][ T7646] md: could not open device unknown-block(1,0). [ 137.280984][ T7646] md: personality for level rai is not loaded! [ 137.308333][ T5237] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.399989][ T7672] loop6: detected capacity change from 0 to 8192 [ 137.417171][ T4401] 8021q: adding VLAN 0 to HW filter on device eth6 [ 137.446773][ T7672] loop6: p1 p2 p4[EZD] [ 137.449207][ T7672] loop6: p4 start 201326592 is beyond EOD, truncated [ 137.463821][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 137.501750][ T5237] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.540043][ T7666] geneve2: entered promiscuous mode [ 137.674035][ T7516] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.674079][ T7516] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.674219][ T7516] bridge_slave_0: entered allmulticast mode [ 137.674809][ T7516] bridge_slave_0: entered promiscuous mode [ 137.675713][ T7516] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.675736][ T7516] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.675813][ T7516] bridge_slave_1: entered allmulticast mode [ 137.676271][ T7516] bridge_slave_1: entered promiscuous mode [ 137.735639][ T5237] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.789048][ T7516] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 137.791018][ T7682] netlink: 8 bytes leftover after parsing attributes in process `syz.5.816'. [ 137.792245][ T7682] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.797046][ T7677] lo speed is unknown, defaulting to 1000 [ 137.803746][ T7516] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 137.842944][ T7677] lo speed is unknown, defaulting to 1000 [ 137.908628][ T7699] loop0: detected capacity change from 0 to 512 [ 137.917990][ T7699] EXT4-fs (loop0): failed to initialize system zone (-117) [ 137.918052][ T7699] EXT4-fs (loop0): mount failed [ 137.939569][ T7677] lo speed is unknown, defaulting to 1000 [ 137.941144][ T7677] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 137.942864][ T7677] infiniband s!0: RDMA CMA: cma_listen_on_dev, error -98 [ 138.004060][ T7516] team0: Port device team_slave_0 added [ 138.020416][ T4401] 8021q: adding VLAN 0 to HW filter on device eth7 [ 138.021362][ T7677] lo speed is unknown, defaulting to 1000 [ 138.021879][ T7677] lo speed is unknown, defaulting to 1000 [ 138.022268][ T7677] lo speed is unknown, defaulting to 1000 [ 138.022645][ T7677] lo speed is unknown, defaulting to 1000 [ 138.023040][ T7677] lo speed is unknown, defaulting to 1000 [ 138.023406][ T7677] lo speed is unknown, defaulting to 1000 [ 138.049568][ T7516] team0: Port device team_slave_1 added [ 138.089767][ T7677] lo speed is unknown, defaulting to 1000 [ 138.102833][ T7710] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 138.143243][ T7516] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 138.144822][ T7516] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 138.149434][ T7516] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 138.179311][ T7516] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 138.180650][ T7516] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 138.186568][ T7516] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 138.235412][ T7710] md: could not open device unknown-block(1,0). [ 138.258256][ T7710] md: personality for level rai is not loaded! [ 138.325807][ T50] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 138.516935][ T5237] bond0 (unregistering): Released all slaves [ 138.527975][ T7516] hsr_slave_0: entered promiscuous mode [ 138.528524][ T7516] hsr_slave_1: entered promiscuous mode [ 138.528809][ T7516] debugfs: 'hsr0' already exists in 'hsr' [ 138.528817][ T7516] Cannot create hsr debugfs directory [ 138.591523][ T7743] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 138.616261][ T7740] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 138.616384][ T7740] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 138.616487][ T7740] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 138.616587][ T7740] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 138.616697][ T7740] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 138.681865][ T4715] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 138.695198][ T7476] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 138.719963][ T7476] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 138.722241][ T7476] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 138.725232][ T7743] md: could not open device unknown-block(1,0). [ 138.747614][ T7476] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 138.762869][ T7743] md: personality for level rai is not loaded! [ 138.866965][ T7476] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 138.895965][ T7476] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 138.968185][ T7476] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 138.981233][ T7476] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 139.000321][ T7780] loop5: detected capacity change from 0 to 8 [ 139.005786][ T7780] squashfs: SQUASHFS error: Xattrs in filesystem, these will be ignored [ 139.005798][ T7780] unable to read xattr id index table [ 139.008976][ T7780] SQUASHFS error: zlib decompression failed, data probably corrupt [ 139.008996][ T7780] SQUASHFS error: Failed to read block 0x9b: -5 [ 139.009018][ T7780] SQUASHFS error: Unable to read metadata cache entry [99] [ 139.009028][ T7780] SQUASHFS error: Unable to read inode 0x127 [ 139.029561][ T4401] 8021q: adding VLAN 0 to HW filter on device eth8 [ 139.044510][ T7780] loop5: detected capacity change from 0 to 4096 [ 139.061119][ T7780] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (6056!=0) [ 139.062845][ T7780] EXT4-fs (loop5): group descriptors corrupted! [ 139.080752][ T5237] hsr_slave_0: left promiscuous mode [ 139.093708][ T5237] hsr_slave_1: left promiscuous mode [ 139.105076][ T5237] veth1_macvtap: left promiscuous mode [ 139.106221][ T5237] veth0_macvtap: left promiscuous mode [ 139.107302][ T5237] veth1_vlan: left promiscuous mode [ 139.108360][ T5237] veth0_vlan: left promiscuous mode [ 139.137618][ T4715] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 139.303706][ C0] net_ratelimit: 149 callbacks suppressed [ 139.320843][ T7806] FAULT_INJECTION: forcing a failure. [ 139.320843][ T7806] name failslab, interval 1, probability 0, space 0, times 0 [ 139.320873][ T7806] CPU: 1 UID: 0 PID: 7806 Comm: syz.5.853 Tainted: G L syzkaller #0 PREEMPT [ 139.320885][ T7806] Tainted: [L]=SOFTLOCKUP [ 139.320889][ T7806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 139.320901][ T7806] Call trace: [ 139.320904][ T7806] show_stack+0x2c/0x3c (C) [ 139.320922][ T7806] __dump_stack+0x30/0x40 [ 139.320933][ T7806] dump_stack_lvl+0xd8/0x12c [ 139.320943][ T7806] dump_stack+0x1c/0x28 [ 139.320953][ T7806] should_fail_ex+0x41c/0x590 [ 139.320961][ T7806] should_failslab+0xc4/0x120 [ 139.320970][ T7806] kmem_cache_alloc_noprof+0x94/0x5d8 [ 139.320979][ T7806] __pmd_alloc+0xc4/0x75c [ 139.320987][ T7806] handle_mm_fault+0x1820/0x2514 [ 139.320994][ T7806] do_page_fault+0x4b0/0xb88 [ 139.321004][ T7806] do_translation_fault+0xc4/0x114 [ 139.321014][ T7806] do_mem_abort+0x70/0x194 [ 139.321023][ T7806] el1_abort+0x50/0x74 [ 139.321033][ T7806] el1h_64_sync_handler+0xdc/0x130 [ 139.321041][ T7806] el1h_64_sync+0x6c/0x70 [ 139.321049][ T7806] __arch_copy_from_user+0x98/0x23c (P) [ 139.321059][ T7806] copy_msghdr_from_user+0xb8/0x194 [ 139.321071][ T7806] ___sys_sendmsg+0x14c/0x224 [ 139.321080][ T7806] __sys_sendmsg+0x158/0x204 [ 139.321089][ T7806] __arm64_sys_sendmsg+0x88/0x9c [ 139.321099][ T7806] invoke_syscall+0x98/0x244 [ 139.321109][ T7806] el0_svc_common+0xec/0x23c [ 139.321124][ T7806] do_el0_svc+0x4c/0x5c [ 139.321134][ T7806] el0_svc+0x64/0x260 [ 139.321143][ T7806] el0t_64_sync_handler+0x44/0x104 [ 139.321151][ T7806] el0t_64_sync+0x198/0x19c [ 139.401066][ T7814] siw: device registration error -23 [ 139.550906][ T7807] netlink: 8 bytes leftover after parsing attributes in process `syz.0.850'. [ 139.553877][ T7807] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.704572][ T4715] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 139.844796][ T7516] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 139.864725][ T7516] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 139.866426][ T7516] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 139.881246][ T7516] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 139.889746][ T7476] 8021q: adding VLAN 0 to HW filter on device bond0 [ 139.893416][ T7476] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.896174][ T7831] syz_tun: left allmulticast mode [ 139.896198][ T7831] syz_tun: left promiscuous mode [ 139.896265][ T7831] bridge0: port 3(syz_tun) entered disabled state [ 139.925457][ T7831] bridge_slave_0: left allmulticast mode [ 139.926544][ T7831] bridge_slave_0: left promiscuous mode [ 139.927643][ T7831] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.938500][ T7831] bridge_slave_1: left allmulticast mode [ 139.938525][ T7831] bridge_slave_1: left promiscuous mode [ 139.938585][ T7831] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.946662][ T7831] bond0: (slave bond_slave_0): Releasing backup interface [ 139.987149][ T7831] bond0: (slave bond_slave_1): Releasing backup interface [ 140.008552][ T7831] team0: Port device team_slave_0 removed [ 140.011221][ T7831] team0: Port device team_slave_1 removed [ 140.013221][ T4401] 8021q: adding VLAN 0 to HW filter on device eth9 [ 140.016551][ T7516] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 140.024217][ T7516] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 140.024578][ T7516] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 140.028889][ T7516] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 140.051975][ T5218] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.052010][ T5218] bridge0: port 1(bridge_slave_0) entered forwarding state [ 140.052696][ T5218] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.052715][ T5218] bridge0: port 2(bridge_slave_1) entered forwarding state [ 140.101830][ T7870] loop0: detected capacity change from 0 to 512 [ 140.111284][ T7870] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 140.111316][ T7870] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 140.119688][ T7857] netlink: 8 bytes leftover after parsing attributes in process `syz.6.867'. [ 140.120828][ T7857] bridge0: port 2(bridge_slave_1) entered disabled state [ 140.128451][ T7857] siw: device registration error -23 [ 140.135614][ T7870] EXT4-fs (loop0): 1 truncate cleaned up [ 140.136046][ T7870] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 140.187979][ T4719] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 140.201812][ T7882] FAULT_INJECTION: forcing a failure. [ 140.201812][ T7882] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 140.204393][ T7882] CPU: 0 UID: 0 PID: 7882 Comm: syz.5.871 Tainted: G L syzkaller #0 PREEMPT [ 140.204409][ T7882] Tainted: [L]=SOFTLOCKUP [ 140.204413][ T7882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 140.204427][ T7882] Call trace: [ 140.204430][ T7882] show_stack+0x2c/0x3c (C) [ 140.204453][ T7882] __dump_stack+0x30/0x40 [ 140.204465][ T7882] dump_stack_lvl+0xd8/0x12c [ 140.204475][ T7882] dump_stack+0x1c/0x28 [ 140.204485][ T7882] should_fail_ex+0x41c/0x590 [ 140.204494][ T7882] should_fail+0x14/0x24 [ 140.204500][ T7882] should_fail_usercopy+0x20/0x30 [ 140.204507][ T7882] copy_safe_from_sockptr+0x88/0x1fc [ 140.204518][ T7882] l2cap_sock_setsockopt+0x220/0x1a10 [ 140.204527][ T7882] do_sock_setsockopt+0x1f0/0x330 [ 140.204538][ T7882] __sys_setsockopt+0x104/0x170 [ 140.204547][ T7882] __arm64_sys_setsockopt+0xc8/0xe4 [ 140.204557][ T7882] invoke_syscall+0x98/0x244 [ 140.204567][ T7882] el0_svc_common+0xec/0x23c [ 140.204577][ T7882] do_el0_svc+0x4c/0x5c [ 140.204586][ T7882] el0_svc+0x64/0x260 [ 140.204596][ T7882] el0t_64_sync_handler+0x44/0x104 [ 140.204608][ T7882] el0t_64_sync+0x198/0x19c [ 140.215345][ T4715] Bluetooth: hci1: unexpected event for opcode 0x0026 [ 140.244216][ T7516] 8021q: adding VLAN 0 to HW filter on device bond0 [ 140.259569][ T7516] 8021q: adding VLAN 0 to HW filter on device team0 [ 140.266352][ T5236] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.266380][ T5236] bridge0: port 1(bridge_slave_0) entered forwarding state [ 140.283138][ T5236] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.283174][ T5236] bridge0: port 2(bridge_slave_1) entered forwarding state [ 140.413598][ T4715] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 140.498748][ T7476] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 140.510908][ T7930] FAULT_INJECTION: forcing a failure. [ 140.510908][ T7930] name failslab, interval 1, probability 0, space 0, times 0 [ 140.513330][ T7930] CPU: 1 UID: 0 PID: 7930 Comm: syz.5.877 Tainted: G L syzkaller #0 PREEMPT [ 140.513355][ T7930] Tainted: [L]=SOFTLOCKUP [ 140.513360][ T7930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 140.513379][ T7930] Call trace: [ 140.513383][ T7930] show_stack+0x2c/0x3c (C) [ 140.513403][ T7930] __dump_stack+0x30/0x40 [ 140.513415][ T7930] dump_stack_lvl+0xd8/0x12c [ 140.513425][ T7930] dump_stack+0x1c/0x28 [ 140.513435][ T7930] should_fail_ex+0x41c/0x590 [ 140.513443][ T7930] should_failslab+0xc4/0x120 [ 140.513452][ T7930] __kvmalloc_node_noprof+0x160/0x7d8 [ 140.513462][ T7930] __arm64_sys_add_key+0x2e0/0x43c [ 140.513470][ T7930] invoke_syscall+0x98/0x244 [ 140.513480][ T7930] el0_svc_common+0xec/0x23c [ 140.513490][ T7930] do_el0_svc+0x4c/0x5c [ 140.513500][ T7930] el0_svc+0x64/0x260 [ 140.513509][ T7930] el0t_64_sync_handler+0x44/0x104 [ 140.513518][ T7930] el0t_64_sync+0x198/0x19c [ 140.536486][ T7516] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 140.595107][ T4401] 8021q: adding VLAN 0 to HW filter on device eth10 [ 140.597882][ T4715] Bluetooth: hci1: unexpected event for opcode 0x0026 [ 140.641583][ T7941] netlink: 8 bytes leftover after parsing attributes in process `syz.5.879'. [ 140.666665][ T4715] Bluetooth: hci4: command 0x040f tx timeout [ 140.666715][ T4715] Bluetooth: hci0: command 0x0c1a tx timeout [ 140.666749][ T4715] Bluetooth: hci3: command 0x0c1a tx timeout [ 140.674124][ T50] Bluetooth: hci2: command 0x041b tx timeout [ 140.731573][ T7516] veth0_vlan: entered promiscuous mode [ 140.740718][ T7516] veth1_vlan: entered promiscuous mode [ 140.759421][ T7476] veth0_vlan: entered promiscuous mode [ 140.760305][ T7961] loop0: detected capacity change from 0 to 8 [ 140.763136][ T50] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 140.796715][ T7476] veth1_vlan: entered promiscuous mode [ 140.822663][ T7516] veth0_macvtap: entered promiscuous mode [ 140.832508][ T7976] SQUASHFS error: Unable to read directory block [631:26] [ 140.845770][ T5237] tipc: Subscription rejected, illegal request [ 140.852495][ T7516] veth1_macvtap: entered promiscuous mode [ 140.866158][ T7961] SQUASHFS error: Unable to read directory block [6aa:8] [ 140.872668][ T7476] veth0_macvtap: entered promiscuous mode [ 140.883253][ T7516] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 140.896115][ T7476] veth1_macvtap: entered promiscuous mode [ 140.905233][ T7516] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 140.926631][ T7989] netlink: 60 bytes leftover after parsing attributes in process `syz.6.890'. [ 140.942127][ T7989] netlink: 60 bytes leftover after parsing attributes in process `syz.6.890'. [ 140.952468][ T7476] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 140.976053][ T4401] 8021q: adding VLAN 0 to HW filter on device eth11 [ 140.977426][ T7476] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 140.979411][ T7989] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 141.081503][ T50] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 141.107618][ T5246] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 141.109396][ T5246] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 141.131664][ T5246] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 141.131692][ T5246] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 141.135810][ T5237] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.135839][ T5237] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.135861][ T5237] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.135882][ T5237] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.135901][ T5237] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.135919][ T5237] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.135937][ T5237] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.135954][ T5237] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.205102][ T5246] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 141.205127][ T5246] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 141.246976][ T5246] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 141.246993][ T5246] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 141.377929][ T8036] FAULT_INJECTION: forcing a failure. [ 141.377929][ T8036] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 141.380537][ T8036] CPU: 1 UID: 0 PID: 8036 Comm: syz.0.902 Tainted: G L syzkaller #0 PREEMPT [ 141.380560][ T8036] Tainted: [L]=SOFTLOCKUP [ 141.380565][ T8036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 141.380578][ T8036] Call trace: [ 141.380582][ T8036] show_stack+0x2c/0x3c (C) [ 141.380605][ T8036] __dump_stack+0x30/0x40 [ 141.380622][ T8036] dump_stack_lvl+0xd8/0x12c [ 141.380632][ T8036] dump_stack+0x1c/0x28 [ 141.380642][ T8036] should_fail_ex+0x41c/0x590 [ 141.380651][ T8036] should_fail+0x14/0x24 [ 141.380657][ T8036] should_fail_usercopy+0x20/0x30 [ 141.380665][ T8036] copy_safe_from_sockptr+0x88/0x1fc [ 141.380676][ T8036] l2cap_sock_setsockopt+0x2dc/0x1a10 [ 141.380685][ T8036] do_sock_setsockopt+0x1f0/0x330 [ 141.380696][ T8036] __sys_setsockopt+0x104/0x170 [ 141.380706][ T8036] __arm64_sys_setsockopt+0xc8/0xe4 [ 141.380715][ T8036] invoke_syscall+0x98/0x244 [ 141.380726][ T8036] el0_svc_common+0xec/0x23c [ 141.380735][ T8036] do_el0_svc+0x4c/0x5c [ 141.380745][ T8036] el0_svc+0x64/0x260 [ 141.380754][ T8036] el0t_64_sync_handler+0x44/0x104 [ 141.380763][ T8036] el0t_64_sync+0x198/0x19c [ 141.424516][ T50] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 141.447739][ T8046] loop0: detected capacity change from 0 to 512 [ 141.480017][ T8046] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 141.506977][ T4719] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 141.589747][ T8070] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 141.605851][ T50] Bluetooth: hci4: ACL packet for unknown connection handle 200 [ 141.669499][ T8070] md: personality for level rai is not loaded! [ 141.708018][ T8084] loop0: detected capacity change from 0 to 512 [ 141.737006][ T8084] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 141.762326][ T4719] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 141.816507][ T50] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 141.871066][ T8118] loop6: detected capacity change from 0 to 8 [ 141.955247][ T8124] siw: device registration error -23 [ 141.959014][ T8129] SQUASHFS error: Unable to read directory block [631:26] [ 141.963129][ T5246] tipc: Subscription rejected, illegal request [ 141.965330][ T8118] SQUASHFS error: Unable to read directory block [6aa:8] [ 142.169656][ T8154] netlink: 8 bytes leftover after parsing attributes in process `syz.6.948'. [ 142.172087][ T8154] siw: device registration error -23 [ 142.199472][ T8166] FAULT_INJECTION: forcing a failure. [ 142.199472][ T8166] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 142.199503][ T8166] CPU: 0 UID: 0 PID: 8166 Comm: syz.7.952 Tainted: G L syzkaller #0 PREEMPT [ 142.199527][ T8166] Tainted: [L]=SOFTLOCKUP [ 142.199532][ T8166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 142.199544][ T8166] Call trace: [ 142.199547][ T8166] show_stack+0x2c/0x3c (C) [ 142.199565][ T8166] __dump_stack+0x30/0x40 [ 142.199577][ T8166] dump_stack_lvl+0xd8/0x12c [ 142.199587][ T8166] dump_stack+0x1c/0x28 [ 142.199597][ T8166] should_fail_ex+0x41c/0x590 [ 142.199610][ T8166] should_fail+0x14/0x24 [ 142.199617][ T8166] should_fail_usercopy+0x20/0x30 [ 142.199625][ T8166] simple_read_from_buffer+0xc4/0x238 [ 142.199639][ T8166] proc_fail_nth_read+0x1a8/0x248 [ 142.199648][ T8166] vfs_read+0x230/0x8c8 [ 142.199656][ T8166] ksys_read+0x12c/0x228 [ 142.199663][ T8166] __arm64_sys_read+0x84/0x98 [ 142.199670][ T8166] invoke_syscall+0x98/0x244 [ 142.199681][ T8166] el0_svc_common+0xec/0x23c [ 142.199691][ T8166] do_el0_svc+0x4c/0x5c [ 142.199701][ T8166] el0_svc+0x64/0x260 [ 142.199711][ T8166] el0t_64_sync_handler+0x44/0x104 [ 142.199719][ T8166] el0t_64_sync+0x198/0x19c [ 142.275952][ T8043] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 142.276106][ T8043] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 142.276208][ T8043] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 142.276303][ T8043] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 142.277423][ T8043] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 142.339829][ T8178] loop7: detected capacity change from 0 to 512 [ 142.361986][ T8178] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 142.451165][ T8196] siw: device registration error -23 [ 142.561170][ T4898] IPVS: starting estimator thread 0... [ 142.607246][ T8208] team0: entered promiscuous mode [ 142.607540][ T8208] team_slave_0: entered promiscuous mode [ 142.607616][ T8208] team_slave_1: entered promiscuous mode [ 142.630074][ C1] vcan0: j1939_tp_rxtimer: 0x00000000855f6c16: rx timeout, send abort [ 142.673848][ T8203] IPVS: using max 60 ests per chain, 144000 per kthread [ 142.701874][ T8218] overlayfs: failed to resolve './file1': -2 [ 142.882886][ T8220] loop0: detected capacity change from 0 to 512 [ 142.885311][ T8220] EXT4-fs (loop0): unable to read superblock [ 142.958771][ T8225] loop6: detected capacity change from 0 to 8 [ 142.980814][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.980876][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.980927][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.980983][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981032][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981095][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981152][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981215][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981272][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981335][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981392][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981456][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981513][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981576][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981641][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981705][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981764][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981827][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981885][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.981949][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982006][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982070][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982128][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982196][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982254][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982317][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982374][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982438][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982495][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982559][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982618][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982683][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 142.982740][ T8225] SQUASHFS error: Failed to read block 0x4de: -5 [ 143.067014][ T8231] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 143.130115][ C1] vcan0: j1939_tp_rxtimer: 0x00000000855f6c16: abort rx timeout. Force session deactivation [ 143.130214][ C1] vcan0: j1939_tp_rxtimer: 0x000000002ba5de1a: rx timeout, send abort [ 143.156932][ T7476] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 143.212303][ T8231] md: personality for level rai is not loaded! [ 143.543872][ T4715] Bluetooth: hci3: command 0x0c1a tx timeout [ 143.608022][ T8260] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 143.630262][ C1] vcan0: j1939_tp_rxtimer: 0x000000002ba5de1a: abort rx timeout. Force session deactivation [ 143.703421][ T8260] md: personality for level rai is not loaded! [ 143.829128][ T8277] netlink: 12 bytes leftover after parsing attributes in process `syz.5.990'. [ 143.872382][ C0] vcan0: j1939_tp_rxtimer: 0x00000000507fbcb0: rx timeout, send abort [ 143.935969][ T8281] FAULT_INJECTION: forcing a failure. [ 143.935969][ T8281] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 143.936002][ T8281] CPU: 0 UID: 0 PID: 8281 Comm: syz.6.994 Tainted: G L syzkaller #0 PREEMPT [ 143.936017][ T8281] Tainted: [L]=SOFTLOCKUP [ 143.936021][ T8281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 143.936037][ T8281] Call trace: [ 143.936041][ T8281] show_stack+0x2c/0x3c (C) [ 143.936059][ T8281] __dump_stack+0x30/0x40 [ 143.936070][ T8281] dump_stack_lvl+0xd8/0x12c [ 143.936080][ T8281] dump_stack+0x1c/0x28 [ 143.936090][ T8281] should_fail_ex+0x41c/0x590 [ 143.936098][ T8281] should_fail+0x14/0x24 [ 143.936105][ T8281] should_fail_usercopy+0x20/0x30 [ 143.936113][ T8281] _inline_copy_from_user+0x3c/0x174 [ 143.936124][ T8281] ____sys_sendmsg+0x254/0x6c8 [ 143.936133][ T8281] ___sys_sendmsg+0x198/0x224 [ 143.936143][ T8281] __sys_sendmsg+0x158/0x204 [ 143.936152][ T8281] __arm64_sys_sendmsg+0x88/0x9c [ 143.936161][ T8281] invoke_syscall+0x98/0x244 [ 143.936172][ T8281] el0_svc_common+0xec/0x23c [ 143.936182][ T8281] do_el0_svc+0x4c/0x5c [ 143.936191][ T8281] el0_svc+0x64/0x260 [ 143.936200][ T8281] el0t_64_sync_handler+0x44/0x104 [ 143.936209][ T8281] el0t_64_sync+0x198/0x19c [ 144.015367][ T8283] binder: 8282:8283 BC_REQUEST_FREEZE_NOTIFICATION invalid ref 1 [ 144.015402][ T8283] binder: 8282:8283 ioctl c0306201 200001c0 returned -22 [ 144.108318][ T8297] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 144.214804][ T8297] md: could not open device unknown-block(1,0). [ 144.237757][ T8297] md: personality for level rai is not loaded! [ 144.259821][ T8312] FAULT_INJECTION: forcing a failure. [ 144.259821][ T8312] name failslab, interval 1, probability 0, space 0, times 0 [ 144.262352][ T8312] CPU: 1 UID: 0 PID: 8312 Comm: syz.6.1006 Tainted: G L syzkaller #0 PREEMPT [ 144.262373][ T8312] Tainted: [L]=SOFTLOCKUP [ 144.262376][ T8312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 144.262390][ T8312] Call trace: [ 144.262394][ T8312] show_stack+0x2c/0x3c (C) [ 144.262418][ T8312] __dump_stack+0x30/0x40 [ 144.262432][ T8312] dump_stack_lvl+0xd8/0x12c [ 144.262442][ T8312] dump_stack+0x1c/0x28 [ 144.262452][ T8312] should_fail_ex+0x41c/0x590 [ 144.262461][ T8312] should_failslab+0xc4/0x120 [ 144.262469][ T8312] kmem_cache_alloc_noprof+0x94/0x5d8 [ 144.262478][ T8312] security_file_alloc+0x3c/0x300 [ 144.262487][ T8312] init_file+0x90/0x28c [ 144.262495][ T8312] alloc_empty_file+0x80/0x1cc [ 144.262503][ T8312] path_openat+0x7c/0x2a60 [ 144.262511][ T8312] do_file_open+0x1c8/0x2e8 [ 144.262520][ T8312] do_sys_openat2+0x114/0x1e8 [ 144.262530][ T8312] do_sys_open+0xb0/0xe0 [ 144.262540][ T8312] __arm64_sys_openat+0xa8/0xc4 [ 144.262550][ T8312] invoke_syscall+0x98/0x244 [ 144.262560][ T8312] el0_svc_common+0xec/0x23c [ 144.262570][ T8312] do_el0_svc+0x4c/0x5c [ 144.262579][ T8312] el0_svc+0x64/0x260 [ 144.262589][ T8312] el0t_64_sync_handler+0x44/0x104 [ 144.262598][ T8312] el0t_64_sync+0x198/0x19c [ 144.343796][ C1] net_ratelimit: 990 callbacks suppressed [ 144.343824][ T50] Bluetooth: hci4: command 0x040f tx timeout [ 144.343893][ T4713] Bluetooth: hci1: command 0x0c1a tx timeout [ 144.343900][ T50] Bluetooth: hci0: command 0x0c1a tx timeout [ 144.344748][ T4715] Bluetooth: hci2: command 0x041b tx timeout [ 144.372418][ C0] vcan0: j1939_tp_rxtimer: 0x00000000507fbcb0: abort rx timeout. Force session deactivation [ 144.372509][ C0] vcan0: j1939_tp_rxtimer: 0x00000000013a69a3: rx timeout, send abort [ 144.685701][ T8325] autofs: Unknown parameter ' [ 144.685701][ T8325] ' [ 144.754232][ T8333] FAULT_INJECTION: forcing a failure. [ 144.754232][ T8333] name failslab, interval 1, probability 0, space 0, times 0 [ 144.757107][ T8333] CPU: 1 UID: 0 PID: 8333 Comm: syz.6.1015 Tainted: G L syzkaller #0 PREEMPT [ 144.757132][ T8333] Tainted: [L]=SOFTLOCKUP [ 144.757136][ T8333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 144.757151][ T8333] Call trace: [ 144.757156][ T8333] show_stack+0x2c/0x3c (C) [ 144.757181][ T8333] __dump_stack+0x30/0x40 [ 144.757193][ T8333] dump_stack_lvl+0xd8/0x12c [ 144.757204][ T8333] dump_stack+0x1c/0x28 [ 144.757214][ T8333] should_fail_ex+0x41c/0x590 [ 144.757223][ T8333] should_failslab+0xc4/0x120 [ 144.757232][ T8333] __kmalloc_cache_noprof+0x94/0x5ec [ 144.757241][ T8333] alloc_pipe_info+0xec/0x420 [ 144.757249][ T8333] splice_direct_to_actor+0x63c/0x7a8 [ 144.757260][ T8333] do_splice_direct_actor+0x140/0x228 [ 144.757269][ T8333] do_splice_direct+0x58/0x70 [ 144.757279][ T8333] do_sendfile+0x40c/0x6c0 [ 144.757287][ T8333] __arm64_sys_sendfile64+0x1c4/0x28c [ 144.757295][ T8333] invoke_syscall+0x98/0x244 [ 144.757305][ T8333] el0_svc_common+0xec/0x23c [ 144.757315][ T8333] do_el0_svc+0x4c/0x5c [ 144.757325][ T8333] el0_svc+0x64/0x260 [ 144.757334][ T8333] el0t_64_sync_handler+0x44/0x104 [ 144.757343][ T8333] el0t_64_sync+0x198/0x19c [ 144.824484][ T8335] loop5: detected capacity change from 0 to 512 [ 144.824935][ T8335] EXT4-fs: Ignoring removed nobh option [ 144.825235][ T8335] EXT4-fs (loop5): Test dummy encryption mode enabled [ 144.825244][ T8335] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 144.825251][ T8335] EXT4-fs (loop5): couldn't mount as ext2 due to feature incompatibilities [ 144.872539][ C0] vcan0: j1939_tp_rxtimer: 0x00000000013a69a3: abort rx timeout. Force session deactivation [ 144.880242][ T8342] netlink: 52 bytes leftover after parsing attributes in process `syz.7.1019'. [ 144.882450][ T8342] netlink: 448 bytes leftover after parsing attributes in process `syz.7.1019'. [ 144.886401][ T8342] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 144.888114][ T8342] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 144.897055][ T8342] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 144.897075][ T8342] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 145.118015][ T8363] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1028'. [ 145.119332][ T8363] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.124268][ T8363] siw: device registration error -23 [ 145.160010][ T8366] loop6: detected capacity change from 0 to 512 [ 145.161761][ T8366] EXT4-fs: Ignoring removed nobh option [ 145.163423][ T8366] EXT4-fs (loop6): Test dummy encryption mode enabled [ 145.165547][ T8366] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 145.167416][ T8366] EXT4-fs (loop6): couldn't mount as ext2 due to feature incompatibilities [ 145.178173][ T8374] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1033'. [ 145.195269][ T8374] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1033'. [ 145.211261][ T8378] ieee802154 phy0 wpan0: encryption failed: -126 [ 145.265514][ T8386] netlink: 52 bytes leftover after parsing attributes in process `syz.6.1038'. [ 145.265796][ T8386] netlink: 448 bytes leftover after parsing attributes in process `syz.6.1038'. [ 145.324380][ T8397] syz_tun: entered allmulticast mode [ 145.325685][ T8395] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1043'. [ 145.326189][ T8395] siw: device registration error -23 [ 145.330777][ T8399] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1044'. [ 145.362206][ T8400] syz_tun: left allmulticast mode [ 145.418877][ T8410] loop8: detected capacity change from 0 to 512 [ 145.420611][ T8410] EXT4-fs: Ignoring removed nobh option [ 145.425303][ T8410] EXT4-fs (loop8): Test dummy encryption mode enabled [ 145.426590][ T8410] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 145.428438][ T8410] EXT4-fs (loop8): couldn't mount as ext2 due to feature incompatibilities [ 145.428677][ T8411] ieee802154 phy0 wpan0: encryption failed: -126 [ 145.447947][ T8413] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 145.637283][ T8439] ieee802154 phy0 wpan0: encryption failed: -126 [ 145.638010][ T8435] loop5: detected capacity change from 0 to 512 [ 145.642829][ T8435] EXT4-fs (loop5): bad geometry: first data block is 0 with a 1k block and cluster size [ 145.668100][ T8441] loop7: detected capacity change from 0 to 512 [ 145.668634][ T8441] EXT4-fs: Ignoring removed nobh option [ 145.669250][ T8441] EXT4-fs (loop7): Test dummy encryption mode enabled [ 145.669261][ T8441] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 145.669270][ T8441] EXT4-fs (loop7): couldn't mount as ext2 due to feature incompatibilities [ 145.776715][ T8447] FAULT_INJECTION: forcing a failure. [ 145.776715][ T8447] name failslab, interval 1, probability 0, space 0, times 0 [ 145.783095][ T8447] CPU: 1 UID: 0 PID: 8447 Comm: syz.7.1067 Tainted: G L syzkaller #0 PREEMPT [ 145.783119][ T8447] Tainted: [L]=SOFTLOCKUP [ 145.783124][ T8447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 145.783137][ T8447] Call trace: [ 145.783141][ T8447] show_stack+0x2c/0x3c (C) [ 145.783165][ T8447] __dump_stack+0x30/0x40 [ 145.783178][ T8447] dump_stack_lvl+0xd8/0x12c [ 145.783188][ T8447] dump_stack+0x1c/0x28 [ 145.783198][ T8447] should_fail_ex+0x41c/0x590 [ 145.783207][ T8447] should_failslab+0xc4/0x120 [ 145.783216][ T8447] __kmalloc_noprof+0x108/0x6b8 [ 145.783226][ T8447] tomoyo_encode2+0x10c/0x330 [ 145.783235][ T8447] tomoyo_encode+0x34/0x50 [ 145.783243][ T8447] tomoyo_realpath_from_path+0x488/0x4dc [ 145.783252][ T8447] tomoyo_path_number_perm+0x1f0/0x500 [ 145.783260][ T8447] tomoyo_file_ioctl+0x2c/0x3c [ 145.783268][ T8447] security_file_ioctl+0xdc/0x2b0 [ 145.783277][ T8447] __arm64_sys_ioctl+0xb0/0x1cc [ 145.783288][ T8447] invoke_syscall+0x98/0x244 [ 145.783298][ T8447] el0_svc_common+0xec/0x23c [ 145.783307][ T8447] do_el0_svc+0x4c/0x5c [ 145.783317][ T8447] el0_svc+0x64/0x260 [ 145.783327][ T8447] el0t_64_sync_handler+0x44/0x104 [ 145.783335][ T8447] el0t_64_sync+0x198/0x19c [ 145.783354][ T8447] ERROR: Out of memory at tomoyo_realpath_from_path. [ 145.879583][ T8455] overlayfs: failed to resolve './file1': -2 [ 146.144749][ T8468] ieee802154 phy0 wpan0: encryption failed: -126 [ 146.223433][ T8477] loop7: detected capacity change from 0 to 512 [ 146.225444][ T8477] EXT4-fs: Ignoring removed nobh option [ 146.230568][ T8477] EXT4-fs (loop7): Test dummy encryption mode enabled [ 146.231994][ T8477] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 146.235051][ T8477] EXT4-fs (loop7): couldn't mount as ext2 due to feature incompatibilities [ 146.255568][ T8482] FAULT_INJECTION: forcing a failure. [ 146.255568][ T8482] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 146.255609][ T8482] CPU: 0 UID: 0 PID: 8482 Comm: syz.5.1079 Tainted: G L syzkaller #0 PREEMPT [ 146.255623][ T8482] Tainted: [L]=SOFTLOCKUP [ 146.255628][ T8482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 146.255644][ T8482] Call trace: [ 146.255648][ T8482] show_stack+0x2c/0x3c (C) [ 146.255666][ T8482] __dump_stack+0x30/0x40 [ 146.255677][ T8482] dump_stack_lvl+0xd8/0x12c [ 146.255688][ T8482] dump_stack+0x1c/0x28 [ 146.255697][ T8482] should_fail_ex+0x41c/0x590 [ 146.255706][ T8482] should_fail+0x14/0x24 [ 146.255712][ T8482] should_fail_usercopy+0x20/0x30 [ 146.255720][ T8482] _inline_copy_from_user+0x3c/0x174 [ 146.255732][ T8482] move_addr_to_kernel+0x88/0x168 [ 146.255740][ T8482] __sys_bind+0x12c/0x268 [ 146.255749][ T8482] __arm64_sys_bind+0x84/0x9c [ 146.255758][ T8482] invoke_syscall+0x98/0x244 [ 146.255769][ T8482] el0_svc_common+0xec/0x23c [ 146.255779][ T8482] do_el0_svc+0x4c/0x5c [ 146.255789][ T8482] el0_svc+0x64/0x260 [ 146.255798][ T8482] el0t_64_sync_handler+0x44/0x104 [ 146.255806][ T8482] el0t_64_sync+0x198/0x19c [ 146.317683][ T8497] loop5: detected capacity change from 0 to 512 [ 146.318179][ T8497] EXT4-fs (loop5): unable to read superblock [ 146.430249][ T4715] Bluetooth: hci1: command 0x0c1a tx timeout [ 146.430295][ T4715] Bluetooth: hci2: command 0x041b tx timeout [ 146.430330][ T4715] Bluetooth: hci4: command 0x040f tx timeout [ 146.450610][ T8506] ieee802154 phy0 wpan0: encryption failed: -126 [ 146.480489][ T8509] batman_adv: batadv0: Adding interface: veth0 [ 146.481783][ T8509] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 146.487787][ T8509] batman_adv: batadv0: Interface activated: veth0 [ 146.490765][ T8509] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 146.493359][ T8509] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 146.495681][ T8509] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 146.495695][ T8509] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 146.499686][ T8509] batman_adv: batadv0: Interface deactivated: veth0 [ 146.501147][ T8509] batman_adv: batadv0: Removing interface: veth0 [ 146.576276][ T8513] siw: device registration error -23 [ 146.787432][ T8545] overlayfs: failed to resolve './bus': -2 [ 147.069201][ T8552] ieee802154 phy0 wpan0: encryption failed: -126 [ 147.127980][ T8557] siw: device registration error -23 [ 147.260398][ T8574] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 147.260611][ T8574] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 147.261179][ T8574] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 147.263313][ T8574] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 147.266308][ T8574] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 147.295742][ T8584] overlayfs: failed to resolve './bus': -2 [ 147.341865][ T8588] ieee802154 phy0 wpan0: encryption failed: -126 [ 147.363075][ T8594] loop0: detected capacity change from 0 to 512 [ 147.380186][ T8594] EXT4-fs error (device loop0): ext4_xattr_inode_iget:441: inode #11: comm syz.0.1114: iget: bad extra_isize 90 (inode size 256) [ 147.380223][ T8594] loop0: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 147.380360][ T8594] EXT4-fs (loop0): Remounting filesystem read-only [ 147.380406][ T8594] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2860: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 147.380417][ T8594] EXT4-fs warning (device loop0): ext4_evict_inode:270: couldn't mark inode dirty (err -30) [ 147.380450][ T8594] EXT4-fs (loop0): 1 orphan inode deleted [ 147.380915][ T8594] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 147.382724][ T8594] tipc: Started in network mode [ 147.382739][ T8594] tipc: Node identity ac1414aa, cluster identity 4711 [ 147.383157][ T8594] tipc: Enabled bearer , priority 10 [ 147.394526][ T4719] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 147.418616][ T8593] siw: device registration error -23 [ 147.434629][ T8591] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 147.434830][ T8591] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 147.437923][ T8591] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 147.438124][ T8591] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 147.438272][ T8591] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 147.701200][ T8634] bridge_slave_0: default FDB implementation only supports local addresses [ 147.704722][ T8629] siw: device registration error -23 [ 147.847321][ T8645] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 147.847458][ T8645] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 147.847563][ T8645] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 147.847670][ T8645] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 147.847767][ T8645] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 148.054314][ T8678] siw: device registration error -23 [ 148.193052][ T8706] loop0: detected capacity change from 0 to 1024 [ 148.232101][ T8706] EXT4-fs (loop0): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 148.238032][ T8706] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.1152: bg 0: block 112: padding at end of block bitmap is not set [ 148.246426][ T8706] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 52 with error 28 [ 148.246455][ T8706] EXT4-fs (loop0): This should not happen!! Data will be lost [ 148.246455][ T8706] [ 148.246474][ T8706] EXT4-fs (loop0): Total free blocks count 0 [ 148.246488][ T8706] EXT4-fs (loop0): Free/Dirty block details [ 148.246524][ T8706] EXT4-fs (loop0): free_blocks=0 [ 148.246552][ T8706] EXT4-fs (loop0): dirty_blocks=64 [ 148.246563][ T8706] EXT4-fs (loop0): Block reservation details [ 148.246574][ T8706] EXT4-fs (loop0): i_reserved_data_blocks=4 [ 148.271716][ T8715] loop7: detected capacity change from 0 to 256 [ 148.286239][ T8722] loop8: detected capacity change from 0 to 256 [ 148.296232][ T8722] FAT-fs (loop8): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. ** 4831 printk messages dropped ** [ 148.399073][ T8724] EXT4-fs error (device loop0): ext4_readdir:265: inode #2: block 16: comm syz.0.1152: path /250/file1: bad entry in directory: directory entry overrun - offset=876, inode=0, rec_len=1024, size=1024 fake=0 [ 148.487873][ T8715] overlay: filesystem on ./bus not supported [ 148.494859][ T4898] tipc: Node number set to 2886997162 [ 148.691740][ T8737] siw: device registration error -23 [ 148.941640][ T8765] FAULT_INJECTION: forcing a failure. [ 148.941640][ T8765] name failslab, interval 1, probability 0, space 0, times 0 [ 148.941675][ T8765] CPU: 1 UID: 0 PID: 8765 Comm: syz.6.1167 Tainted: G L syzkaller #0 PREEMPT [ 148.941690][ T8765] Tainted: [L]=SOFTLOCKUP [ 148.941694][ T8765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 148.941707][ T8765] Call trace: [ 148.941710][ T8765] show_stack+0x2c/0x3c (C) [ 148.941730][ T8765] __dump_stack+0x30/0x40 [ 148.941741][ T8765] dump_stack_lvl+0xd8/0x12c [ 148.941751][ T8765] dump_stack+0x1c/0x28 [ 148.941761][ T8765] should_fail_ex+0x41c/0x590 [ 148.941769][ T8765] should_failslab+0xc4/0x120 [ 148.941778][ T8765] __kvmalloc_node_noprof+0x160/0x7d8 [ 148.941788][ T8765] xt_alloc_table_info+0x58/0xc4 [ 148.941798][ T8765] do_ip6t_set_ctl+0x850/0xc38 [ 148.941808][ T8765] nf_setsockopt+0xa0/0xe4 [ 148.941816][ T8765] ipv6_setsockopt+0x130/0x16c [ 148.941824][ T8765] tcp_setsockopt+0xcc/0xe8 [ 148.941833][ T8765] sock_common_setsockopt+0xb0/0xcc [ 148.941843][ T8765] do_sock_setsockopt+0x1f0/0x330 [ 148.941853][ T8765] __sys_setsockopt+0x104/0x170 [ 148.941862][ T8765] __arm64_sys_setsockopt+0xc8/0xe4 [ 148.941871][ T8765] invoke_syscall+0x98/0x244 [ 148.941882][ T8765] el0_svc_common+0xec/0x23c [ 148.941891][ T8765] do_el0_svc+0x4c/0x5c [ 148.941901][ T8765] el0_svc+0x64/0x260 [ 148.941911][ T8765] el0t_64_sync_handler+0x44/0x104 [ 148.941919][ T8765] el0t_64_sync+0x198/0x19c [ 149.023308][ T4719] EXT4-fs warning (device loop0): ext4_evict_inode:195: inode #15: comm syz-executor: data will be lost [ 149.027656][ T4719] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 149.068060][ T8774] siw: device registration error -23 [ 149.115536][ T8721] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 149.115557][ T8721] FAT-fs (loop8): Filesystem has been set read-only [ 149.115585][ T8721] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 149.115624][ T8721] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 149.115650][ T8721] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 149.115670][ T8721] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 149.115687][ T8721] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 149.115705][ T8721] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 149.115725][ T8721] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 149.167872][ T8785] __nla_validate_parse: 20 callbacks suppressed [ 149.169269][ T8785] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1175'. [ 149.248732][ T8801] FAULT_INJECTION: forcing a failure. [ 149.248732][ T8801] name failslab, interval 1, probability 0, space 0, times 0 [ 149.248765][ T8801] CPU: 1 UID: 0 PID: 8801 Comm: syz.0.1180 Tainted: G L syzkaller #0 PREEMPT [ 149.248782][ T8801] Tainted: [L]=SOFTLOCKUP [ 149.248786][ T8801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 149.248799][ T8801] Call trace: [ 149.248803][ T8801] show_stack+0x2c/0x3c (C) [ 149.248821][ T8801] __dump_stack+0x30/0x40 [ 149.248833][ T8801] dump_stack_lvl+0xd8/0x12c [ 149.248843][ T8801] dump_stack+0x1c/0x28 [ 149.248852][ T8801] should_fail_ex+0x41c/0x590 [ 149.248861][ T8801] should_failslab+0xc4/0x120 [ 149.248870][ T8801] __kmalloc_noprof+0x108/0x6b8 [ 149.248879][ T8801] tomoyo_encode2+0x10c/0x330 [ 149.248887][ T8801] tomoyo_encode+0x34/0x50 [ 149.248896][ T8801] tomoyo_realpath_from_path+0x488/0x4dc [ 149.248904][ T8801] tomoyo_path_number_perm+0x1f0/0x500 [ 149.248913][ T8801] tomoyo_file_ioctl+0x2c/0x3c [ 149.248921][ T8801] security_file_ioctl+0xdc/0x2b0 [ 149.248930][ T8801] __arm64_sys_ioctl+0xb0/0x1cc [ 149.248941][ T8801] invoke_syscall+0x98/0x244 [ 149.248952][ T8801] el0_svc_common+0xec/0x23c [ 149.248962][ T8801] do_el0_svc+0x4c/0x5c [ 149.248971][ T8801] el0_svc+0x64/0x260 [ 149.248981][ T8801] el0t_64_sync_handler+0x44/0x104 [ 149.248989][ T8801] el0t_64_sync+0x198/0x19c [ 149.249011][ T8801] ERROR: Out of memory at tomoyo_realpath_from_path. [ 149.353348][ T8812] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1187'. [ 149.364996][ T1037] net_ratelimit: 192 callbacks suppressed [ 149.400140][ T8809] siw: device registration error -23 [ 149.505122][ T8830] FAULT_INJECTION: forcing a failure. [ 149.505122][ T8830] name failslab, interval 1, probability 0, space 0, times 0 [ 149.507920][ T8830] CPU: 0 UID: 0 PID: 8830 Comm: syz.7.1191 Tainted: G L syzkaller #0 PREEMPT [ 149.507938][ T8830] Tainted: [L]=SOFTLOCKUP [ 149.507942][ T8830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 149.507955][ T8830] Call trace: [ 149.507959][ T8830] show_stack+0x2c/0x3c (C) [ 149.507983][ T8830] __dump_stack+0x30/0x40 [ 149.507997][ T8830] dump_stack_lvl+0xd8/0x12c [ 149.508008][ T8830] dump_stack+0x1c/0x28 [ 149.508017][ T8830] should_fail_ex+0x41c/0x590 [ 149.508026][ T8830] should_failslab+0xc4/0x120 [ 149.508035][ T8830] __kmalloc_noprof+0x108/0x6b8 [ 149.508044][ T8830] tomoyo_encode2+0x10c/0x330 [ 149.508053][ T8830] tomoyo_encode+0x34/0x50 [ 149.508061][ T8830] tomoyo_realpath_from_path+0x488/0x4dc [ 149.508070][ T8830] tomoyo_path_number_perm+0x1f0/0x500 [ 149.508078][ T8830] tomoyo_file_ioctl+0x2c/0x3c [ 149.508086][ T8830] security_file_ioctl+0xdc/0x2b0 [ 149.508095][ T8830] __arm64_sys_ioctl+0xb0/0x1cc [ 149.508106][ T8830] invoke_syscall+0x98/0x244 [ 149.508117][ T8830] el0_svc_common+0xec/0x23c [ 149.508127][ T8830] do_el0_svc+0x4c/0x5c [ 149.508136][ T8830] el0_svc+0x64/0x260 [ 149.508145][ T8830] el0t_64_sync_handler+0x44/0x104 [ 149.508154][ T8830] el0t_64_sync+0x198/0x19c [ 149.530329][ T8830] ERROR: Out of memory at tomoyo_realpath_from_path. [ 149.672119][ T8854] FAULT_INJECTION: forcing a failure. [ 149.672119][ T8854] name failslab, interval 1, probability 0, space 0, times 0 [ 149.672152][ T8854] CPU: 1 UID: 0 PID: 8854 Comm: syz.0.1196 Tainted: G L syzkaller #0 PREEMPT [ 149.672167][ T8854] Tainted: [L]=SOFTLOCKUP [ 149.672171][ T8854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 149.672184][ T8854] Call trace: [ 149.672187][ T8854] show_stack+0x2c/0x3c (C) [ 149.672203][ T8854] __dump_stack+0x30/0x40 [ 149.672214][ T8854] dump_stack_lvl+0xd8/0x12c [ 149.672224][ T8854] dump_stack+0x1c/0x28 [ 149.672234][ T8854] should_fail_ex+0x41c/0x590 [ 149.672242][ T8854] should_failslab+0xc4/0x120 [ 149.672250][ T8854] kmem_cache_alloc_noprof+0x94/0x5d8 [ 149.672259][ T8854] do_getname+0x48/0x234 [ 149.672267][ T8854] getname_flags+0x2c/0x3c [ 149.672274][ T8854] do_sys_openat2+0xd0/0x1e8 [ 149.672284][ T8854] do_sys_open+0xb0/0xe0 [ 149.672294][ T8854] __arm64_sys_openat+0xa8/0xc4 [ 149.672304][ T8854] invoke_syscall+0x98/0x244 [ 149.672314][ T8854] el0_svc_common+0xec/0x23c [ 149.672324][ T8854] do_el0_svc+0x4c/0x5c [ 149.672334][ T8854] el0_svc+0x64/0x260 [ 149.672343][ T8854] el0t_64_sync_handler+0x44/0x104 [ 149.672352][ T8854] el0t_64_sync+0x198/0x19c [ 149.674398][ T8850] veth0: entered promiscuous mode [ 149.843633][ T8878] securityfs: Unknown parameter 'fd' [ 149.866289][ T4713] Bluetooth: hci4: command 0x040f tx timeout [ 149.866338][ T4713] Bluetooth: hci0: command 0x0c1a tx timeout [ 149.866359][ T4713] Bluetooth: hci2: command 0x041b tx timeout [ 149.866377][ T4713] Bluetooth: hci1: command 0x0c1a tx timeout [ 149.866513][ T50] Bluetooth: hci3: command 0x0c1a tx timeout [ 149.948055][ T8892] loop6: detected capacity change from 0 to 8 [ 149.976334][ T8890] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 150.102976][ T50] Bluetooth: hci3: connection err: -111 [ 150.105380][ T8905] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1213'. [ 150.139441][ T8899] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 150.188092][ T8930] FAULT_INJECTION: forcing a failure. [ 150.188092][ T8930] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 150.198374][ T8930] CPU: 1 UID: 0 PID: 8930 Comm: syz.6.1217 Tainted: G L syzkaller #0 PREEMPT [ 150.198396][ T8930] Tainted: [L]=SOFTLOCKUP [ 150.198400][ T8930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 150.198414][ T8930] Call trace: [ 150.198418][ T8930] show_stack+0x2c/0x3c (C) [ 150.198442][ T8930] __dump_stack+0x30/0x40 [ 150.198455][ T8930] dump_stack_lvl+0xd8/0x12c [ 150.198465][ T8930] dump_stack+0x1c/0x28 [ 150.198475][ T8930] should_fail_ex+0x41c/0x590 [ 150.198483][ T8930] should_fail+0x14/0x24 [ 150.198490][ T8930] should_fail_usercopy+0x20/0x30 [ 150.198498][ T8930] simple_read_from_buffer+0xc4/0x238 [ 150.198508][ T8930] proc_fail_nth_read+0x1a8/0x248 [ 150.198517][ T8930] vfs_read+0x230/0x8c8 [ 150.198524][ T8930] ksys_read+0x12c/0x228 [ 150.198531][ T8930] __arm64_sys_read+0x84/0x98 [ 150.198538][ T8930] invoke_syscall+0x98/0x244 [ 150.198549][ T8930] el0_svc_common+0xec/0x23c [ 150.198559][ T8930] do_el0_svc+0x4c/0x5c [ 150.198568][ T8930] el0_svc+0x64/0x260 [ 150.198578][ T8930] el0t_64_sync_handler+0x44/0x104 [ 150.198587][ T8930] el0t_64_sync+0x198/0x19c [ 150.241213][ T8934] FAULT_INJECTION: forcing a failure. [ 150.241213][ T8934] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 150.241246][ T8934] CPU: 0 UID: 0 PID: 8934 Comm: syz.6.1220 Tainted: G L syzkaller #0 PREEMPT [ 150.241260][ T8934] Tainted: [L]=SOFTLOCKUP [ 150.241265][ T8934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 150.241280][ T8934] Call trace: [ 150.241283][ T8934] show_stack+0x2c/0x3c (C) [ 150.241297][ T8934] __dump_stack+0x30/0x40 [ 150.241308][ T8934] dump_stack_lvl+0xd8/0x12c [ 150.241318][ T8934] dump_stack+0x1c/0x28 [ 150.241328][ T8934] should_fail_ex+0x41c/0x590 [ 150.241335][ T8934] should_fail_alloc_page+0xec/0x10c [ 150.241344][ T8934] prepare_alloc_pages+0x194/0x4a4 [ 150.241353][ T8934] __alloc_frozen_pages_noprof+0x134/0x320 [ 150.241362][ T8934] alloc_pages_mpol+0x1ec/0x3c0 [ 150.241371][ T8934] alloc_frozen_pages_noprof+0xc4/0x10c [ 150.241380][ T8934] alloc_pages_noprof+0x30/0x148 [ 150.241389][ T8934] __pmd_alloc+0x54/0x75c [ 150.241397][ T8934] handle_mm_fault+0x1820/0x2514 [ 150.241404][ T8934] do_page_fault+0x4b0/0xb88 [ 150.241414][ T8934] do_translation_fault+0xc4/0x114 [ 150.241424][ T8934] do_mem_abort+0x70/0x194 [ 150.241433][ T8934] el1_abort+0x50/0x74 [ 150.241441][ T8934] el1h_64_sync_handler+0xdc/0x130 [ 150.241450][ T8934] el1h_64_sync+0x6c/0x70 [ 150.241457][ T8934] __arch_copy_from_user+0x114/0x23c (P) [ 150.241467][ T8934] move_addr_to_kernel+0x88/0x168 [ 150.241477][ T8934] __sys_bind+0x12c/0x268 [ 150.241486][ T8934] __arm64_sys_bind+0x84/0x9c [ 150.241495][ T8934] invoke_syscall+0x98/0x244 [ 150.241505][ T8934] el0_svc_common+0xec/0x23c [ 150.241515][ T8934] do_el0_svc+0x4c/0x5c [ 150.241525][ T8934] el0_svc+0x64/0x260 [ 150.241533][ T8934] el0t_64_sync_handler+0x44/0x104 [ 150.241546][ T8934] el0t_64_sync+0x198/0x19c [ 150.418438][ T8956] loop6: detected capacity change from 0 to 8 [ 150.552912][ T8965] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 150.553076][ T8965] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 150.553181][ T8965] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 150.553277][ T8965] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 150.553369][ T8965] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 150.561006][ T8971] overlayfs: missing 'lowerdir' [ 150.596446][ T8979] ieee802154 phy0 wpan0: encryption failed: -126 [ 150.857832][ T9016] overlayfs: missing 'lowerdir' [ 150.908085][ T9018] siw: device registration error -23 [ 150.977562][ T9032] loop0: detected capacity change from 0 to 128 [ 150.977962][ T9032] vfat: Unknown parameter '0xffffffffffffffff&^Ao[[I7W4 Ggb")"ĵi' [ 151.000669][ T9032] netlink: 'syz.0.1243': attribute type 3 has an invalid length. [ 151.120744][ T9049] overlayfs: missing 'lowerdir' [ 151.171354][ T9055] overlayfs: upper fs does not support tmpfile. [ 151.243946][ T9063] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 151.266393][ T9069] FAULT_INJECTION: forcing a failure. [ 151.266393][ T9069] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 151.266422][ T9069] CPU: 1 UID: 0 PID: 9069 Comm: syz.6.1259 Tainted: G L syzkaller #0 PREEMPT [ 151.266440][ T9069] Tainted: [L]=SOFTLOCKUP [ 151.266445][ T9069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 151.266458][ T9069] Call trace: [ 151.266462][ T9069] show_stack+0x2c/0x3c (C) [ 151.266478][ T9069] __dump_stack+0x30/0x40 [ 151.266490][ T9069] dump_stack_lvl+0xd8/0x12c [ 151.266500][ T9069] dump_stack+0x1c/0x28 [ 151.266509][ T9069] should_fail_ex+0x41c/0x590 [ 151.266518][ T9069] should_fail+0x14/0x24 [ 151.266524][ T9069] should_fail_usercopy+0x20/0x30 [ 151.266532][ T9069] _copy_from_iter+0x188/0x1064 [ 151.266541][ T9069] netlink_sendmsg+0x570/0x948 [ 151.266551][ T9069] __sock_sendmsg+0xc8/0x17c [ 151.266560][ T9069] sock_write_iter+0x220/0x310 [ 151.266570][ T9069] do_iter_readv_writev+0x48c/0x6f8 [ 151.266579][ T9069] vfs_writev+0x2a8/0x630 [ 151.266586][ T9069] do_writev+0x134/0x2a8 [ 151.266594][ T9069] __arm64_sys_writev+0x88/0x9c [ 151.266601][ T9069] invoke_syscall+0x98/0x244 [ 151.266612][ T9069] el0_svc_common+0xec/0x23c [ 151.266628][ T9069] do_el0_svc+0x4c/0x5c [ 151.266638][ T9069] el0_svc+0x64/0x260 [ 151.266648][ T9069] el0t_64_sync_handler+0x44/0x104 [ 151.266657][ T9069] el0t_64_sync+0x198/0x19c [ 151.309212][ T9063] md: could not open device unknown-block(1,0). [ 151.331903][ T9063] md: personality for level rai is not loaded! [ 151.363351][ T9079] overlayfs: missing 'lowerdir' [ 151.375010][ T9083] loop7: detected capacity change from 0 to 1024 [ 151.428931][ T9083] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 151.437865][ T9078] netlink: 'syz.8.1262': attribute type 21 has an invalid length. [ 151.437898][ T9078] netlink: 128 bytes leftover after parsing attributes in process `syz.8.1262'. [ 151.437955][ T9078] netlink: 3 bytes leftover after parsing attributes in process `syz.8.1262'. [ 151.451113][ T9083] EXT4-fs error (device loop7): ext4_generic_delete_entry:2673: inode #2: block 16: comm syz.7.1265: bad entry in directory: inode out of bounds - offset=0, inode=1538, rec_len=12, size=1024 fake=1 [ 151.461351][ T9083] EXT4-fs error (device loop7) in ext4_delete_entry:2744: Corrupt filesystem [ 151.464516][ T9083] EXT4-fs warning (device loop7): ext4_rename_delete:3739: inode #2: comm syz.7.1265: Deleting old file: nlink 1, error=-117 [ 151.467871][ T9096] loop6: detected capacity change from 0 to 128 [ 151.471631][ T9096] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 151.507534][ T9096] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 151.527063][ T9096] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1267'. [ 151.530694][ T9096] netdevsim netdevsim6 netdevsim0: entered allmulticast mode [ 151.576696][ T9105] overlayfs: upper fs does not support tmpfile. [ 151.689891][ T7476] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 151.690259][ T9125] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 151.716729][ T9131] overlayfs: missing 'lowerdir' [ 151.774018][ T9125] md: could not open device unknown-block(1,0). [ 151.818836][ T9125] md: personality for level rai is not loaded! [ 151.908576][ T9158] loop6: detected capacity change from 0 to 1024 [ 151.932702][ T9158] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 151.942444][ T9158] EXT4-fs error (device loop6): ext4_generic_delete_entry:2673: inode #2: block 16: comm syz.6.1288: bad entry in directory: inode out of bounds - offset=0, inode=1538, rec_len=12, size=1024 fake=1 [ 151.948531][ T9158] EXT4-fs error (device loop6) in ext4_delete_entry:2744: Corrupt filesystem [ 151.950924][ T9158] EXT4-fs warning (device loop6): ext4_rename_delete:3739: inode #2: comm syz.6.1288: Deleting old file: nlink 1, error=-117 [ 152.034587][ T6789] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 152.129908][ T9189] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 152.162915][ T9193] FAULT_INJECTION: forcing a failure. [ 152.162915][ T9193] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 152.165720][ T9193] CPU: 1 UID: 0 PID: 9193 Comm: syz.5.1295 Tainted: G L syzkaller #0 PREEMPT [ 152.165737][ T9193] Tainted: [L]=SOFTLOCKUP [ 152.165741][ T9193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 152.165755][ T9193] Call trace: [ 152.165759][ T9193] show_stack+0x2c/0x3c (C) [ 152.165784][ T9193] __dump_stack+0x30/0x40 [ 152.165797][ T9193] dump_stack_lvl+0xd8/0x12c [ 152.165808][ T9193] dump_stack+0x1c/0x28 [ 152.165818][ T9193] should_fail_ex+0x41c/0x590 [ 152.165826][ T9193] should_fail+0x14/0x24 [ 152.165833][ T9193] should_fail_usercopy+0x20/0x30 [ 152.165841][ T9193] _inline_copy_from_user+0x3c/0x174 [ 152.165852][ T9193] copy_msghdr_from_user+0xb8/0x194 [ 152.165862][ T9193] ___sys_sendmsg+0x14c/0x224 [ 152.165872][ T9193] __sys_sendmsg+0x158/0x204 [ 152.165881][ T9193] __arm64_sys_sendmsg+0x88/0x9c [ 152.165891][ T9193] invoke_syscall+0x98/0x244 [ 152.165901][ T9193] el0_svc_common+0xec/0x23c [ 152.165911][ T9193] do_el0_svc+0x4c/0x5c [ 152.165921][ T9193] el0_svc+0x64/0x260 [ 152.165930][ T9193] el0t_64_sync_handler+0x44/0x104 [ 152.165939][ T9193] el0t_64_sync+0x198/0x19c [ 152.244125][ T9189] md: could not open device unknown-block(1,0). [ 152.272562][ T9189] md: personality for level rai is not loaded! [ 152.287607][ T9213] FAULT_INJECTION: forcing a failure. [ 152.287607][ T9213] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 152.290260][ T9213] CPU: 1 UID: 0 PID: 9213 Comm: syz.5.1299 Tainted: G L syzkaller #0 PREEMPT [ 152.290275][ T9213] Tainted: [L]=SOFTLOCKUP [ 152.290279][ T9213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 152.290292][ T9213] Call trace: [ 152.290295][ T9213] show_stack+0x2c/0x3c (C) [ 152.290317][ T9213] __dump_stack+0x30/0x40 [ 152.290329][ T9213] dump_stack_lvl+0xd8/0x12c [ 152.290339][ T9213] dump_stack+0x1c/0x28 [ 152.290349][ T9213] should_fail_ex+0x41c/0x590 [ 152.290358][ T9213] should_fail+0x14/0x24 [ 152.290364][ T9213] should_fail_usercopy+0x20/0x30 [ 152.290372][ T9213] _inline_copy_from_user+0x3c/0x174 [ 152.290383][ T9213] move_addr_to_kernel+0x88/0x168 [ 152.290392][ T9213] __sys_connect+0xd4/0x194 [ 152.290401][ T9213] __arm64_sys_connect+0x84/0x9c [ 152.290410][ T9213] invoke_syscall+0x98/0x244 [ 152.290420][ T9213] el0_svc_common+0xec/0x23c [ 152.290430][ T9213] do_el0_svc+0x4c/0x5c [ 152.290440][ T9213] el0_svc+0x64/0x260 [ 152.290449][ T9213] el0t_64_sync_handler+0x44/0x104 [ 152.290458][ T9213] el0t_64_sync+0x198/0x19c [ 152.320195][ C0] vcan0: j1939_tp_rxtimer: 0x00000000647e21b9: rx timeout, send abort [ 152.342262][ T9217] loop6: detected capacity change from 0 to 8 [ 152.362094][ T9217] SQUASHFS error: Unable to read inode 0xa7 [ 152.385861][ T9217] SQUASHFS error: Unable to read directory block [631:26] [ 152.565519][ T9251] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 152.565819][ T9251] CPU: 1 UID: 0 PID: 9251 Comm: syz.6.1306 Tainted: G L syzkaller #0 PREEMPT [ 152.565839][ T9251] Tainted: [L]=SOFTLOCKUP [ 152.565843][ T9251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 152.565855][ T9251] Call trace: [ 152.565858][ T9251] show_stack+0x2c/0x3c (C) [ 152.565879][ T9251] __dump_stack+0x30/0x40 [ 152.565894][ T9251] dump_stack_lvl+0xd8/0x12c [ 152.565907][ T9251] dump_stack+0x1c/0x28 [ 152.565918][ T9251] sysfs_warn_dup+0x9c/0xb8 [ 152.565932][ T9251] sysfs_create_dir_ns+0x190/0x1f4 [ 152.565944][ T9251] kobject_add_internal+0x290/0x6f0 [ 152.565958][ T9251] kobject_add_varg+0x9c/0xe8 [ 152.565970][ T9251] kobject_add+0x110/0x1c8 [ 152.565981][ T9251] device_add+0x394/0x9e0 [ 152.565991][ T9251] device_register+0x28/0x38 [ 152.566003][ T9251] tty_register_device_attr+0x31c/0x5e8 [ 152.566016][ T9251] tty_register_device+0x3c/0x50 [ 152.566026][ T9251] gsm_activate_mux+0xdc/0x284 [ 152.566038][ T9251] gsmld_ioctl+0xea8/0x1414 [ 152.566048][ T9251] tty_ioctl+0x8a8/0xcb0 [ 152.566058][ T9251] __arm64_sys_ioctl+0x154/0x1cc [ 152.566071][ T9251] invoke_syscall+0x98/0x244 [ 152.566084][ T9251] el0_svc_common+0xec/0x23c [ 152.566096][ T9251] do_el0_svc+0x4c/0x5c [ 152.566108][ T9251] el0_svc+0x64/0x260 [ 152.566118][ T9251] el0t_64_sync_handler+0x44/0x104 [ 152.566128][ T9251] el0t_64_sync+0x198/0x19c [ 152.566149][ T9251] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 152.593760][ T4713] Bluetooth: hci4: command 0x040f tx timeout [ 152.593786][ T4713] Bluetooth: hci1: command 0x0c1a tx timeout [ 152.593809][ T4713] Bluetooth: hci0: command 0x0c1a tx timeout [ 152.593828][ T4713] Bluetooth: hci3: command 0x0c1a tx timeout [ 152.593921][ T50] Bluetooth: hci2: command 0x041b tx timeout [ 152.662599][ T9255] EXT4-fs: Ignoring removed nobh option [ 152.678945][ T9255] EXT4-fs (loop0): Test dummy encryption mode enabled [ 152.678978][ T9255] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 152.678993][ T9255] EXT4-fs (loop0): couldn't mount as ext2 due to feature incompatibilities [ 152.721113][ T9259] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 152.754024][ T9267] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1311'. [ 152.814963][ T9259] md: could not open device unknown-block(1,0). [ 152.820259][ C0] vcan0: j1939_tp_rxtimer: 0x00000000647e21b9: abort rx timeout. Force session deactivation [ 152.820385][ C0] vcan0: j1939_tp_rxtimer: 0x00000000a9689f29: rx timeout, send abort [ 152.852894][ T9267] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 152.870669][ T9259] md: personality for level rai is not loaded! [ 152.940412][ T9293] Bluetooth: hci0: service_discovery: expected 4 bytes, got 7 bytes [ 153.069541][ T9306] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 153.149944][ T4716] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 153.173564][ T9317] netlink: 'syz.8.1322': attribute type 39 has an invalid length. [ 153.188113][ T9313] EXT4-fs: Ignoring removed nobh option [ 153.188357][ T9313] EXT4-fs (loop0): Test dummy encryption mode enabled [ 153.188365][ T9313] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 153.188372][ T9313] EXT4-fs (loop0): couldn't mount as ext2 due to feature incompatibilities [ 153.210985][ T9321] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1323'. [ 153.280841][ T9328] set_capacity_and_notify: 3 callbacks suppressed [ 153.280858][ T9328] loop0: detected capacity change from 0 to 8 [ 153.315840][ T9328] SQUASHFS error: Unable to read directory block [6aa:8] [ 153.320418][ C0] vcan0: j1939_tp_rxtimer: 0x00000000a9689f29: abort rx timeout. Force session deactivation [ 153.432456][ T9342] FAULT_INJECTION: forcing a failure. [ 153.432456][ T9342] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 153.432488][ T9342] CPU: 0 UID: 0 PID: 9342 Comm: syz.0.1329 Tainted: G L syzkaller #0 PREEMPT [ 153.432501][ T9342] Tainted: [L]=SOFTLOCKUP [ 153.432504][ T9342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 153.432516][ T9342] Call trace: [ 153.432519][ T9342] show_stack+0x2c/0x3c (C) [ 153.432535][ T9342] __dump_stack+0x30/0x40 [ 153.432546][ T9342] dump_stack_lvl+0xd8/0x12c [ 153.432556][ T9342] dump_stack+0x1c/0x28 [ 153.432566][ T9342] should_fail_ex+0x41c/0x590 [ 153.432574][ T9342] should_fail+0x14/0x24 [ 153.432581][ T9342] should_fail_usercopy+0x20/0x30 [ 153.432588][ T9342] strncpy_from_user+0x48/0x388 [ 153.432596][ T9342] mptcp_setsockopt+0x1138/0x219c [ 153.432612][ T9342] sock_common_setsockopt+0xb0/0xcc [ 153.432623][ T9342] do_sock_setsockopt+0x1f0/0x330 [ 153.432634][ T9342] __sys_setsockopt+0x104/0x170 [ 153.432644][ T9342] __arm64_sys_setsockopt+0xc8/0xe4 [ 153.432653][ T9342] invoke_syscall+0x98/0x244 [ 153.432663][ T9342] el0_svc_common+0xec/0x23c [ 153.432673][ T9342] do_el0_svc+0x4c/0x5c [ 153.432683][ T9342] el0_svc+0x64/0x260 [ 153.432691][ T9342] el0t_64_sync_handler+0x44/0x104 [ 153.432700][ T9342] el0t_64_sync+0x198/0x19c [ 153.586966][ T9357] loop8: detected capacity change from 0 to 512 [ 153.589728][ T9357] EXT4-fs: Ignoring removed nobh option [ 153.597856][ T9357] EXT4-fs (loop8): Test dummy encryption mode enabled [ 153.599877][ T9357] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 153.602124][ T9357] EXT4-fs (loop8): couldn't mount as ext2 due to feature incompatibilities [ 153.632218][ T9363] loop5: detected capacity change from 0 to 8 [ 153.669304][ T9367] loop8: detected capacity change from 0 to 8 [ 153.739241][ T9375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.739504][ T9375] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.740918][ T9367] SQUASHFS error: Unable to read directory block [6aa:8] [ 153.759721][ T9375] netlink: 5 bytes leftover after parsing attributes in process `syz.5.1338'. [ 153.759803][ T9375] 1{X: renamed from 30{X (while UP) [ 153.800423][ T9385] loop6: detected capacity change from 0 to 1024 [ 153.807465][ T9385] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 153.831335][ T9389] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(6) [ 153.837762][ T9385] EXT4-fs: Ignoring removed bh option [ 153.839792][ T9385] EXT4-fs: old and new quota format mixing [ 153.865451][ T9391] FAULT_INJECTION: forcing a failure. [ 153.865451][ T9391] name failslab, interval 1, probability 0, space 0, times 0 [ 153.865482][ T9391] CPU: 0 UID: 0 PID: 9391 Comm: syz.0.1343 Tainted: G L syzkaller #0 PREEMPT [ 153.865500][ T9391] Tainted: [L]=SOFTLOCKUP [ 153.865505][ T9391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 153.865519][ T9391] Call trace: [ 153.865522][ T9391] show_stack+0x2c/0x3c (C) [ 153.865540][ T9391] __dump_stack+0x30/0x40 [ 153.865551][ T9391] dump_stack_lvl+0xd8/0x12c [ 153.865561][ T9391] dump_stack+0x1c/0x28 [ 153.865571][ T9391] should_fail_ex+0x41c/0x590 [ 153.865580][ T9391] should_failslab+0xc4/0x120 [ 153.865588][ T9391] kmem_cache_alloc_node_noprof+0x98/0x5f8 [ 153.865597][ T9391] __alloc_skb+0x1f0/0x610 [ 153.865615][ T9391] netlink_alloc_large_skb+0xd4/0x114 [ 153.865628][ T9391] netlink_sendmsg+0x4c4/0x948 [ 153.865638][ T9391] __sock_sendmsg+0xc8/0x17c [ 153.865647][ T9391] ____sys_sendmsg+0x3d0/0x6c8 [ 153.865656][ T9391] ___sys_sendmsg+0x198/0x224 [ 153.865666][ T9391] __sys_sendmsg+0x158/0x204 [ 153.865675][ T9391] __arm64_sys_sendmsg+0x88/0x9c [ 153.865685][ T9391] invoke_syscall+0x98/0x244 [ 153.865695][ T9391] el0_svc_common+0xec/0x23c [ 153.865705][ T9391] do_el0_svc+0x4c/0x5c [ 153.865715][ T9391] el0_svc+0x64/0x260 [ 153.865724][ T9391] el0t_64_sync_handler+0x44/0x104 [ 153.865732][ T9391] el0t_64_sync+0x198/0x19c [ 153.922969][ T6789] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 153.955681][ T9401] loop0: detected capacity change from 0 to 512 [ 153.957504][ T9401] EXT4-fs: Ignoring removed nobh option [ 153.959006][ T9401] EXT4-fs (loop0): Test dummy encryption mode enabled [ 153.962232][ T9401] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 153.962681][ T9403] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 153.968471][ T9401] EXT4-fs (loop0): couldn't mount as ext2 due to feature incompatibilities [ 154.009583][ T9410] netlink: 52 bytes leftover after parsing attributes in process `syz.7.1349'. [ 154.014528][ T9409] loop0: detected capacity change from 0 to 8 [ 154.040468][ T9409] SQUASHFS error: Unable to read directory block [6aa:8] [ 154.048758][ T9403] md: could not open device unknown-block(1,0). [ 154.107720][ T9403] md: personality for level rai is not loaded! [ 154.253107][ T9430] __nla_validate_parse: 1 callbacks suppressed [ 154.253308][ T9430] netlink: 52 bytes leftover after parsing attributes in process `syz.7.1357'. [ 154.486744][ T9463] netlink: 52 bytes leftover after parsing attributes in process `syz.7.1367'. [ 154.490074][ T9463] netlink: 448 bytes leftover after parsing attributes in process `syz.7.1367'. [ 154.567445][ T9474] net_ratelimit: 209 callbacks suppressed [ 154.635724][ T9485] loop7: detected capacity change from 0 to 512 [ 154.664733][ T9485] EXT4-fs (loop7): feature flags set on rev 0 fs, running e2fsck is recommended [ 154.665253][ T9474] tun0: tun_chr_ioctl cmd 1074025681 [ 154.669026][ T9485] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a842c01c, mo2=0002] [ 154.669068][ T9485] System zones: 0-2, 18-18, 34-34 [ 154.673743][ T4716] Bluetooth: hci2: command 0x041b tx timeout [ 154.673792][ T4716] Bluetooth: hci1: command 0x0c1a tx timeout [ 154.675004][ T9485] EXT4-fs error (device loop7): ext4_orphan_get:1425: comm syz.7.1372: bad orphan inode 15 [ 154.675026][ T9485] loop7: lost filesystem error report for type 5 error -117 [ 154.675281][ T9485] ext4_test_bit(bit=14, block=18) = 1 [ 154.675296][ T9485] is_bad_inode(inode)=0 [ 154.675301][ T9485] NEXT_ORPHAN(inode)=2264924160 [ 154.675306][ T9485] max_ino=32 [ 154.675310][ T9485] i_nlink=0 [ 154.675539][ T9485] EXT4-fs error (device loop7): ext4_xattr_delete_inode:2972: inode #15: comm syz.7.1372: corrupted xattr block 19: ea_inode specified without ea_inode feature enabled [ 154.675657][ T9485] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 154.675812][ T9485] EXT4-fs warning (device loop7): ext4_evict_inode:287: xattr delete (err -117) [ 154.676299][ T9485] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 154.686585][ T9485] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 154.699820][ T7476] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 154.753864][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 154.972769][ T50] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 155.608292][ T9507] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 155.608501][ T9507] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 155.608661][ T9507] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 155.608801][ T9507] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 155.608938][ T9507] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 155.713422][ T9588] loop0: detected capacity change from 0 to 8 [ 155.723798][ T9588] SQUASHFS error: Unable to read directory block [6aa:8] [ 155.792888][ T9593] : renamed from bond_slave_0 (while UP) [ 156.113361][ T9601] autofs: Unknown parameter '00000000000000000000' [ 156.195348][ T9605] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 156.195523][ T9605] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 156.195672][ T9605] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 156.195821][ T9605] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 156.203210][ T9605] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 156.350904][ T9634] autofs: Unknown parameter '00000000000000000000' [ 156.474398][ T9645] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 156.476015][ T9645] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 156.477548][ T9645] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 156.478930][ T9645] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 156.480458][ T9645] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 156.550586][ T9665] loop5: detected capacity change from 0 to 8 [ 156.565461][ T9668] autofs: Unknown parameter '00000000000000000000' [ 156.757766][ T9695] autofs: Unknown parameter 'fd00000000000000000000' [ 156.794817][ T9687] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 156.794932][ T9687] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 156.795032][ T9687] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 156.795131][ T9687] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 156.795227][ T9687] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 156.845828][ T9708] netlink: 68 bytes leftover after parsing attributes in process `syz.6.1452'. [ 156.988757][ T9732] autofs: Unknown parameter 'fd00000000000000000000' [ 157.049728][ T9733] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 157.049940][ T9733] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 157.050096][ T9733] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 157.050240][ T9733] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 157.050381][ T9733] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 157.073580][ T9746] FAULT_INJECTION: forcing a failure. [ 157.073580][ T9746] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 157.077089][ T9746] CPU: 0 UID: 0 PID: 9746 Comm: syz.7.1469 Tainted: G L syzkaller #0 PREEMPT [ 157.077115][ T9746] Tainted: [L]=SOFTLOCKUP [ 157.077119][ T9746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 157.077135][ T9746] Call trace: [ 157.077139][ T9746] show_stack+0x2c/0x3c (C) [ 157.077162][ T9746] __dump_stack+0x30/0x40 [ 157.077174][ T9746] dump_stack_lvl+0xd8/0x12c [ 157.077185][ T9746] dump_stack+0x1c/0x28 [ 157.077195][ T9746] should_fail_ex+0x41c/0x590 [ 157.077203][ T9746] should_fail_alloc_page+0xec/0x10c [ 157.077212][ T9746] prepare_alloc_pages+0x194/0x4a4 [ 157.077221][ T9746] __alloc_frozen_pages_noprof+0x134/0x320 [ 157.077230][ T9746] alloc_pages_mpol+0x1ec/0x3c0 [ 157.077239][ T9746] alloc_frozen_pages_noprof+0xc4/0x10c [ 157.077249][ T9746] alloc_pages_noprof+0x30/0x148 [ 157.077257][ T9746] __pte_alloc+0x40/0x1c4 [ 157.077268][ T9746] do_pte_missing+0x259c/0x2a24 [ 157.077276][ T9746] handle_mm_fault+0x14f8/0x2514 [ 157.077283][ T9746] do_page_fault+0x4b0/0xb88 [ 157.077293][ T9746] do_translation_fault+0xc4/0x114 [ 157.077303][ T9746] do_mem_abort+0x70/0x194 [ 157.077312][ T9746] el1_abort+0x50/0x74 [ 157.077321][ T9746] el1h_64_sync_handler+0xdc/0x130 [ 157.077330][ T9746] el1h_64_sync+0x6c/0x70 [ 157.077338][ T9746] __arch_copy_from_user+0x114/0x23c (P) [ 157.077348][ T9746] move_addr_to_kernel+0x88/0x168 [ 157.077358][ T9746] __sys_bind+0x12c/0x268 [ 157.077367][ T9746] __arm64_sys_bind+0x84/0x9c [ 157.077376][ T9746] invoke_syscall+0x98/0x244 [ 157.077386][ T9746] el0_svc_common+0xec/0x23c [ 157.077396][ T9746] do_el0_svc+0x4c/0x5c [ 157.077405][ T9746] el0_svc+0x64/0x260 [ 157.077414][ T9746] el0t_64_sync_handler+0x44/0x104 [ 157.077422][ T9746] el0t_64_sync+0x198/0x19c [ 157.094150][ T9751] FAULT_INJECTION: forcing a failure. [ 157.094150][ T9751] name failslab, interval 1, probability 0, space 0, times 0 [ 157.094166][ T9751] CPU: 1 UID: 0 PID: 9751 Comm: syz.5.1468 Tainted: G L syzkaller #0 PREEMPT [ 157.094179][ T9751] Tainted: [L]=SOFTLOCKUP [ 157.094183][ T9751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 157.094195][ T9751] Call trace: [ 157.094197][ T9751] show_stack+0x2c/0x3c (C) [ 157.094212][ T9751] __dump_stack+0x30/0x40 [ 157.094222][ T9751] dump_stack_lvl+0xd8/0x12c [ 157.094232][ T9751] dump_stack+0x1c/0x28 [ 157.094242][ T9751] should_fail_ex+0x41c/0x590 [ 157.094250][ T9751] should_failslab+0xc4/0x120 [ 157.094257][ T9751] __kmalloc_node_track_caller_noprof+0x108/0x6d4 [ 157.094267][ T9751] kmemdup_noprof+0x44/0x8c [ 157.094276][ T9751] llcp_sock_bind+0x2b0/0x58c [ 157.094286][ T9751] __sys_bind+0x1c4/0x268 [ 157.094295][ T9751] __arm64_sys_bind+0x84/0x9c [ 157.094304][ T9751] invoke_syscall+0x98/0x244 [ 157.094314][ T9751] el0_svc_common+0xec/0x23c [ 157.094323][ T9751] do_el0_svc+0x4c/0x5c [ 157.094333][ T9751] el0_svc+0x64/0x260 [ 157.094341][ T9751] el0t_64_sync_handler+0x44/0x104 [ 157.094350][ T9751] el0t_64_sync+0x198/0x19c [ 157.188530][ T9758] bridge0: port 3(veth1_virt_wifi) entered blocking state [ 157.188588][ T9758] bridge0: port 3(veth1_virt_wifi) entered disabled state [ 157.188778][ T9758] veth1_virt_wifi: entered allmulticast mode [ 157.190909][ T9758] veth1_virt_wifi: left allmulticast mode [ 157.237160][ T9767] autofs: Unknown parameter 'fd00000000000000000000' [ 157.324886][ T9773] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 157.325100][ T9773] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 157.325254][ T9773] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 157.325398][ T9773] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 157.326413][ T9773] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 157.339864][ T9784] FAULT_INJECTION: forcing a failure. [ 157.339864][ T9784] name failslab, interval 1, probability 0, space 0, times 0 [ 157.339895][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: syz.0.1484 Tainted: G L syzkaller #0 PREEMPT [ 157.339910][ T9784] Tainted: [L]=SOFTLOCKUP [ 157.339914][ T9784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 157.339931][ T9784] Call trace: [ 157.339935][ T9784] show_stack+0x2c/0x3c (C) [ 157.339955][ T9784] __dump_stack+0x30/0x40 [ 157.339967][ T9784] dump_stack_lvl+0xd8/0x12c [ 157.339977][ T9784] dump_stack+0x1c/0x28 [ 157.339987][ T9784] should_fail_ex+0x41c/0x590 [ 157.339996][ T9784] should_failslab+0xc4/0x120 [ 157.340005][ T9784] __kmalloc_noprof+0x108/0x6b8 [ 157.340014][ T9784] ioctl_standard_iw_point+0x40c/0xb04 [ 157.340026][ T9784] ioctl_standard_call+0xb4/0x178 [ 157.340035][ T9784] wext_ioctl_dispatch+0x104/0x36c [ 157.340045][ T9784] wext_handle_ioctl+0x154/0x288 [ 157.340054][ T9784] sock_ioctl+0x154/0x7ec [ 157.340065][ T9784] __arm64_sys_ioctl+0x154/0x1cc [ 157.340076][ T9784] invoke_syscall+0x98/0x244 [ 157.340087][ T9784] el0_svc_common+0xec/0x23c [ 157.340097][ T9784] do_el0_svc+0x4c/0x5c [ 157.340106][ T9784] el0_svc+0x64/0x260 [ 157.340115][ T9784] el0t_64_sync_handler+0x44/0x104 [ 157.340124][ T9784] el0t_64_sync+0x198/0x19c [ 157.390768][ T9786] netlink: 'syz.5.1486': attribute type 21 has an invalid length. [ 157.390796][ T9786] netlink: 128 bytes leftover after parsing attributes in process `syz.5.1486'. [ 157.390844][ T9786] netlink: 3 bytes leftover after parsing attributes in process `syz.5.1486'. [ 157.427762][ T9790] overlayfs: failed to resolve './bus': -2 [ 157.495077][ T9801] vfat: Unknown parameter 'iochGVset' [ 157.505007][ T9802] binder: BINDER_SET_CONTEXT_MGR already set [ 157.505026][ T9802] binder: 9799:9802 ioctl 4018620d 20000240 returned -16 [ 157.511577][ T9802] binder: 9799:9802 tried to acquire reference to desc 0, got 1 instead [ 157.511714][ T9802] binder: 9799:9802 got transaction with invalid data ptr [ 157.511866][ T9802] binder: 9799:9802 transaction call to 9799:0 failed 9/29201/-14, code 0 size 0-24 line 3511 [ 157.544799][ T9810] FAULT_INJECTION: forcing a failure. [ 157.544799][ T9810] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 157.544834][ T9810] CPU: 1 UID: 0 PID: 9810 Comm: syz.0.1497 Tainted: G L syzkaller #0 PREEMPT [ 157.544847][ T9810] Tainted: [L]=SOFTLOCKUP [ 157.544851][ T9810] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 157.544863][ T9810] Call trace: [ 157.544866][ T9810] show_stack+0x2c/0x3c (C) [ 157.544883][ T9810] __dump_stack+0x30/0x40 [ 157.544894][ T9810] dump_stack_lvl+0xd8/0x12c [ 157.544905][ T9810] dump_stack+0x1c/0x28 [ 157.544914][ T9810] should_fail_ex+0x41c/0x590 [ 157.544922][ T9810] should_fail+0x14/0x24 [ 157.544929][ T9810] should_fail_usercopy+0x20/0x30 [ 157.544937][ T9810] simple_read_from_buffer+0xc4/0x238 [ 157.544947][ T9810] proc_fail_nth_read+0x1a8/0x248 [ 157.544956][ T9810] vfs_read+0x230/0x8c8 [ 157.544963][ T9810] ksys_read+0x12c/0x228 [ 157.544970][ T9810] __arm64_sys_read+0x84/0x98 [ 157.544977][ T9810] invoke_syscall+0x98/0x244 [ 157.544987][ T9810] el0_svc_common+0xec/0x23c [ 157.544997][ T9810] do_el0_svc+0x4c/0x5c [ 157.545006][ T9810] el0_svc+0x64/0x260 [ 157.545015][ T9810] el0t_64_sync_handler+0x44/0x104 [ 157.545024][ T9810] el0t_64_sync+0x198/0x19c [ 157.660022][ T9812] ================================================================== [ 157.660028][ T9812] BUG: KASAN: slab-out-of-bounds in string_nocheck+0xd8/0x140 [ 157.660047][ T9812] Read of size 1 at addr ffff0000caead541 by task syz.5.1498/9812 [ 157.660054][ T9812] [ 157.660060][ T9812] CPU: 1 UID: 0 PID: 9812 Comm: syz.5.1498 Tainted: G L syzkaller #0 PREEMPT [ 157.660072][ T9812] Tainted: [L]=SOFTLOCKUP [ 157.660075][ T9812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 157.660087][ T9812] Call trace: [ 157.660090][ T9812] show_stack+0x2c/0x3c (C) [ 157.660104][ T9812] __dump_stack+0x30/0x40 [ 157.660116][ T9812] dump_stack_lvl+0xd8/0x12c [ 157.660128][ T9812] print_address_description+0xb0/0x238 [ 157.660138][ T9812] print_report+0x68/0x84 [ 157.660146][ T9812] kasan_report+0x8c/0xc4 [ 157.660157][ T9812] __asan_report_load1_noabort+0x20/0x2c [ 157.660169][ T9812] string_nocheck+0xd8/0x140 [ 157.660182][ T9812] string+0x8c/0xc8 [ 157.660193][ T9812] vsnprintf+0x880/0xd10 [ 157.660205][ T9812] pointer+0x5e8/0x6b4 [ 157.660216][ T9812] vsnprintf+0x618/0xd10 [ 157.660231][ T9812] vprintk_store+0x344/0xb94 [ 157.660243][ T9812] vprintk_emit+0x1bc/0x514 [ 157.660253][ T9812] vprintk_default+0x54/0x80 [ 157.660264][ T9812] vprintk+0x9c/0x114 [ 157.660276][ T9812] _printk+0xe0/0x130 [ 157.660283][ T9812] __dynamic_pr_debug+0x148/0x1e4 [ 157.660292][ T9812] nfc_llcp_get_sdp_ssap+0x350/0x3fc [ 157.660301][ T9812] llcp_sock_bind+0x2e0/0x58c [ 157.660310][ T9812] __sys_bind+0x1c4/0x268 [ 157.660322][ T9812] __arm64_sys_bind+0x84/0x9c [ 157.660332][ T9812] invoke_syscall+0x98/0x244 [ 157.660344][ T9812] el0_svc_common+0xec/0x23c [ 157.660356][ T9812] do_el0_svc+0x4c/0x5c [ 157.660368][ T9812] el0_svc+0x64/0x260 [ 157.660378][ T9812] el0t_64_sync_handler+0x44/0x104 [ 157.660388][ T9812] el0t_64_sync+0x198/0x19c [ 157.660397][ T9812] [ 157.660399][ T9812] Allocated by task 9812: [ 157.660403][ T9812] kasan_save_track+0x40/0x78 [ 157.660412][ T9812] kasan_save_alloc_info+0x40/0x50 [ 157.660423][ T9812] __kasan_kmalloc+0x9c/0xb4 [ 157.660431][ T9812] __kmalloc_node_track_caller_noprof+0x434/0x6d4 [ 157.660441][ T9812] kmemdup_noprof+0x44/0x8c [ 157.660450][ T9812] llcp_sock_bind+0x2b0/0x58c [ 157.660457][ T9812] __sys_bind+0x1c4/0x268 [ 157.660466][ T9812] __arm64_sys_bind+0x84/0x9c [ 157.660475][ T9812] invoke_syscall+0x98/0x244 [ 157.660485][ T9812] el0_svc_common+0xec/0x23c [ 157.660495][ T9812] do_el0_svc+0x4c/0x5c [ 157.660505][ T9812] el0_svc+0x64/0x260 [ 157.660513][ T9812] el0t_64_sync_handler+0x44/0x104 [ 157.660521][ T9812] el0t_64_sync+0x198/0x19c [ 157.660527][ T9812] [ 157.660529][ T9812] The buggy address belongs to the object at ffff0000caead540 [ 157.660529][ T9812] which belongs to the cache kmalloc-8 of size 8 [ 157.660536][ T9812] The buggy address is located 0 bytes to the right of [ 157.660536][ T9812] allocated 1-byte region [ffff0000caead540, ffff0000caead541) [ 157.660545][ T9812] [ 157.660547][ T9812] The buggy address belongs to the physical page: [ 157.660551][ T9812] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10aead [ 157.660559][ T9812] flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 157.660566][ T9812] page_type: f5(slab) [ 157.660574][ T9812] raw: 05ffc00000000000 ffff0000c0001500 dead000000000100 dead000000000122 [ 157.660581][ T9812] raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000 [ 157.660585][ T9812] page dumped because: kasan: bad access detected [ 157.660589][ T9812] [ 157.660591][ T9812] Memory state around the buggy address: [ 157.660595][ T9812] ffff0000caead400: 05 fc fc fc 05 fc fc fc 00 fc fc fc 00 fc fc fc [ 157.660601][ T9812] ffff0000caead480: fa fc fc fc 00 fc fc fc 05 fc fc fc 00 fc fc fc [ 157.660607][ T9812] >ffff0000caead500: 05 fc fc fc 05 fc fc fc 01 fc fc fc 06 fc fc fc [ 157.660611][ T9812] ^ [ 157.660616][ T9812] ffff0000caead580: 00 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc [ 157.660627][ T9812] ffff0000caead600: 05 fc fc fc 00 fc fc fc 05 fc fc fc 00 fc fc fc [ 157.660634][ T9812] ================================================================== [ 157.660639][ T9812] Disabling lock debugging due to kernel taint [ 157.687347][ T9818] overlayfs: failed to resolve './bus': -2 [ 157.741722][ T9814] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 157.742142][ T9814] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 157.742226][ T9814] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 157.742321][ T9814] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 157.742404][ T9814] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 157.901133][ T9801] syz.7.1493 (9801): drop_caches: 2 [ 157.902503][ T26] binder: undelivered TRANSACTION_ERROR: 29201 [ 157.907029][ T26] binder: release 9799:9806 transaction 10 out, still active [ 157.910381][ T26] binder: undelivered TRANSACTION_COMPLETE [ 157.925858][ T26] binder: send failed reply for transaction 10, target dead [ 159.783735][ T4715] Bluetooth: hci1: command 0x0c1a tx timeout [ 159.783754][ T4713] Bluetooth: hci0: command 0x0c1a tx timeout [ 159.783780][ T4715] Bluetooth: hci3: command 0x0c1a tx timeout [ 159.784637][ T50] Bluetooth: hci2: command 0x041b tx timeout [ 159.784674][ T4716] Bluetooth: hci4: command 0x040f tx timeout [ 159.863927][ T5237] net_ratelimit: 171 callbacks suppressed [ 164.903666][ C1] net_ratelimit: 136 callbacks suppressed