last executing test programs: 4m7.23716874s ago: executing program 2 (id=1008): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e8500000005"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000010"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 4m7.025905024s ago: executing program 2 (id=1010): socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @cred={{0x1c}}], 0x90}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x2f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 4m5.9808426s ago: executing program 2 (id=1017): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f0000001300)="b8d49fc0205107", 0x7}], 0x1}}], 0x1, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x3}, {0xffff, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0xfff, 0x10000000, 0x7, 0xccb}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd000011"], 0xfce) 4m5.745648179s ago: executing program 2 (id=1019): syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000000)='./file0\x00', 0x800000, &(0x7f0000000380)=ANY=[], 0x1, 0x14fd, &(0x7f0000002a80)="$eJzs3AuYjtXaOPB1r7UexjTpbZLDsO51P7xpsEyS5JCQQ5IkSZJTQtIkSUJiyClpSEKOk+QwhOQwjUnjfD7knDTZ0iRJSEhY/0u7ve2929/X9/33/v991zf377rWNeue573v937mnmve53mvmfmu56h6LerXbkZE4l8Cf/6QIoSIEUIME0JcJ4QIhBCV4ivFXz5eQEHKv/Yk7N/r4fSr3QG7mnj+eRvPP2/j+edtPP+8jeeft/H88zaef97G82csL9s+p9j1vPLu4vf/8zJ+/f9fJLf85K82lr+x138jheeft/H88zaef97G88/beP55G8//f79a/8kxnn/exvNnLC/bDlqI/wHvQ/O6Outqf/8xxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGMsbzvkrtBDiL/ur3RdjjDHGGGOMMcb+fXz+q90BY4wxxhhjjDHG/t8DIYUSWgQin8gvYkQBESuuEXHiWlFQXCci4noRL24QhcSNorAoIoqKYiJBFBclhBEorCARipKilIiKm0RpcbNIFGVEWVFOOFFeJIlbRAVxq6gobhOVxO2isrhDVBFVRTVRXdwpaoi7RE1RS9QWd4s6oq6oJ+qLe0QDca9oKO4TjcT9orF4QDQRD4qm4iHRTDwsmotHRAvxqGgpHhOtRGvRRrQV7f6v8l8SfcXLop/oL1LEADFQvCIGicFiiBgqholXxXDxmhghXhepYqQYJd4Qo8WbYox4S4wV48R48baYICaKSWKymCKmijTxjpgm3hXTxXtihpgpZonZIl3MEXPF+2KemC8WiA/EQvGhWCQWiyViqcgQH4lMsUxkiY/FcvGJyBYrxEqxSqwWa8RasU6sFxvERrFJbBZbxFaxTWwXn4odYqfYJXaLPWKv2Cc+E/vF5+KA+ELkiC//m/ln/yG/FwgQIEGCBg35IB/EQAzEQizEQRwUhIIQgQjEQzwUgkJQGApDUSgKCZAAJaAEICAQEJSEkhCFKJSG0pAIiVAWyoIDB0mQBBXgVqgIFaESVILKUBmqQFWoCtWhOtSAGlATakJtqA11oA7Ug3pwD9wD90JDaAiNoBE0hsbQBJpAU2gKzaAZNIfm0AJaQEtoCa2gFbSBNtAO2kF7aA8doAN0gk7QGTpDF+gCyZAMXaErdINu0B26Qw/oAT2hJ/SC3tAbXoKX4GV4GfpDHTkABsJAGASDYAgMhaHwKgyH1+A1eB1SYSSMgjfgDXgTxsAZGAvjYDyMhxpyIkyCyUByKqRBGkyDaTAdpsMMmAkzYTakwxyYC3NhHsyH+fABLIQP4UNYDIthKWRABmTCMsiCLFgOZyEbVsBKWAWrYQ2shnWwHtbBRtgEG2ELbIFtsA0+hU9hJ+yE3bAb9sJe+Aw+g8/hc0iFHMiBg3AQDsEhOAyHIRdy4QgcgaNwFI7BMTgOx+EEnIRTcBJOw2k4A2fhHJyD83AeLsALCd8031tmQ6qQl2mpZT6ZT8bIGBkrY2WcjJMFZUEZkREZL+NlIVlIFpaFZVFZVCbIBFlClpAoUZIMZUlZUkZlVJaWpWWiTJRlZVnppJNJMklWkBVkRVlRVpK3y8ryDllFVpUdXXVZXdaQnVxNWUvWlrVlHVlX1pP1ZX3ZQDaQDWVD2Ug2ko1lY9lEPiibygEwBB6WlyfTQo6ElnIUtJKtZRvZVr4Jj8v2cgx0kB1lJ/mkHAdjoYts75LlM7KrnATd5HNyMjwve8ip0FO+KHvJ3rKPfEn2lR1cP9lfzoABcqCcDYPkYDlEDpXzoK68PLF68nWZKkfKUfINuRTelGPkW3KsHCfHy7flBDlRTpKT5RQ5VabJd+Q0+a6cLt+TM+RMOUvOlulyjpwr35fz5Hy5QH4gF8oP5SK5WC6RS2WG/EhmymUyS34sl8tPZLZcIVfKVXK1XCPXynVyvdwgN8pNcrPcIrfKbXK7/FTukDvlLrlb7pF75T75mdwvP5cH5BcyR34pD8o/yUPyK3lYfi1z5TfyiPxWHpXfyWPye3lc/iBPyJPylPxRnpY/yTPyrDwnf5bn5S/ygrwoL0kvhQIllVJaBSqfyq9iVAEVq65RcepaVVBdpyLqehWvblCF1I2qsCqiiqpiKkEVVyWUUaisIhX+9htj/VVpdbNKVGVUWVVOOVVeJalbVAV1q6qoblOV1O2qsrpDVVFVVTVVXd2paqi7VE1VS9VWd6s6qq6qp+qre1QDda9qqO5TjdT9qrF6QDVRD6qm6iHVTD2smqtHVAv1qGqpHlOtVGvVRrVV7dTjqr16QnVQHVUn9aTqrJ5SXdTTKlk9o7qqZ1U39Zzqrp5XPdQLqqd6UfVSvVUfdVFdUl71U/1VihqgBqpX1CA1WA1RQ9Uw9aoarl5TI9TrKlWNVKPUG2q0elONUW+psWqcGq/eVhPURDVJTVZT1FSVpt5R09S7arp6T81QM9UsNVulqzlqyG+VFvwX8t/9J/kjfn32bWq7+lTtUDvVLrVb7VF71T61T+1X+9UBdUDlqBx1UB1Uh9QhdVgdVrkqVx1RR9RRdVQdU8fUcXVcnVAn1c/qR3Va/aTOqLPqrPpZnVfn1YXfvgZCg5Zaaa0DnU/n1zG6gI7V1+g4fa0uqK/TEX29jtc36EL6Rl1YF9FFdTGdoIvrEtpo1FaTDnVJXUpH9U26tL5ZJ+oyuqwup50ur5P0Lf9y/h/110630+11e91Bd9CddCfdWXfWXXQXnayTdVfdVXfT3XR33V330D10T91T99K9dB/dR/fVfXU/3U+n6BQ9UL+iB+nBeogeqofpV/VwPVyP0CN0qk7Vo/QoPVqP1mP0GD1Wj9Xj9Xg9QU/Qk/QkPUVP0Wk6TU/T0/R0PV3P0DP0LD1Lp+t0PVfP1fP0PL1AL9AL9UK9SC/SS/QSnaEzdKbO1Fk6Sy/Xy3W2XqFX6FV6lV6j1+h1ep3eoDfoTXqT3qK36Gy9XW/XO/QOvUvv0nv0Hr1P79P79X59QB/QOTpHH9QH9SF9SB/Wh3WuztVH9BF9VB/Vx/QxfVwf1yf0CX1Kn9Kn9Wl9Rp/R5/Q5fV6f1xf0BX1JX7p82RfIQAY60EG+IF8QE8QEsUFsEBfEBQWDgkEkiATxQXxQKLgxKBwUCYoGxYKEoHhQIjABBjagIAxKBqWCaHBTUDq4OUgMygRlg3KBC8oHScEtQYXg1qBicFtQKbg9qBzcEVQpIIJqQfXgzqBGcFdQM6gV1A7uDuoEdYN6Qf3gnqBBcG/QMLgvaBTcHzQOHgiaBA8GTYOHgmbBw0Hz4JGgRfBo0DJ4LGgVtA7aBG2Ddv9YP6j6L9T3/kyRJ1w/09+kmAFmoHnFDDKDzRAz1Awzr5rh5jUzwrxuUs1IM8q8YUabN80Y85YZa8aZ8eZtM8FMNJPMZDPFTDVp5h0zzbxrppv3zAwz08wys026mWPmmvfNPDPfLDAfmIXmQ7PILDZLzFKTYT4ymWaZyTIfm+XmE5NtVpiVZpVZbdaYtWadWW82mI1mk9lstpitZpvZbj41O8xOs8vsNnvMXrPPfGb2m8/NAfOFyTFfmoPmT+aQ+cocNl+bXPONOWK+NUfNd+aY+d4cNz+YE+akOWV+NKfNT+aMOWvOmZ/NefOLuWAumkvGX764v/zyjho15sN8GIMxGIuxGIdxWBALYgQjGI/xWAgLYWEsjEWxKCZgApbAEngZIWFJLIlRjGJpLI2JmIhlsSw6dJiESVgBK2BFrIiVsBJWxspYBatgNayGd+KdeBfehbWwFt6Nd2NdrIv1sT42wAbYEBtiI2yEjbExNsEm2BSbYjNshs2xObbAFtgSW2IrbIVtsA22w3bYHttjB+yAnbATdsbO2AW7YDImY1fsit2wG3bH7tgDe2BP7Im9sBf2wT7YF/tiP+yHKZiCA3EgDsJBOASH4DAchsNxOI7AEZiKqTgKR+FoHI1jcAyOxXE4Ht/GCTgRJ+FknIJTMQ3TcBpOw+k4HWfgDJyFszAd03EuzsV5OA8X4AJciAtxES7CJbgEMzADMzETszALl+NyzMZsXIkrcTWuxrW4FtfjetyIG3EzbsatuBW343bcgTtwF+7CPbgH9+E+3I/78QAewBzMwYN4EA/hITyMhzEXc/EIHsGjeBSP4TE8jsfxBJ7AU3gKT+NpPINn8Byew/P4C17Ai3gJPcZYKWLtNTbOXmsL2utsjC1g/zYuaovZBFvclrDGFrZF/i5Ga22iLWPL2nLW2fI2yd7yu7iKrWqr2er2TlvD3mVr/i5uYO+1De19tpG939a39/xd3Ng+YJvYR21T+5htZlvb5ratbWEftS3tY7aVbW3b2La2s33KdrFP22T7jO1qn/1dnGmX2fV2g91oN9n99nN7zv5sj9rv7Hn7i+1n+9th9lU73L5mR9jXbaod+bt4vH3bTrAT7SQ72U6xU38Xz7KzbbqdY+fa9+08O/93cYb9yC60WXaRXWyX2KW/xpd7yrIf2+X2E5ttV9iVdpVdbdfYtXbdX3tdZbfYrXab3Wc/szvsTrvL7rZ77N5f48vnccB+YXPsl/aI/dYesl/Zw/aYzbXf/BpfPr9j9nt73P5gT9iT9pT90Z62P9kz9uyv53/53H+0F+0l660gIEmKNAWUj/JTDBWgWLqG4uhaKkjXUYSup3i6gQrRjVSYilBRKkYJVJxKkCEkS0QhlaRSFKWbqDTdTIlUhspSOXJUnpLoFqpAt1JFuo0q0e1Ume6gKlSVqlF1upNq0F1Uk2pRbbqb6lBdqkf16R5qQPdSQ7qPGtH91JgeoCb0IDWlh6gZPUzN6RFqQY9SS3qMWlFrakNtqR09Tu3pCepAHakTPUmd6SnqQk9TMj1DXelZ6kbPUXd6nnrQC9STXqRe1Jv60EvUl16mftSfUmgADaRXaBANpiE0lIbRqzScXqMR9Dql0kgaRW/QaHqTxtBbNJbG0Xh6mybQRJpEk2kKTaU0eoem0bs0nd6jGTSTZtFsSqc5NJfep3k0nxbQB7SQPqRFtJiW0FLKoI8ok5ZRFn1My+kTyqYVtJJW0WpaQ2tpHa2nDbSRNtFm2kJbaRttp09pB+2kXbSb9tBe2kef0X76nA7QF5RDX9JB+hMdoq/oMH1NufQNHaFv6Sh9R8foezpOP9AJOkmn6Ec6TT/RGTpL5+hnOk+/0AW6SJfIkwghlKEKdRiE+cL8YUxYIIwNrwnjwmvDguF1YSS8PowPbwgLhTeGhcMiYdGwWJgQFg9LhCbE0IYUhmHJsFQYDW8KS4c3h4lhmbBsWC50YfkwKbwlrBDeGlYMbwsrhbeHlcM7wiph1fDR+6uHd4Y1wrvCmmGtsHZ4d1gnrBvWC+uH94QNwnvDhuF9YaPw/rBi+EDYJHwwbBo+FDYLHw6bh4+ELcJHw5bhY2GrsHXYJmwbtgsfD9uHT4Qdwo5hp/DJsHP4VNglfDpMDp8Ju4bP/uHxlHBAODB8JXwl9P4+tSS6NJoR/SiaGV0WzYp+HF0e/SSaHV0RXRldFV0dXRNdG10XXR/dEN0Y3RTdHN0S3RrdFvW+fn7hwEmnnHaBy+fyuxhXwMW6a1ycu9YVdNe5iLvexbsbXCF3oyvsiriirphLcMVdCWccOuvIha6kK+Wi7iZX2t3sEl0ZV9aVc86Vd0murWvn2rn27gnXwXV0ndyT7kn3lHvKPe2eds+4ru5Z180957q7510P94J7wb3oernero97yfV1L7t+rr9LcSluoBvoBrlBbogb4oa5YW64G+5GuBEu1aW6UW6UG+1GuzFujBvrxrrxbryb4Ca4SW6Sm+KmuDSX5qa5aW66m+5muBlulpvl0l26m+vmunlunlvgFriFiQvdIrfILXFLXIbLcJku02W5LLfcLXfZLtutdCvdarfarXVr3Xq33m10G91mt9ltdVvddrfd7XA73C63y+1xe9w+t8/td/vdAXfA5bgcd9AddIfcIXfYfe1y3TfuiPvWHXXfuWPue3fc/eBOuJPulPvRnXY/uTPurDvnfnbn3S/ugrvoLjnv0iLvRKZF3o1Mj7wXmRGZGZkVmR1Jj8yJzI28H5kXmR9ZEPkgsjDyYWRRZHFkSWRpJCPyUSQzsiySFfk4sjzySSQ7siKyMrIqsjqyJuJ98R2hL+lL+ai/yZf2N/tEX8aX9eW88+V9kr/FV/C3+or+Nl/J3+4r+zt8FV/VV/OP+Va+tW/j2/p2/nHf3j/hO/iOvpN/0nf2T/ku/mmf7J/xXf2zvpt/znf3z/se/gXf07/oe/nevo9/yff1L/t+vr9P8QP8QP+KH+QH+yF+qB/mX/XD/Wt+hH/dp/qRfpR/w4/2b/ox/i0/1o/z4/3bfoKf6Cf5yX6Kn+rT/Dt+mn/XT/fv+Rl+pp/lZ/t0P8fP9e/7eX6+X+A/8Av9h36RX+yX+KU+w3/kM/0yn+U/9sv9Jz7br/Ar/Sq/2q/xa/06v95v8Bv9Jr/Zb/Fb/Ta/3X/qd/idfpff7ff4vX6f/8zv95/7A/4Ln+O/9Af9n/wh/5U/7L/2uf4bf8R/64/67/wx/70/7n/wJ/xJf8r/6E/7n/wZf9af8z/78/4Xf8Ff9Jf4b9YYY4wxxv5L1B8cH/BPPid/W5cNFEJcu7NY7j/W3Fz4z/vBMqFzRAjxTP+eD/9l1amTkpLy22OzlQhKLRZCRK7k5xNX4hWik3hKJIuOosI/7W+w7H2e/qB+9HYhYv/auRAx4i/x39a/9T+o//iT4zMrh+fi/5P6i4VILHUlp4C4El+pX/E/qF+k/R/0X+CrNCE6/E1OnLgSX6mfJJ4Qz4rkv3skY4wxxhhjjDH2Z4Nlte5/dP98+f48QV/JyS+uxH90f84YY4wxxhhjjLGr7/nefZ5+PDm5Y3fe8IY3vPnr5mr/ZGKMMcYYY4z9u1256L/anTDGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY3nX/49/J3a1z5ExxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhi72v5PAAAA//+nkUE+") creat(&(0x7f0000000580)='./bus\x00', 0x9e) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000000100)='?', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) mkdir(&(0x7f0000000740)='./file0\x00', 0x0) 4m5.420637256s ago: executing program 2 (id=1022): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1808000000000000000000000300000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000002f000000b70900000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r2}, &(0x7f0000000280), &(0x7f0000000240)=r4}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 4m4.901891993s ago: executing program 2 (id=1029): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmmsg(r1, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f0000001300)="b8d49fc0205107", 0x7}], 0x1}}], 0x1, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x3}, {0xffff, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0xfff, 0x10000000, 0x7, 0xccb}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd000011"], 0xfce) 4m4.453925086s ago: executing program 32 (id=1029): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmmsg(r1, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f0000001300)="b8d49fc0205107", 0x7}], 0x1}}], 0x1, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x3}, {0xffff, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0xfff, 0x10000000, 0x7, 0xccb}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd000011"], 0xfce) 1m2.113107622s ago: executing program 5 (id=1819): r0 = socket$nl_route(0x10, 0x3, 0x0) close(0x3) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newlink={0x20, 0x10, 0x1, 0x0, 0x25dfdbfb}, 0x20}}, 0x0) 1m1.538031552s ago: executing program 5 (id=1825): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller1\x00'}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003000320006006300"], 0x76) 1m0.779875578s ago: executing program 5 (id=1830): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a0101"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x840) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="4104"], 0x7) 1m0.620778521s ago: executing program 5 (id=1832): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000200)='./bus\x00', 0x1400c, &(0x7f0000000040)={[{@debug}, {@data_journal}, {@norecovery}]}, 0x3, 0x498, &(0x7f0000000240)="$eJzs3L9vG1UcAPDvOXFCaCGhlF8tPwIFUSFImrZABwZAIDEUgQQDjFYSqtK0oCZItIpEylAmVCGxI0b+BSZYEGJCYgVmVFGhLG2ZjM53l9iu7eaHY5f685GcfN/d2e997+45z/dyDmBgTaY/kojdEfF7RIxnxcYNJrNf11aXZ6+vLs8mUa2+809S2+7q6vJssWnxvF31hUhif4t6F8+dP1VZWJg/m5enl05/PL147vxzJ09XTsyfmD9z+Nixo0dmXnzh8PPbyG4sIva8lcWlfNkb73/15vEvG/JvyqNLJjutfKpa7XJ1/XVXXTzcx3awOUP58SrX+v94DNUdvfF4/fO1wmd9aiCwY6rVanVX+9UrVeA2lkRjWZeHQVH8oS8+/+a/R+sHAS/v6Aikv668kn0ASvO+lj+yNcNrVwzKTZ9vu2kyIt5b+feb9BEdr0MkO9QCAGDQ/JCOf55NRzvLs+nYY338UYr767a7O58bmoiIeyJiT0TcG2dib0TcF1Hb9oGIeHCT9ddNktSGmVdXR5rGP6XLW05uA9Lx30v53Fbj+K8Y/cXEUK10LitEOfng5ML8oXyfHIzyaFqe6VDHj6/9dqnduvrxX/pI6y/Ggnk7Lg+PNj5nrrJU2XrGja5ciNg33Cr/ZG0mIB15PhQR+1q9QOnmdZx85ruH2627ef4ddGGiqfptxNPZ8V+JpvwLSef5yek7YmH+0HRxVtzol18vvt2u/m3l3wXp8b+z5fm/lv9EUj9fu7j5Oi7+8UXbudXJch5s4vxfqSxVRpJ3a/FIvuzTytLS2ZmIkeR41uj65YfXn1uUi+3T/A8eaN3/98T6ntgfEelJ/EhEPBoRj+XH7vGIeCIiDnTI/+dXn/ywedlYkf8tcPznNnX814ORaFxSarFNGgyd+un7hkon1sM8/+ud3/+O1qKD+ZKNvP/d2IrWwXb3HwAAAPwflCJidySlqbW4VJqayv6Hf2829Z365Mxcdo/ARJRLxZWu8brroTP5x/qsfCEisn8tKNYfiVLtuvHXQ2O18tTsRwtzfc0c2NWm/6f+Gup364Ad54YtGFz6Pwyujv2/3Lt2AL13Q//v2OdHd7QtQG+1+Ps/1o92AL3Xavzv+35gMDT1f9N+MEBc/4fBpf/D4NrAPfzA7WdxLG5+k/xaUI6I5lXFK23g6VsJxiM208LtB8U3I273daLcuzb3I4hSd17nz3x/t1g10v7U+vtSxC2wE1oHyc51h94F/XtPAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6Kb/AgAA//8GT9U6") syz_mount_image$ext4(0x0, &(0x7f0000000080)='./file0\x00', 0x18808, 0x0, 0xf7, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0xcd) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000500)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 59.786085784s ago: executing program 5 (id=1834): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="18080000000000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000002f000000b70900000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r2}, &(0x7f0000000280), &(0x7f0000000240)=r4}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 59.459563361s ago: executing program 5 (id=1836): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x202, 0x0) sendfile(r0, r1, 0x0, 0xd6) 58.856481536s ago: executing program 33 (id=1836): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x202, 0x0) sendfile(r0, r1, 0x0, 0xd6) 11.788617934s ago: executing program 3 (id=1952): bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x9, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000010000000000000000000000711827000000000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 11.598082233s ago: executing program 3 (id=1953): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x54040081}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xa}, {0xffff, 0xffff}, {0x2}}, [@TCA_RATE={0x6, 0x5, {0xe2, 0x10}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10010}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 9.517158073s ago: executing program 3 (id=1957): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x5) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffd000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x80}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0x7101}) 6.441102539s ago: executing program 1 (id=1980): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) syz_open_procfs(0x0, &(0x7f00000002c0)='net/softnet_stat\x00') connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffff7]}, 0x8, 0x80000) 6.387036031s ago: executing program 4 (id=1982): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x4, 0x8, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000500)='./file0\x00', 0x1010008, &(0x7f00000001c0)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c756e695f786c6174653d312c636865636b3d7374726963742c646f733178666c6f7070792c757466383d312c757466383d312c757466383d302c696f636861727365743d6370313235de26302c696f636861727365743d69736f383835392d342c696f636861727365743d64656661756c742c73686f72746e616d653d6d69786564", @ANYRES16=0x0, @ANYRESOCT=0x0], 0xfe, 0x1b2, &(0x7f0000000580)="$eJzs289qE1EUB+CT2Na0LpKFK3Ex4MZVaPoEBqkgBgQlCwVBsQ1IRwIWArow2bnwIfRx3OqTuCwiXEmmf5Iai5Q2A+n3bXKYub9w7pDkMIF5efvt3k5/v/ei9y1qlUpU76UUB5VoRDWOjAIAWCYHKcWXiEjXR7H+NdKvVCi7LwDg8ozn/8/xwD+c/yY/ACy/p8+eP2p3OttPsqwWkX8adAfd4rU43+7Fm8hjNzajHr8j0rGifvCws72ZTTTicz48zA8H3Wuz+VbUozE/3yry2Wx+NTam81tRj5vz81tz82tx985Uvhn1+PE6+pHHToyzJ/mPrSy7/7hzKn9jsg4AAACWQTM7Nvf+vdn81/ki36789/8Dp+6vV+LWSrl7B4Crav/9h71Xeb77bqHF2tSRiBidsfj7RtHo4jrMzhk/uqSLvpgXV6zHxb/zapS/r+Up+tXzx1NKw/Hn8+zFtYiYFOX9JgGLcfLtnzlcL60hAAAAAAAAAAAAAADgL4t4dKnsPQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABw9fwJAAD//xQYkLQ=") unshare(0x20060400) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) chmod(0x0, 0x234) flock(0xffffffffffffffff, 0xb) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfc, 0x4}, 0xc) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010000000000000000002c00000020000000ff0f00000000000008001c00c9"], 0x3c}], 0x1, 0x0, 0x0, 0xb305e06d8ab48273}, 0x48800) pipe(0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x100000) syz_usb_connect(0x0, 0x5a, 0x0, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8}, 0x48) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0x14, &(0x7f0000000540)=@framed={{}, [@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xf}}, @generic={0x7a, 0xa, 0x0, 0xfffffff0}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x0, 0x3e, 0x0, &(0x7f00000001c0)="00000000d4070000000000000000622b951b5ecd6ea23e7f71914844c93adf72bfeebf356d50c7f706cf4a1b0ba200"/62, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffeffb}, 0x48) 6.04862369s ago: executing program 6 (id=1984): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000007008500000073"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 5.766092289s ago: executing program 6 (id=1986): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x8c00, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, 0x0) 5.485555267s ago: executing program 6 (id=1988): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000002b00)=@base={0x1, 0x4, 0x2, 0x5, 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x50) 5.408475352s ago: executing program 1 (id=1989): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000500000000000000000000850000002a00000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000001a00)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000071"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) sendmsg$inet(r2, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) 5.198001056s ago: executing program 1 (id=1990): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x54040081}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xa}, {0xffff, 0xffff}, {0x2}}, [@TCA_RATE={0x6, 0x5, {0xe2, 0x10}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x10010}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 5.197814066s ago: executing program 6 (id=1991): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002000000000000000100000400000000b75c6672598f"], &(0x7f0000000240)=""/218, 0x3e, 0xda, 0x1}, 0x28) 5.020285573s ago: executing program 6 (id=1993): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000180)=[{&(0x7f00000002c0)="89e7ee0c7cdad9b4b47380c988cafb", 0xf}, {&(0x7f0000000440)="448b7c0acf8bc0cefe8360fcbe079ca4e62ef0675c", 0x15}, {&(0x7f0000000100)="208aae0838a467b58f9fcbf94251344a1259241763bf61", 0x17}], 0x3) 4.960463345s ago: executing program 1 (id=1994): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x5, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000069108e0000000000bc0010"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, 0x0, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b0030003200060063"], 0x76) 4.879407802s ago: executing program 4 (id=1995): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=@updpolicy={0xf4, 0x19, 0x1, 0x0, 0x1, {{@in=@multicast2, @in, 0x0, 0x0, 0x1000, 0x0, 0xa, 0x0, 0x20, 0x5c}, {0x1ff, 0x0, 0x0, 0xfffffffffffffffc, 0x10000, 0x0, 0x0, 0xfffffffffffffffb}, {0x218, 0x9, 0x200000000000000, 0x4}, 0xfffffffc, 0x0, 0x0, 0x0, 0x1, 0x1}, [@lastused={0xc, 0xf, 0x3}, @iptfs_max_qsize={0x8, 0x28, 0x7}, @replay_esn_val={0x1c, 0x17, {0x0, 0x70bd28, 0x70bd2d, 0x70bd28, 0x70bd2d, 0x6}}, @mark={0xc, 0x15, {0x35075b, 0x3}}]}, 0xf4}}, 0x2c000014) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x4, {{@in=@multicast1=0xe0000002, @in, 0x4e24, 0x0, 0x1000, 0x0, 0xa, 0x20, 0x0, 0x2f}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfffffffffffffffd}, {0x1, 0x6, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x987a3a9f32358a4c) 4.40361321s ago: executing program 4 (id=1997): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001980)=ANY=[@ANYBLOB="0e00000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 4.095431104s ago: executing program 4 (id=1999): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) syz_open_procfs(0x0, &(0x7f00000002c0)='net/softnet_stat\x00') connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffff7]}, 0x8, 0x80000) 4.095260784s ago: executing program 0 (id=2000): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0xc, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002e00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.929661538s ago: executing program 0 (id=2001): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r1}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 3.738130068s ago: executing program 0 (id=2002): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, 0x0, 0x76) 3.14614211s ago: executing program 4 (id=2003): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002000000000000000000000400000003000000000100001301000000000000000000000d0200"], 0xffffffffffffffff, 0x3e, 0x0, 0x2}, 0x28) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a80)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd6372ce22667f2b"], 0x66) 2.466908281s ago: executing program 3 (id=2004): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x54040081}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xa}, {0xffff, 0xffff}, {0x2}}, [@TCA_RATE={0x6, 0x5, {0xe2, 0x10}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0], 0x48}, 0x1, 0x0, 0x0, 0x10010}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 787.878548ms ago: executing program 6 (id=2005): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x4, 0x8, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000500)='./file0\x00', 0x1010008, &(0x7f00000001c0)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c756e695f786c6174653d312c636865636b3d7374726963742c646f733178666c6f7070792c757466383d312c757466383d312c757466383d302c696f636861727365743d6370313235de26302c696f636861727365743d69736f383835392d342c696f636861727365743d64656661756c742c73686f72746e616d653d6d69786564", @ANYRES16=0x0, @ANYRESOCT=0x0], 0xfe, 0x1b2, &(0x7f0000000580)="$eJzs289qE1EUB+CT2Na0LpKFK3Ex4MZVaPoEBqkgBgQlCwVBsQ1IRwIWArow2bnwIfRx3OqTuCwiXEmmf5Iai5Q2A+n3bXKYub9w7pDkMIF5efvt3k5/v/ei9y1qlUpU76UUB5VoRDWOjAIAWCYHKcWXiEjXR7H+NdKvVCi7LwDg8ozn/8/xwD+c/yY/ACy/p8+eP2p3OttPsqwWkX8adAfd4rU43+7Fm8hjNzajHr8j0rGifvCws72ZTTTicz48zA8H3Wuz+VbUozE/3yry2Wx+NTam81tRj5vz81tz82tx985Uvhn1+PE6+pHHToyzJ/mPrSy7/7hzKn9jsg4AAACWQTM7Nvf+vdn81/ki36789/8Dp+6vV+LWSrl7B4Crav/9h71Xeb77bqHF2tSRiBidsfj7RtHo4jrMzhk/uqSLvpgXV6zHxb/zapS/r+Up+tXzx1NKw/Hn8+zFtYiYFOX9JgGLcfLtnzlcL60hAAAAAAAAAAAAAADgL4t4dKnsPQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABw9fwJAAD//xQYkLQ=") unshare(0x20060400) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) chmod(0x0, 0x234) flock(0xffffffffffffffff, 0xb) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfc, 0x4}, 0xc) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010000000000000000002c00000020000000ff0f00000000000008001c00c9"], 0x3c}], 0x1, 0x0, 0x0, 0xb305e06d8ab48273}, 0x48800) pipe(0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x100000) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8}, 0x48) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0x14, &(0x7f0000000540)=@framed={{}, [@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xf}}, @generic={0x7a, 0xa, 0x0, 0xfffffff0}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x0, 0x3e, 0x0, &(0x7f00000001c0)="00000000d4070000000000000000622b951b5ecd6ea23e7f71914844c93adf72bfeebf356d50c7f706cf4a1b0ba200"/62, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffeffb}, 0x48) 665.803563ms ago: executing program 1 (id=2006): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x74, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xb, 0xc}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x40, 0x2, [@TCA_MATCHALL_ACT={0x3c, 0x2, [@m_mpls={0x38, 0x1, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0x1fc16}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x74}}, 0x0) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003000320006006300"], 0x76) 665.517403ms ago: executing program 4 (id=2007): unshare(0x40000400) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_clone3(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='0', 0x1) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_usb_connect$uac2(0x5, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x182) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0x8004587d, &(0x7f0000000080)={@desc={0x1, 0x0, @desc3}}) fallocate(r1, 0x0, 0xbf5, 0x2000402) 664.786173ms ago: executing program 0 (id=2008): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@rand_addr=0x64010101, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x8, 0x0, 0x100000001, 0x0, 0x0, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x0, 0xffffffffffffffff}, 0xfffffffe}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x2c000014) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x4, {{@in=@multicast1=0xe0000002, @in, 0x4e24, 0x0, 0x1000, 0x0, 0xa, 0x20, 0x0, 0x2f}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfffffffffffffffd}, {0x1, 0x6, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x987a3a9f32358a4c) 652.571346ms ago: executing program 3 (id=2009): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000100)={0x2, 0x4e29, @local}, 0x10) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0x18}, 0x4000000) 361.079086ms ago: executing program 0 (id=2010): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000240), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000040)={0x3, &(0x7f0000000840)=[{0x8, '\x00', @buffer={"14ec41ecbd8ad8826481a1bdf27b01cdb47096aca3e53e7d32531763c6fc8e7e", 0x20}, 0x1}, {0x6, '\x00', @data=0x4, 0x404}, {0x13, '\x00', @buffer={"668c947331ab1ad4e398ce872e4f5abeac41f8a9d4d68c6cb1ee692b9bd1f0f4", 0x20}}]}) 210.065897ms ago: executing program 3 (id=2011): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="02c8"], 0x15) ioctl(r1, 0x40140921, &(0x7f0000000440)="02000000010000") pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) 30.003774ms ago: executing program 0 (id=2012): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0x2d, 0x80000000, 0x1}, 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000007008500000073"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 0s ago: executing program 1 (id=2013): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000340), 0x42101, 0x0) ioctl$SNAPSHOT_FREE(r0, 0x3305) kernel console output (not intermixed with test programs): 02][ T8360] loop0: detected capacity change from 0 to 512 [ 233.858761][ T8360] EXT4-fs: Ignoring removed oldalloc option [ 233.886342][ T8360] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 233.918720][ T8360] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=c802e02c, mo2=0002] [ 234.002296][ T8360] EXT4-fs (loop0): orphan cleanup on readonly fs [ 234.008790][ T8360] EXT4-fs error (device loop0): ext4_orphan_get:1435: comm syz.0.1326: bad orphan inode 267 [ 234.098186][ T8360] EXT4-fs (loop0): Remounting filesystem read-only [ 234.160982][ T8360] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 234.262356][ T8371] device-mapper: ioctl: name not supplied when creating device [ 234.833551][ T8386] loop1: detected capacity change from 0 to 512 [ 234.907193][ T8386] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 234.963324][ T8386] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e019, mo2=0002] [ 235.012473][ T8386] System zones: 1-12 [ 235.088489][ T8386] EXT4-fs error (device loop1): ext4_xattr_inode_iget:401: inode #12: comm syz.1.1332: missing EA_INODE flag [ 235.149115][ T8386] EXT4-fs error (device loop1): ext4_xattr_inode_iget:406: comm syz.1.1332: error while reading EA inode 12 err=-117 [ 235.230681][ T8386] EXT4-fs (loop1): 1 orphan inode deleted [ 235.240531][ T8386] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 236.260968][ T4365] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 236.428921][ T4274] EXT4-fs (loop0): unmounting filesystem. [ 236.531081][ T4365] usb 6-1: Using ep0 maxpacket: 32 [ 236.548813][ T4365] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 236.603562][ T4365] usb 6-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 236.632179][ T4365] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.661087][ T4365] usb 6-1: Product: syz [ 236.668099][ T4365] usb 6-1: Manufacturer: syz [ 236.668323][ T8399] loop0: detected capacity change from 0 to 512 [ 236.683254][ T4365] usb 6-1: SerialNumber: syz [ 236.709316][ T4365] usb 6-1: config 0 descriptor?? [ 236.744012][ T4365] usb 6-1: bad CDC descriptors [ 236.749562][ T8399] EXT4-fs: Ignoring removed oldalloc option [ 236.758744][ T4365] usb 6-1: unsupported MDLM descriptors [ 236.855808][ T8399] EXT4-fs (loop0): orphan cleanup on readonly fs [ 236.872645][ T8399] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -13 [ 236.913271][ T8399] EXT4-fs error (device loop0): ext4_clear_blocks:883: inode #13: comm syz.0.1333: attempt to clear invalid blocks 2 len 1 [ 236.999223][ T8399] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 237.026445][ T2170] usb 6-1: USB disconnect, device number 4 [ 237.050361][ T8399] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.1333: invalid indirect mapped block 1819239214 (level 0) [ 237.096410][ T8399] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.1333: invalid indirect mapped block 1819239214 (level 1) [ 237.138875][ T8399] EXT4-fs (loop0): 1 truncate cleaned up [ 237.157127][ T8399] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 237.387913][ T4274] EXT4-fs (loop0): unmounting filesystem. [ 238.337065][ T8435] loop5: detected capacity change from 0 to 1024 [ 238.385101][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 238.427020][ T8437] loop0: detected capacity change from 0 to 256 [ 238.456978][ T8437] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 238.478135][ T26] audit: type=1800 audit(1790430920.284:173): pid=8437 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1342" name="file1" dev="loop0" ino=1048635 res=0 errno=0 [ 238.566315][ T8442] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1343'. [ 238.623982][ T8435] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 238.672504][ T8435] EXT4-fs (loop5): orphan cleanup on readonly fs [ 238.758587][ T8435] Quota error (device loop5): v2_read_file_info: Can't read info structure [ 238.897050][ T8435] EXT4-fs warning (device loop5): ext4_enable_quotas:7093: Failed to enable quota tracking (type=0, err=-5, ino=3). Please run e2fsck to fix. [ 239.693944][ T8435] EXT4-fs (loop5): Cannot turn on quotas: error -5 [ 239.785145][ T8435] EXT4-fs (loop5): 1 truncate cleaned up [ 239.809503][ T8435] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 240.011347][ T8435] EXT4-fs error (device loop5): ext4_search_dir:1551: inode #2: block 16: comm syz.5.1341: bad entry in directory: inode out of bounds - offset=44, inode=40, rec_len=16, size=1024 fake=0 [ 240.119242][ T8459] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1346'. [ 240.187753][ T8459] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1346'. [ 240.259969][ T8459] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 240.269346][ T8459] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 240.278163][ T8459] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 240.287037][ T8459] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 240.342195][ T7216] EXT4-fs (loop5): unmounting filesystem. [ 240.363896][ T8459] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1346'. [ 240.374257][ T8459] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1346'. [ 240.804096][ T8466] tipc: Enabling of bearer rejected, failed to enable media [ 241.850226][ T4288] Bluetooth: hci2: link tx timeout [ 241.856053][ T4288] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 242.180159][ T8503] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1356'. [ 244.773476][ T8551] tipc: Enabling of bearer rejected, failed to enable media [ 245.739642][ T4288] Bluetooth: hci2: link tx timeout [ 245.744998][ T4288] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 245.913828][ T8585] page:ffffea0001e00000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 245.931113][ T8585] head:ffffea0001e00000 order:3 compound_mapcount:0 compound_pincount:0 [ 245.976479][ T8585] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 245.995742][ T8585] raw: 00fff00000010200 ffffea0000bf3a00 dead000000000002 ffff888017442140 [ 246.051171][ T8585] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 246.070552][ T8585] page dumped because: unmovable page [ 246.111080][ T8585] page_owner tracks the page as allocated [ 246.113947][ T8590] loop5: detected capacity change from 0 to 128 [ 246.128676][ T8585] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8282, tgid 8282 (cmp), ts 231383373370, free_ts 231108597895 [ 246.216007][ T8585] post_alloc_hook+0x173/0x1a0 [ 246.229773][ T8585] get_page_from_freelist+0x206b/0x2180 [ 246.256382][ T8585] __alloc_pages+0x1ec/0x4f0 [ 246.317028][ T8590] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 246.349162][ T8585] alloc_slab_page+0x5d/0x180 [ 246.361055][ T8590] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 246.382437][ T8585] new_slab+0x87/0x2d0 [ 246.397481][ T8585] ___slab_alloc+0xbc5/0x1240 [ 246.421010][ T8585] __kmem_cache_alloc_node+0x126/0x270 [ 246.464351][ T8585] __kmalloc+0xa3/0x240 [ 246.494223][ T8585] tomoyo_realpath_from_path+0xe2/0x5c0 [ 246.511027][ T8585] tomoyo_path_perm+0x26f/0x610 [ 246.521131][ T8585] security_inode_getattr+0xcf/0x120 [ 246.527138][ T8585] vfs_getattr+0x26/0x3a0 [ 246.540719][ T8585] __x64_sys_newfstat+0x13d/0x220 [ 246.551297][ T8585] do_syscall_64+0x4c/0xa0 [ 246.556152][ T8585] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 246.569551][ T8585] page last free stack trace: [ 246.575831][ T8585] free_unref_page_prepare+0x8e5/0x9e0 [ 246.586728][ T8585] free_unref_page+0x2e/0x3f0 [ 246.591676][ T8585] __unfreeze_partials+0x188/0x1e0 [ 246.611177][ T8585] put_cpu_partial+0x17c/0x250 [ 246.618423][ T8585] qlist_free_all+0x76/0xe0 [ 246.637159][ T8585] kasan_quarantine_reduce+0x144/0x160 [ 246.658352][ T8585] __kasan_slab_alloc+0x1e/0x80 [ 246.673075][ T8585] slab_post_alloc_hook+0x4b/0x490 [ 246.684256][ T8585] kmem_cache_alloc+0x18b/0x2f0 [ 246.696266][ T8585] getname_flags+0xb7/0x500 [ 246.706677][ T8585] do_sys_openat2+0xdd/0x4f0 [ 246.718227][ T8585] __x64_sys_openat+0x135/0x160 [ 246.730019][ T8585] do_syscall_64+0x4c/0xa0 [ 246.740459][ T8585] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 246.783307][ T7216] EXT4-fs (loop5): unmounting filesystem. [ 246.879473][ T4337] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 247.039299][ T8611] loop3: detected capacity change from 0 to 256 [ 247.083473][ T8611] FAT-fs (loop3): bogus logical sector size 11520 [ 247.089970][ T8611] FAT-fs (loop3): Can't find a valid FAT filesystem [ 247.196327][ T4288] Bluetooth: hci2: link tx timeout [ 247.201694][ T4288] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 247.324895][ T4288] Bluetooth: hci2: link tx timeout [ 247.330104][ T4288] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 247.636684][ T8641] tipc: Enabling of bearer rejected, failed to enable media [ 249.476439][ T8699] loop3: detected capacity change from 0 to 16 [ 249.522774][ T8699] erofs: (device loop3): mounted with root inode @ nid 36. [ 249.594770][ T8699] erofs: (device loop3): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 249.635017][ T8699] syz.3.1395: attempt to access beyond end of device [ 249.635017][ T8699] loop3: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 249.717315][ T8699] erofs: (device loop3): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 249.771077][ T8699] syz.3.1395: attempt to access beyond end of device [ 249.771077][ T8699] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 249.841932][ T8699] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -4055 in[4096, 0] out[8192] [ 249.881291][ T26] audit: type=1800 audit(1790430931.694:174): pid=8699 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1395" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 250.251021][ T4318] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 250.416560][ T8689] loop0: detected capacity change from 0 to 40427 [ 250.452556][ T4318] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 250.470634][ T8689] F2FS-fs (loop0): build fault injection attr: rate: 690, type: 0x3ffff [ 250.484977][ T4318] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 250.487908][ T8687] loop4: detected capacity change from 0 to 40427 [ 250.517765][ T8720] loop3: detected capacity change from 0 to 512 [ 250.522531][ T8689] F2FS-fs (loop0): invalid crc value [ 250.541017][ T4318] usb 2-1: New USB device found, idVendor=0925, idProduct=8066, bcdDevice= 0.00 [ 250.560326][ T8687] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 250.576479][ T8689] F2FS-fs (loop0): Found nat_bits in checkpoint [ 250.589505][ T4318] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.611918][ T8687] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 250.638099][ T8720] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 250.657034][ T4318] usb 2-1: config 0 descriptor?? [ 250.677259][ T8687] F2FS-fs (loop4): Unrecognized mount option "0xffffffffffffffff" or missing value [ 250.737527][ T8720] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 250.973943][ T8689] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 251.014444][ T8720] EXT4-fs (loop3): 1 truncate cleaned up [ 251.229693][ T8720] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 252.927664][ T4318] usbhid 2-1:0.0: can't add hid device: -71 [ 252.960122][ T4318] usbhid: probe of 2-1:0.0 failed with error -71 [ 253.041912][ T4318] usb 2-1: USB disconnect, device number 4 [ 253.222535][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 254.686803][ T8777] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 256.053086][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.059496][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.084273][ T8798] loop0: detected capacity change from 0 to 16 [ 256.109672][ T8798] erofs: (device loop0): mounted with root inode @ nid 36. [ 256.418134][ T8133] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.629069][ T8133] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.645028][ T8813] loop3: detected capacity change from 0 to 512 [ 256.788119][ T8133] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.087458][ T8133] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.542366][ T4279] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 257.552910][ T4279] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 257.561277][ T4279] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 257.569333][ T4279] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 257.577018][ T4279] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 257.585860][ T4279] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 258.281110][ T8813] loop3: detected capacity change from 0 to 40427 [ 258.316789][ T8813] F2FS-fs (loop3): invalid crc value [ 258.374570][ T8813] F2FS-fs (loop3): Found nat_bits in checkpoint [ 258.610267][ T8813] F2FS-fs (loop3): Start checkpoint disabled! [ 258.686735][ T8813] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 258.778237][ T8832] chnl_net:caif_netlink_parms(): no params data found [ 259.142985][ T8813] syz.3.1424: attempt to access beyond end of device [ 259.142985][ T8813] loop3: rw=2049, sector=49160, nr_sectors = 128 limit=40427 [ 259.399245][ T4300] kworker/u4:5: attempt to access beyond end of device [ 259.399245][ T4300] loop3: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 259.516420][ T8832] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.531215][ T8832] bridge0: port 1(bridge_slave_0) entered disabled state [ 259.552646][ T8832] device bridge_slave_0 entered promiscuous mode [ 259.579973][ T8878] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1437'. [ 259.601094][ T8878] netlink: 'syz.1.1437': attribute type 19 has an invalid length. [ 259.621186][ T8878] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1437'. [ 259.641575][ T8878] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1437'. [ 259.650676][ T8878] netlink: 'syz.1.1437': attribute type 19 has an invalid length. [ 259.651174][ T4288] Bluetooth: hci2: command 0x0409 tx timeout [ 259.671167][ T8878] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1437'. [ 259.702636][ T8832] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.709802][ T8832] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.795694][ T8832] device bridge_slave_1 entered promiscuous mode [ 259.944421][ T8887] loop4: detected capacity change from 0 to 512 [ 260.047240][ T8887] EXT4-fs error (device loop4): ext4_orphan_get:1409: inode #15: comm syz.4.1439: iget: bad i_size value: 38620345925642 [ 260.191497][ T8887] EXT4-fs error (device loop4): ext4_orphan_get:1414: comm syz.4.1439: couldn't read orphan inode 15 (err -117) [ 260.249493][ T8133] device hsr_slave_0 left promiscuous mode [ 260.261555][ T8133] device hsr_slave_1 left promiscuous mode [ 260.279398][ T8887] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 260.306840][ T8133] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 260.330961][ T8133] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 260.362304][ T8133] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 260.390427][ T8133] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 260.416663][ T8133] device bridge_slave_1 left promiscuous mode [ 260.461183][ T8133] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.507527][ T8901] loop3: detected capacity change from 0 to 128 [ 260.516484][ T8133] device bridge_slave_0 left promiscuous mode [ 260.532100][ T8133] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.583812][ T8901] FAT-fs (loop3): Directory bread(block 32) failed [ 260.596683][ T8170] EXT4-fs error (device loop4): ext4_validate_block_bitmap:429: comm kworker/u4:13: bg 0: block 5: invalid block bitmap [ 260.620953][ T8901] FAT-fs (loop3): Directory bread(block 33) failed [ 260.627635][ T8901] FAT-fs (loop3): Directory bread(block 34) failed [ 260.653814][ T8133] device veth1_macvtap left promiscuous mode [ 260.665850][ T8901] FAT-fs (loop3): Directory bread(block 35) failed [ 260.668398][ T8133] device veth0_macvtap left promiscuous mode [ 260.673084][ T8170] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 408 with error 28 [ 260.699441][ T8133] device veth1_vlan left promiscuous mode [ 260.710762][ T8901] FAT-fs (loop3): Directory bread(block 36) failed [ 260.724752][ T8133] device veth0_vlan left promiscuous mode [ 260.731037][ T8901] FAT-fs (loop3): Directory bread(block 37) failed [ 260.737702][ T8901] FAT-fs (loop3): Directory bread(block 38) failed [ 260.744653][ T8170] EXT4-fs (loop4): This should not happen!! Data will be lost [ 260.744653][ T8170] [ 260.772705][ T8170] EXT4-fs (loop4): Total free blocks count 0 [ 260.791368][ T8170] EXT4-fs (loop4): Free/Dirty block details [ 260.797363][ T8170] EXT4-fs (loop4): free_blocks=0 [ 260.803229][ T8901] FAT-fs (loop3): Directory bread(block 39) failed [ 260.809990][ T8901] FAT-fs (loop3): Directory bread(block 40) failed [ 260.840938][ T8170] EXT4-fs (loop4): dirty_blocks=412 [ 260.846222][ T8170] EXT4-fs (loop4): Block reservation details [ 260.871251][ T8901] FAT-fs (loop3): Directory bread(block 41) failed [ 260.878844][ T8170] EXT4-fs (loop4): i_reserved_data_blocks=412 [ 260.940223][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 261.731147][ T4288] Bluetooth: hci2: command 0x041b tx timeout [ 261.904800][ T8133] bond1 (unregistering): Released all slaves [ 262.706371][ T8133] team0 (unregistering): Port device team_slave_1 removed [ 262.763549][ T8133] team0 (unregistering): Port device team_slave_0 removed [ 262.795828][ T8938] loop0: detected capacity change from 0 to 40427 [ 262.831829][ T8938] F2FS-fs (loop0): invalid crc value [ 262.840291][ T8938] F2FS-fs (loop0): Found nat_bits in checkpoint [ 262.847893][ T8133] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 262.929142][ T8133] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 262.956243][ T8938] F2FS-fs (loop0): Start checkpoint disabled! [ 262.979946][ T8938] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 263.026140][ T26] audit: type=1800 audit(1790430944.834:175): pid=8938 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1447" name="file1" dev="loop0" ino=10 res=0 errno=0 [ 263.191120][ T4300] kworker/u4:5: attempt to access beyond end of device [ 263.191120][ T4300] loop0: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 263.577430][ T8133] bond0 (unregistering): Released all slaves [ 263.714411][ T8832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 263.815736][ T4279] Bluetooth: hci2: command 0x040f tx timeout [ 263.918688][ T8940] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1448'. [ 263.931076][ T8940] netlink: 'syz.3.1448': attribute type 19 has an invalid length. [ 263.948417][ T8940] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1448'. [ 264.003940][ T8953] loop4: detected capacity change from 0 to 256 [ 264.096186][ T8953] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0x4368f20e, utbl_chksum : 0xe619d30d) [ 265.660564][ T8964] loop4: detected capacity change from 0 to 256 [ 265.891023][ T4279] Bluetooth: hci2: command 0x0419 tx timeout [ 268.075145][ T8832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 268.108066][ T8940] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1448'. [ 268.121183][ T8940] netlink: 'syz.3.1448': attribute type 19 has an invalid length. [ 268.129061][ T8940] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1448'. [ 268.336792][ T8832] team0: Port device team_slave_0 added [ 268.383195][ T8981] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1460'. [ 268.413944][ T8832] team0: Port device team_slave_1 added [ 268.478104][ T8832] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 268.528809][ T8832] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 268.657623][ T8986] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 268.658214][ T8832] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 268.902526][ T8832] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 268.921002][ T8832] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 269.239019][ T8999] loop1: detected capacity change from 0 to 256 [ 269.261872][ T8999] FAT-fs (loop1): Unrecognized mount option "hash" or missing value [ 269.301379][ T26] audit: type=1326 audit(1790430950.824:176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 269.897468][ T8832] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 269.901685][ T26] audit: type=1326 audit(1790430950.834:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 270.069361][ T26] audit: type=1326 audit(1790430950.834:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=326 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 270.123137][ T8832] device hsr_slave_0 entered promiscuous mode [ 270.151700][ T8832] device hsr_slave_1 entered promiscuous mode [ 270.175235][ T8832] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 270.191173][ T8832] Cannot create hsr debugfs directory [ 270.230753][ T26] audit: type=1326 audit(1790430950.834:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 270.309972][ T26] audit: type=1326 audit(1790430950.834:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 270.352171][ T9017] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1470'. [ 270.381119][ T26] audit: type=1326 audit(1790430950.834:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 270.441358][ T26] audit: type=1326 audit(1790430950.844:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 270.465947][ T9017] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1470'. [ 270.570317][ T26] audit: type=1326 audit(1790430950.844:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 270.986534][ T26] audit: type=1326 audit(1790430950.844:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 271.501037][ T26] audit: type=1326 audit(1790430950.874:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8992 comm="syz.1.1464" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f083139e159 code=0x7ffc0000 [ 272.388290][ T9041] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1476'. [ 272.512285][ T9050] loop1: detected capacity change from 0 to 2048 [ 272.576313][ T9050] EXT4-fs: Ignoring removed orlov option [ 272.590777][ T9041] device bond2 entered promiscuous mode [ 272.685767][ T9050] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 272.713730][ T9050] ext4 filesystem being mounted at /333/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 273.016360][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 277.103216][ T9112] loop4: detected capacity change from 0 to 512 [ 277.231529][ T9112] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 277.390738][ T9112] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 277.441750][ T9112] ext4 filesystem being mounted at /295/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 277.673826][ T9131] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1489'. [ 277.779224][ T9137] device bond1 entered promiscuous mode [ 277.894341][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 277.902422][ T8832] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 277.911404][ T4340] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 277.958935][ T8832] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 278.158618][ T8832] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 278.214031][ T8832] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 278.604319][ T9161] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 278.700620][ T9161] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 278.759263][ T9161] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 279.032022][ T8832] 8021q: adding VLAN 0 to HW filter on device bond0 [ 279.122810][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 279.175766][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 279.194864][ T8832] 8021q: adding VLAN 0 to HW filter on device team0 [ 279.237816][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 279.263146][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 279.276536][ T4340] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.283777][ T4340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 279.310145][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 279.652274][ T9001] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 279.666593][ T9001] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 279.714390][ T9001] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.721727][ T9001] bridge0: port 2(bridge_slave_1) entered forwarding state [ 279.839688][ T26] kauditd_printk_skb: 41 callbacks suppressed [ 279.839830][ T26] audit: type=1326 audit(1790430961.564:227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.385331][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 280.435086][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 280.446106][ T26] audit: type=1326 audit(1790430961.564:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.514097][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 280.527646][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 280.552579][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 280.575708][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 280.604001][ T26] audit: type=1326 audit(1790430961.564:229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=326 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.626833][ T9193] loop4: detected capacity change from 0 to 256 [ 280.645989][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 280.664177][ T26] audit: type=1326 audit(1790430961.564:230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.675913][ T8832] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 280.702125][ T8832] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 280.711651][ T26] audit: type=1326 audit(1790430961.564:231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.743420][ T26] audit: type=1326 audit(1790430961.564:232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.776112][ T26] audit: type=1326 audit(1790430961.564:233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.821369][ T26] audit: type=1326 audit(1790430961.564:234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.844046][ T9198] device bond5 entered promiscuous mode [ 280.859363][ T26] audit: type=1326 audit(1790430961.574:235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.907691][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 280.926219][ T26] audit: type=1326 audit(1790430961.594:236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9187 comm="syz.4.1501" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe41cd9e159 code=0x7ffc0000 [ 280.931492][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 281.047287][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 281.064134][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 281.081485][ T9195] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1503'. [ 281.122535][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 281.350610][ T9212] tipc: Enabling of bearer rejected, failed to enable media [ 281.534618][ T9218] device syzkaller1 entered promiscuous mode [ 281.782251][ T9222] loop1: detected capacity change from 0 to 512 [ 281.935123][ T9222] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -2 [ 281.956375][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 281.978237][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 281.988449][ T9222] EXT4-fs error (device loop1): ext4_iget_extra_inode:4763: inode #15: comm syz.1.1511: corrupted in-inode xattr [ 282.004321][ T9222] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.1511: couldn't read orphan inode 15 (err -117) [ 282.017501][ T9222] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 282.020163][ T8832] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 282.105951][ T9222] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1511'. [ 282.273288][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 282.284322][ T9242] loop4: detected capacity change from 0 to 512 [ 282.495715][ T9246] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1518'. [ 282.612892][ T9246] device bond6 entered promiscuous mode [ 284.030210][ T9262] device syzkaller1 entered promiscuous mode [ 284.198669][ T9269] loop4: detected capacity change from 0 to 512 [ 284.210738][ T9269] EXT4-fs: Ignoring removed i_version option [ 284.216923][ T9269] EXT4-fs: Ignoring removed oldalloc option [ 287.178930][ T9269] EXT4-fs: failed to create workqueue [ 287.184728][ T9269] EXT4-fs (loop4): mount failed [ 287.739707][ T9280] loop1: detected capacity change from 0 to 512 [ 287.788699][ T9280] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 288.324377][ T9280] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 288.483685][ T9280] ext4 filesystem being mounted at /342/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 289.565723][ T9301] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1532'. [ 289.718374][ T9305] device bond2 entered promiscuous mode [ 289.822769][ T9298] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 289.859630][ T9298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 289.876794][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 289.986194][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 290.028920][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 290.069650][ T8832] device veth0_vlan entered promiscuous mode [ 290.089088][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 290.129225][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 290.172439][ T8832] device veth1_vlan entered promiscuous mode [ 290.328203][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 290.347521][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 290.392048][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 290.419229][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 290.474941][ T8832] device veth0_macvtap entered promiscuous mode [ 290.529143][ T8832] device veth1_macvtap entered promiscuous mode [ 290.627000][ T8832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 290.652481][ T8832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 290.679827][ T9314] loop3: detected capacity change from 0 to 1024 [ 290.703651][ T8832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 290.713306][ T9314] journal_path: Lookup failure for './file0' [ 290.730921][ T8832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 290.750910][ T8832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 290.759973][ T9314] EXT4-fs: error: could not find journal device path [ 290.795649][ T8832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 290.827307][ T8832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 290.854413][ T8832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 290.903007][ T8832] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 290.922479][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 290.941317][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 290.954948][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 290.974214][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 291.009559][ T8832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 291.041235][ T8832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 291.060974][ T8832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 291.080891][ T8832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 291.090745][ T8832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 291.108868][ T8832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 291.121064][ T8832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 291.210973][ T8832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 292.063680][ T8832] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 292.147439][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 292.165178][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 292.217418][ T8832] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.238243][ T8832] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.240705][ T9336] loop1: detected capacity change from 0 to 128 [ 292.255219][ T8832] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.302164][ T8832] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.331701][ T9336] FAT-fs (loop1): Directory bread(block 32) failed [ 292.338344][ T9336] FAT-fs (loop1): Directory bread(block 33) failed [ 292.376249][ T9336] FAT-fs (loop1): Directory bread(block 34) failed [ 292.436217][ T9336] FAT-fs (loop1): Directory bread(block 35) failed [ 292.464528][ T9336] FAT-fs (loop1): Directory bread(block 36) failed [ 292.484324][ T9336] FAT-fs (loop1): Directory bread(block 37) failed [ 292.511531][ T9336] FAT-fs (loop1): Directory bread(block 38) failed [ 292.535708][ T9336] FAT-fs (loop1): Directory bread(block 39) failed [ 292.578831][ T9336] FAT-fs (loop1): Directory bread(block 40) failed [ 292.587627][ T9336] FAT-fs (loop1): Directory bread(block 41) failed [ 292.618442][ T9298] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 292.678315][ T9298] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 292.720937][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 292.752025][ T7282] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 292.809999][ T7282] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 292.882326][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 292.930099][ T9345] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1544'. [ 292.978743][ T9345] device bond3 entered promiscuous mode [ 293.160621][ T9352] loop3: detected capacity change from 0 to 512 [ 293.186402][ T9352] EXT4-fs: Ignoring removed oldalloc option [ 293.202837][ T9352] EXT4-fs (loop3): orphan cleanup on readonly fs [ 293.219777][ T9352] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -13 [ 293.256919][ T9352] EXT4-fs error (device loop3): ext4_clear_blocks:883: inode #13: comm syz.3.1545: attempt to clear invalid blocks 2 len 1 [ 293.276119][ T9352] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 293.295746][ T9352] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.1545: invalid indirect mapped block 1819239214 (level 0) [ 293.311874][ T9352] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.1545: invalid indirect mapped block 1819239214 (level 1) [ 293.328439][ T9352] EXT4-fs (loop3): 1 truncate cleaned up [ 293.341598][ T9352] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 293.407501][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 293.782436][ T9364] loop0: detected capacity change from 0 to 2048 [ 293.853449][ T9364] loop0: p1 p2 p3 < > p4 < p5 p6 > [ 293.858983][ T9364] loop0: partition table partially beyond EOD, truncated [ 293.921397][ T9364] loop0: p1 start 3405774849 is beyond EOD, truncated [ 293.956112][ T9364] loop0: p2 start 53543428 is beyond EOD, truncated [ 294.295021][ T9364] loop0: p3 start 4284289 is beyond EOD, truncated [ 294.748846][ T9364] loop0: p5 start 3405774849 is beyond EOD, truncated [ 294.844439][ T9364] loop0: p6 start 53543428 is beyond EOD, truncated [ 294.889250][ T9377] device syzkaller1 entered promiscuous mode [ 295.109696][ T9384] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1556'. [ 295.130339][ T9386] loop4: detected capacity change from 0 to 256 [ 295.243501][ T26] kauditd_printk_skb: 13 callbacks suppressed [ 295.243519][ T26] audit: type=1326 audit(1790430977.054:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9389 comm="syz.5.1558" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a2d19e159 code=0x7ffc0000 [ 295.251087][ T9390] device bond3 entered promiscuous mode [ 295.274620][ T26] audit: type=1326 audit(1790430977.054:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9389 comm="syz.5.1558" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a2d19e159 code=0x7ffc0000 [ 295.304515][ T26] audit: type=1326 audit(1790430977.084:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9389 comm="syz.5.1558" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=192 compat=0 ip=0x7f9a2d19e159 code=0x7ffc0000 [ 295.329643][ T26] audit: type=1326 audit(1790430977.084:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9389 comm="syz.5.1558" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a2d19e159 code=0x7ffc0000 [ 295.364374][ T9392] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1559'. [ 295.364415][ T26] audit: type=1326 audit(1790430977.084:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9389 comm="syz.5.1558" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a2d19e159 code=0x7ffc0000 [ 295.470966][ T4317] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 295.659548][ T9397] loop5: detected capacity change from 0 to 128 [ 295.674195][ T4317] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 295.683219][ T9399] loop1: detected capacity change from 0 to 1024 [ 295.690936][ T4317] usb 5-1: config 0 has no interfaces? [ 295.690977][ T4317] usb 5-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 295.691002][ T4317] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.698927][ T4317] usb 5-1: config 0 descriptor?? [ 295.756714][ T9399] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 295.792961][ T9397] FAT-fs (loop5): Directory bread(block 32) failed [ 295.816882][ T9397] FAT-fs (loop5): Directory bread(block 33) failed [ 295.847617][ T9397] FAT-fs (loop5): Directory bread(block 34) failed [ 295.855795][ T9399] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 295.883761][ T9397] FAT-fs (loop5): Directory bread(block 35) failed [ 295.904485][ T9397] FAT-fs (loop5): Directory bread(block 36) failed [ 295.920135][ T9397] FAT-fs (loop5): Directory bread(block 37) failed [ 295.930158][ T9399] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=6055c01c, mo2=0002] [ 295.950501][ T9399] System zones: 0-1, 3-36 [ 295.976539][ T9330] usb 5-1: USB disconnect, device number 4 [ 296.007137][ T9397] FAT-fs (loop5): Directory bread(block 38) failed [ 296.031071][ T9399] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 296.041781][ T9381] loop3: detected capacity change from 0 to 40427 [ 296.048437][ T9397] FAT-fs (loop5): Directory bread(block 39) failed [ 296.081563][ T9381] F2FS-fs (loop3): invalid crc value [ 296.097889][ T9397] FAT-fs (loop5): Directory bread(block 40) failed [ 296.115742][ T9381] F2FS-fs (loop3): Found nat_bits in checkpoint [ 296.146093][ T9397] FAT-fs (loop5): Directory bread(block 41) failed [ 296.232912][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 296.244510][ T9381] F2FS-fs (loop3): Start checkpoint disabled! [ 296.311081][ T9381] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 298.243368][ T9422] syz.4.1567 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 298.355181][ T9422] loop4: detected capacity change from 0 to 256 [ 298.370351][ T9426] device syzkaller1 entered promiscuous mode [ 298.594945][ T9429] loop5: detected capacity change from 0 to 16 [ 298.735543][ T9429] erofs: (device loop5): mounted with root inode @ nid 36. [ 298.751465][ T9431] loop3: detected capacity change from 0 to 512 [ 298.805063][ T9433] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1572'. [ 298.862694][ T9431] EXT4-fs error (device loop3): ext4_orphan_get:1409: inode #15: comm syz.3.1571: inode has both inline data and extents flags [ 298.975965][ T9431] EXT4-fs error (device loop3): ext4_orphan_get:1414: comm syz.3.1571: couldn't read orphan inode 15 (err -117) [ 299.041491][ T9442] device bond4 entered promiscuous mode [ 299.055933][ T9431] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 299.153253][ T9437] loop0: detected capacity change from 0 to 16 [ 299.191655][ T9437] erofs: (device loop0): mounted with root inode @ nid 36. [ 299.339777][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 301.343641][ T9463] loop3: detected capacity change from 0 to 128 [ 301.739649][ T9463] FAT-fs (loop3): Directory bread(block 32) failed [ 301.865207][ T9463] FAT-fs (loop3): Directory bread(block 33) failed [ 301.928572][ T9463] FAT-fs (loop3): Directory bread(block 34) failed [ 301.955042][ T9463] FAT-fs (loop3): Directory bread(block 35) failed [ 302.001360][ T9463] FAT-fs (loop3): Directory bread(block 36) failed [ 302.030957][ T9463] FAT-fs (loop3): Directory bread(block 37) failed [ 302.037670][ T9463] FAT-fs (loop3): Directory bread(block 38) failed [ 302.066466][ T9468] loop4: detected capacity change from 0 to 1024 [ 302.099095][ T9463] FAT-fs (loop3): Directory bread(block 39) failed [ 302.114455][ T9468] journal_path: Lookup failure for './file0' [ 302.121945][ T9470] device syzkaller1 entered promiscuous mode [ 302.122050][ T9463] FAT-fs (loop3): Directory bread(block 40) failed [ 302.137054][ T9468] EXT4-fs: error: could not find journal device path [ 302.157556][ T9463] FAT-fs (loop3): Directory bread(block 41) failed [ 302.268085][ T9475] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1585'. [ 302.537902][ T9478] loop0: detected capacity change from 0 to 256 [ 302.612955][ T9478] exFAT-fs (loop0): failed to load upcase table (idx : 0x00011a39, chksum : 0xd7c18d7b, utbl_chksum : 0xe619d30d) [ 303.038771][ T126] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 303.780783][ T9489] loop1: detected capacity change from 0 to 512 [ 303.824410][ T126] usb 6-1: unable to get BOS descriptor or descriptor too short [ 303.834821][ T126] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 303.845216][ T126] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 303.860946][ T126] usb 6-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 303.889331][ T126] usb 6-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 303.909179][ T126] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 303.928743][ T126] usb 6-1: config 1 interface 1 has no altsetting 0 [ 303.941616][ T126] usb 6-1: string descriptor 0 read error: -22 [ 303.948190][ T126] usb 6-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 303.964317][ T126] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.082370][ T9489] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -2 [ 304.176696][ T9489] EXT4-fs error (device loop1): ext4_iget_extra_inode:4763: inode #15: comm syz.1.1590: corrupted in-inode xattr [ 304.476566][ T9489] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.1590: couldn't read orphan inode 15 (err -117) [ 304.644076][ T9500] loop5: detected capacity change from 0 to 256 [ 304.683812][ T9500] FAT-fs (loop5): Unrecognized mount option "sh‚rtname=winnt" or missing value [ 304.723296][ T9489] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 304.824122][ T4288] Bluetooth: hci4: command 0x0406 tx timeout [ 304.899726][ T9502] loop4: detected capacity change from 0 to 2048 [ 304.967963][ T9502] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 304.993842][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 305.052181][ T126] usb 6-1: 2:0: cannot get min/max values for control 2 (id 2) [ 305.075584][ T9508] device syzkaller1 entered promiscuous mode [ 305.116554][ T126] usb 6-1: 2:0: cannot get min/max values for control 2 (id 2) [ 305.163844][ T126] usb 6-1: 2:0: cannot get min/max values for control 2 (id 2) [ 305.212998][ T126] usb 6-1: USB disconnect, device number 5 [ 305.253755][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 305.297497][ T9511] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1597'. [ 305.371374][ T9516] device bond7 entered promiscuous mode [ 305.483657][ T9520] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1600'. [ 305.541527][ T9520] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1600'. [ 305.617149][ T9522] loop4: detected capacity change from 0 to 128 [ 305.665430][ T9522] FAT-fs (loop4): Directory bread(block 32) failed [ 305.687375][ T9522] FAT-fs (loop4): Directory bread(block 33) failed [ 305.727643][ T9522] FAT-fs (loop4): Directory bread(block 34) failed [ 306.011400][ T9522] FAT-fs (loop4): Directory bread(block 35) failed [ 306.048656][ T9522] FAT-fs (loop4): Directory bread(block 36) failed [ 306.206329][ T9522] FAT-fs (loop4): Directory bread(block 37) failed [ 306.316498][ T9522] FAT-fs (loop4): Directory bread(block 38) failed [ 306.423788][ T9522] FAT-fs (loop4): Directory bread(block 39) failed [ 306.436838][ T9533] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1604'. [ 306.599720][ T9522] FAT-fs (loop4): Directory bread(block 40) failed [ 306.620173][ T9533] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1604'. [ 306.650658][ T9522] FAT-fs (loop4): Directory bread(block 41) failed [ 306.666039][ T9533] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1604'. [ 306.721607][ T9533] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1604'. [ 306.756751][ T9533] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1604'. [ 306.781387][ T9533] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1604'. [ 306.802988][ T9533] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 306.813450][ T9533] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 306.822338][ T9533] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 307.975352][ T9548] device syzkaller1 entered promiscuous mode [ 308.213356][ T9554] __nla_validate_parse: 141 callbacks suppressed [ 308.213443][ T9554] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1614'. [ 308.501889][ T9560] loop5: detected capacity change from 0 to 512 [ 308.503767][ T9558] loop3: detected capacity change from 0 to 512 [ 308.565257][ T9560] EXT4-fs: Ignoring removed oldalloc option [ 308.588234][ T9558] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 308.609555][ T9560] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 308.620673][ T9558] EXT4-fs error (device loop3): ext4_iget_extra_inode:4763: inode #15: comm syz.3.1616: corrupted in-inode xattr [ 308.671877][ T9560] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=c802e02c, mo2=0002] [ 308.717074][ T9558] EXT4-fs error (device loop3): ext4_orphan_get:1414: comm syz.3.1616: couldn't read orphan inode 15 (err -117) [ 308.800714][ T9560] EXT4-fs (loop5): orphan cleanup on readonly fs [ 308.881400][ T9560] EXT4-fs error (device loop5): ext4_orphan_get:1435: comm syz.5.1618: bad orphan inode 267 [ 308.941554][ T9558] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 309.097255][ T7282] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 309.354554][ T9560] EXT4-fs (loop5): Remounting filesystem read-only [ 309.423936][ T9558] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1616'. [ 309.487904][ T9560] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 309.724341][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 310.084477][ T9550] loop1: detected capacity change from 0 to 40427 [ 310.156237][ T9550] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 310.178271][ T9550] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 310.225383][ T9550] F2FS-fs (loop1): invalid crc value [ 310.352390][ T9579] EXT4-fs warning (device loop5): dx_probe:893: inode #2: comm syz.5.1618: dx entry: limit 0 != root limit 125 [ 310.364955][ T9579] EXT4-fs warning (device loop5): dx_probe:966: inode #2: comm syz.5.1618: Corrupt directory, running e2fsck is recommended [ 310.967167][ T9550] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 311.226047][ T9556] loop0: detected capacity change from 0 to 40427 [ 311.493427][ T9556] F2FS-fs (loop0): Invalid SB checksum offset: 0 [ 312.255750][ T9556] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock [ 312.518907][ T9556] F2FS-fs (loop0): invalid crc value [ 312.538320][ T9556] F2FS-fs (loop0): Failed to start F2FS issue_checkpoint_thread (-12) [ 312.959188][ T9600] loop4: detected capacity change from 0 to 1024 [ 313.008836][ T9600] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 313.063902][ T9600] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 313.123404][ T9600] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 313.152088][ T9600] System zones: 0-1, 3-36 [ 313.212924][ T9600] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 313.325339][ T9608] device syzkaller1 entered promiscuous mode [ 313.390571][ T26] audit: type=1800 audit(1790430995.164:255): pid=9600 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1623" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 313.414841][ T9610] loop0: detected capacity change from 0 to 128 [ 313.433033][ T8832] EXT4-fs (loop5): unmounting filesystem. [ 313.502067][ T9610] FAT-fs (loop0): Directory bread(block 32) failed [ 313.537838][ T9610] FAT-fs (loop0): Directory bread(block 33) failed [ 313.589453][ T9610] FAT-fs (loop0): Directory bread(block 34) failed [ 313.634220][ T9610] FAT-fs (loop0): Directory bread(block 35) failed [ 313.650003][ T9610] FAT-fs (loop0): Directory bread(block 36) failed [ 313.672495][ T9615] binder: 9613:9615 ioctl c0306201 0 returned -14 [ 313.689182][ T9610] FAT-fs (loop0): Directory bread(block 37) failed [ 313.703251][ T9614] binder: 9613:9614 ioctl c0306201 0 returned -14 [ 313.720765][ T9610] FAT-fs (loop0): Directory bread(block 38) failed [ 313.760167][ T9610] FAT-fs (loop0): Directory bread(block 39) failed [ 313.787023][ T9610] FAT-fs (loop0): Directory bread(block 40) failed [ 313.836820][ T9610] FAT-fs (loop0): Directory bread(block 41) failed [ 315.265127][ T9642] loop1: detected capacity change from 0 to 512 [ 315.408493][ T9642] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 315.428899][ T9642] ext4 filesystem being mounted at /360/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 316.332114][ T9642] EXT4-fs error (device loop1): ext4_get_first_dir_block:3585: inode #12: comm syz.1.1633: Attempting to read directory block (0) that is past i_size (3) [ 316.657783][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 316.796893][ T9658] binder: 9657:9658 unknown command 1074553619 [ 316.836931][ T9658] binder: 9657:9658 ioctl c0306201 200000000040 returned -22 [ 316.872880][ T9665] binder: 9657:9665 unknown command 1074553620 [ 316.881251][ T9665] binder: 9657:9665 ioctl c0306201 200000000640 returned -22 [ 316.896926][ T9664] device syzkaller1 entered promiscuous mode [ 317.271077][ T4317] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 317.512173][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.519278][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.608351][ T4317] usb 2-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 317.781517][ T4317] usb 2-1: config 0 interface 0 has no altsetting 0 [ 317.963168][ T4317] usb 2-1: New USB device found, idVendor=1e7d, idProduct=3264, bcdDevice= 0.00 [ 318.031562][ T4317] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.080311][ T4317] usb 2-1: config 0 descriptor?? [ 318.477568][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 318.722813][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.731859][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.738949][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.752474][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.760246][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.767827][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.787941][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.805820][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.816567][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.830981][ T4317] isku 0003:1E7D:3264.0002: unknown main item tag 0x0 [ 318.848556][ T4317] isku 0003:1E7D:3264.0002: unbalanced collection at end of report description [ 318.869031][ T4317] isku 0003:1E7D:3264.0002: parse failed [ 318.885460][ T4317] isku: probe of 0003:1E7D:3264.0002 failed with error -22 [ 318.910576][ T4317] usb 2-1: USB disconnect, device number 5 [ 319.398718][ T9330] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 319.620717][ T9330] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 319.715228][ T9330] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 319.935807][ T9330] usb 5-1: New USB device found, idVendor=0d49, idProduct=7000, bcdDevice= 0.01 [ 320.223968][ T9330] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.263722][ T9330] usb 5-1: Product: syz [ 320.481025][ T9330] usb 5-1: Manufacturer: syz [ 320.486341][ T9330] usb 5-1: SerialNumber: syz [ 320.784477][ T9674] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 320.846651][ T9330] usb 5-1: USB disconnect, device number 5 [ 323.314623][ T9744] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 323.323170][ T9744] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 323.351995][ T9744] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 323.681336][ T4320] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 324.221009][ T4320] usb 2-1: Using ep0 maxpacket: 16 [ 324.233511][ T4320] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 324.285880][ T4320] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 324.434222][ T9752] loop3: detected capacity change from 0 to 512 [ 324.498775][ T4320] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 324.513449][ T9752] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 324.521245][ T4320] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 324.529960][ T4320] usb 2-1: SerialNumber: syz [ 324.550662][ T9752] System zones: 1-12 [ 324.574464][ T4320] usb 2-1: 0:2 : does not exist [ 324.613190][ T9752] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #12: comm syz.3.1663: missing EA_INODE flag [ 324.652415][ T9752] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.1663: error while reading EA inode 12 err=-117 [ 324.699668][ T9752] EXT4-fs (loop3): 1 orphan inode deleted [ 324.711895][ T9752] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 324.764755][ T9757] loop0: detected capacity change from 0 to 8192 [ 325.257410][ T4320] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 325.612982][ T4320] usb 2-1: USB disconnect, device number 6 [ 326.578715][ T9782] loop4: detected capacity change from 0 to 512 [ 327.444427][ T9782] EXT4-fs error (device loop4): ext4_do_update_inode:5279: inode #15: comm syz.4.1669: corrupted inode contents [ 327.544949][ T9782] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 327.609316][ T9782] EXT4-fs error (device loop4): ext4_do_update_inode:5279: inode #15: comm syz.4.1669: corrupted inode contents [ 327.640957][ T9782] EXT4-fs error (device loop4): ext4_evict_inode:329: inode #15: comm syz.4.1669: mark_inode_dirty error [ 327.684829][ T9782] EXT4-fs (loop4): 1 orphan inode deleted [ 327.710566][ T9782] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 328.331178][ T33] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 328.487613][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 328.523083][ T33] usb 6-1: config 0 interface 0 altsetting 129 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 328.556958][ T33] usb 6-1: config 0 interface 0 has no altsetting 0 [ 328.581215][ T33] usb 6-1: New USB device found, idVendor=056a, idProduct=00ed, bcdDevice= 0.00 [ 328.611327][ T33] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 328.638756][ T33] usb 6-1: config 0 descriptor?? [ 328.752714][ T9810] loop1: detected capacity change from 0 to 512 [ 328.795760][ T9810] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 328.826446][ T9812] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1677'. [ 328.848295][ T9810] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e019, mo2=0002] [ 328.866505][ T9810] System zones: 1-12 [ 328.873471][ T9810] EXT4-fs error (device loop1): ext4_xattr_inode_iget:401: inode #12: comm syz.1.1678: missing EA_INODE flag [ 328.902010][ T9810] EXT4-fs error (device loop1): ext4_xattr_inode_iget:406: comm syz.1.1678: error while reading EA inode 12 err=-117 [ 328.961160][ T9810] EXT4-fs (loop1): 1 orphan inode deleted [ 328.978318][ T9810] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 329.503807][ T33] usbhid 6-1:0.0: can't add hid device: -71 [ 329.534038][ T33] usbhid: probe of 6-1:0.0 failed with error -71 [ 329.553095][ T9824] device syzkaller1 entered promiscuous mode [ 329.662656][ T33] usb 6-1: USB disconnect, device number 6 [ 329.907891][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 332.561350][ T9861] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1691'. [ 332.618517][ T9858] loop4: detected capacity change from 0 to 2048 [ 332.663283][ T9858] loop4: p1 p2 p3 < > p4 < p5 p6 > [ 332.668665][ T9858] loop4: partition table partially beyond EOD, truncated [ 332.717155][ T9858] loop4: p1 start 3405774849 is beyond EOD, truncated [ 332.731009][ T9858] loop4: p2 start 53543428 is beyond EOD, truncated [ 332.741089][ T9858] loop4: p3 start 4284289 is beyond EOD, truncated [ 332.757865][ T9858] loop4: p5 start 3405774849 is beyond EOD, truncated [ 332.776133][ T9858] loop4: p6 start 53543428 is beyond EOD, truncated [ 333.006666][ T9867] loop5: detected capacity change from 0 to 512 [ 333.052899][ T9867] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 333.098633][ T9867] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 333.117190][ T9867] System zones: 1-12 [ 333.133408][ T9867] EXT4-fs error (device loop5): ext4_orphan_get:1435: comm syz.5.1693: bad orphan inode 131072 [ 333.233765][ T9871] device syzkaller1 entered promiscuous mode [ 333.243461][ T9867] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 333.425090][ T8832] EXT4-fs (loop5): unmounting filesystem. [ 333.484422][ T9845] loop1: detected capacity change from 0 to 40427 [ 333.552483][ T9845] F2FS-fs (loop1): invalid crc value [ 333.619704][ T9845] F2FS-fs (loop1): Found nat_bits in checkpoint [ 334.568802][ T9845] F2FS-fs (loop1): Start checkpoint disabled! [ 334.644602][ T9879] loop4: detected capacity change from 0 to 512 [ 334.785268][ T9879] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -2 [ 334.851170][ T9879] EXT4-fs error (device loop4): ext4_iget_extra_inode:4763: inode #15: comm syz.4.1696: corrupted in-inode xattr [ 334.916002][ T9879] EXT4-fs error (device loop4): ext4_orphan_get:1414: comm syz.4.1696: couldn't read orphan inode 15 (err -117) [ 334.998581][ T9879] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 335.409206][ T9855] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 335.540658][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 335.768219][ T9898] loop4: detected capacity change from 0 to 2048 [ 335.841868][ T9898] loop4: p3 < > p4 < > [ 335.846344][ T9898] loop4: partition table partially beyond EOD, truncated [ 335.876684][ T9902] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1703'. [ 335.886838][ T9898] loop4: p3 start 4284289 is beyond EOD, truncated [ 336.035718][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 336.274190][ T9908] device syzkaller1 entered promiscuous mode [ 336.302977][ T6507] udevd[6507]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 337.315711][ T26] audit: type=1800 audit(1790431019.124:256): pid=9917 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1702" name="file1" dev="sda1" ino=2052 res=0 errno=0 [ 337.539218][ T9927] loop4: detected capacity change from 0 to 16 [ 337.621876][ T9927] erofs: (device loop4): mounted with root inode @ nid 36. [ 337.899750][ T9933] loop1: detected capacity change from 0 to 1024 [ 337.942256][ T9933] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 338.015355][ T9933] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 338.232823][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 338.275150][ T9941] loop0: detected capacity change from 0 to 256 [ 338.486573][ T9943] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1717'. [ 338.578770][ T9909] loop3: detected capacity change from 0 to 40427 [ 338.606443][ T9909] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 338.614589][ T33] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 338.642313][ T9909] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 338.671917][ T9909] F2FS-fs (loop3): invalid crc value [ 338.719090][ T9909] F2FS-fs (loop3): Found nat_bits in checkpoint [ 338.802916][ T33] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 338.851050][ T33] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.893741][ T33] usb 1-1: config 0 descriptor?? [ 338.934304][ T9909] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 338.960922][ T9909] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 339.104908][ T33] usb 1-1: Cannot read MAC address [ 339.110256][ T33] MOSCHIP usb-ethernet driver: probe of 1-1:0.0 failed with error -71 [ 339.162184][ T33] usb 1-1: USB disconnect, device number 2 [ 339.227467][ T9955] loop1: detected capacity change from 0 to 256 [ 339.281660][ T9955] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 339.325848][ T9955] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 339.396699][ T9955] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 339.420689][ T9955] exFAT-fs (loop1): failed to load alloc-bitmap [ 339.427785][ T9955] exFAT-fs (loop1): failed to recognize exfat type [ 339.559914][ T9959] device syzkaller1 entered promiscuous mode [ 339.808615][ T9961] loop1: detected capacity change from 0 to 1024 [ 339.872412][ T9961] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 340.039728][ T9961] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 340.202996][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 340.366805][ T5191] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 340.517438][ T9983] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1728'. [ 341.413475][ T14] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 341.583164][ T9991] device-mapper: table: 248:0: multipath: not enough priority group arguments (-EINVAL) [ 341.595062][ T9991] device-mapper: ioctl: error adding target to table [ 341.622384][ T26] audit: type=1326 audit(1790431023.434:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9993 comm="syz.0.1732" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 341.692307][ T26] audit: type=1326 audit(1790431023.434:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9993 comm="syz.0.1732" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=20 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 341.747435][ T26] audit: type=1326 audit(1790431023.434:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9993 comm="syz.0.1732" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 341.778510][T10003] device syzkaller1 entered promiscuous mode [ 341.799510][ T26] audit: type=1326 audit(1790431023.434:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9993 comm="syz.0.1732" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 341.859496][T10006] netlink: 'syz.0.1735': attribute type 9 has an invalid length. [ 342.508456][T10023] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1745'. [ 342.648056][T10027] loop3: detected capacity change from 0 to 256 [ 342.665885][T10027] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 342.696237][ T26] audit: type=1800 audit(1790431024.504:261): pid=10027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1746" name="file1" dev="loop3" ino=1048695 res=0 errno=0 [ 342.972911][ T9966] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 346.206417][T10059] loop3: detected capacity change from 0 to 256 [ 346.369487][T10065] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1758'. [ 346.801110][ T26] audit: type=1326 audit(1790431028.514:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 348.520895][ T26] audit: type=1326 audit(1790431028.514:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 348.647649][T10084] loop0: detected capacity change from 0 to 512 [ 348.843518][ T26] audit: type=1326 audit(1790431028.514:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=326 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 348.873222][ T26] audit: type=1326 audit(1790431028.514:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 349.302907][ T26] audit: type=1326 audit(1790431028.514:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 349.542431][ T26] audit: type=1326 audit(1790431028.514:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 349.640071][ T26] audit: type=1326 audit(1790431028.524:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 349.669096][ T26] audit: type=1326 audit(1790431028.524:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 349.751373][ T26] audit: type=1326 audit(1790431028.524:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 349.932167][ T26] audit: type=1326 audit(1790431028.544:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 350.040716][T10084] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 350.060965][ T26] audit: type=1326 audit(1790431028.544:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10062 comm="syz.0.1757" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f814339e159 code=0x7ffc0000 [ 350.106022][T10084] ext4 filesystem being mounted at /367/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 350.712995][ T4274] EXT4-fs (loop0): unmounting filesystem. [ 352.532305][T10115] loop4: detected capacity change from 0 to 512 [ 352.539819][T10115] EXT4-fs: Ignoring removed oldalloc option [ 352.587512][T10115] EXT4-fs (loop4): orphan cleanup on readonly fs [ 352.601264][T10115] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -13 [ 352.700934][ T14] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 353.409307][T10115] EXT4-fs error (device loop4): ext4_clear_blocks:883: inode #13: comm syz.4.1770: attempt to clear invalid blocks 2 len 1 [ 353.535325][T10115] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 353.586150][T10115] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.1770: invalid indirect mapped block 1819239214 (level 0) [ 353.632134][T10115] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.1770: invalid indirect mapped block 1819239214 (level 1) [ 353.661263][T10115] EXT4-fs (loop4): 1 truncate cleaned up [ 353.667385][T10115] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 353.762381][T10125] loop0: detected capacity change from 0 to 256 [ 353.778895][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 353.788384][T10125] exfat: Deprecated parameter 'namecase' [ 353.805535][ T14] usb 2-1: Using ep0 maxpacket: 8 [ 353.820203][ T14] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 353.837231][ T14] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 353.847892][T10125] exfat: Deprecated parameter 'namecase' [ 353.868145][T10125] exfat: Deprecated parameter 'namecase' [ 353.874994][ T14] usb 2-1: New USB device found, idVendor=0e41, idProduct=4249, bcdDevice= 0.40 [ 353.890994][ T14] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 353.949358][T10125] exFAT-fs (loop0): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 353.970494][ T14] usb 2-1: Product: syz [ 353.977669][ T14] usb 2-1: Manufacturer: syz [ 353.990183][ T14] usb 2-1: SerialNumber: syz [ 354.177263][T10131] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1776'. [ 354.197442][T10127] loop4: detected capacity change from 0 to 16 [ 354.210364][T10127] erofs: (device loop4): mounted with root inode @ nid 36. [ 354.245299][ T14] usb 2-1: unit 6 not found! [ 354.268673][T10133] loop0: detected capacity change from 0 to 512 [ 354.331836][ T14] usb 2-1: USB disconnect, device number 7 [ 354.387622][T10133] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 354.451120][T10133] ext4 filesystem being mounted at /371/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 354.523006][T10145] loop3: detected capacity change from 0 to 128 [ 354.599617][T10145] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 354.623618][ T4352] udevd[4352]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 354.676381][T10145] ext4 filesystem being mounted at /323/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 354.995092][ T4274] EXT4-fs (loop0): unmounting filesystem. [ 357.140599][T10176] loop5: detected capacity change from 0 to 256 [ 357.194677][T10178] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1790'. [ 357.206877][ T26] kauditd_printk_skb: 9 callbacks suppressed [ 357.206892][ T26] audit: type=1800 audit(1790431039.014:282): pid=10176 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1789" name="file1" dev="loop5" ino=1048696 res=0 errno=0 [ 357.355192][T10178] 8021q: adding VLAN 0 to HW filter on device bond5 [ 357.494877][T10180] bond5: (slave veth3): Enslaving as an active interface with an up link [ 357.808180][T10189] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1794'. [ 357.821404][T10189] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1794'. [ 357.833073][T10185] loop1: detected capacity change from 0 to 512 [ 357.848923][T10187] loop4: detected capacity change from 0 to 512 [ 357.880698][T10189] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1794'. [ 357.957162][T10185] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -2 [ 357.968799][T10187] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 357.996988][T10190] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1794'. [ 358.006382][T10185] EXT4-fs error (device loop1): ext4_iget_extra_inode:4763: inode #15: comm syz.1.1793: corrupted in-inode xattr [ 358.047363][T10187] ext4 filesystem being mounted at /373/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 358.063440][T10185] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.1793: couldn't read orphan inode 15 (err -117) [ 358.110609][T10185] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 358.156568][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 358.277247][T10187] EXT4-fs error (device loop4): ext4_get_first_dir_block:3585: inode #12: comm syz.4.1792: Attempting to read directory block (0) that is past i_size (3) [ 358.297841][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 358.511243][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 358.977391][T10207] loop1: detected capacity change from 0 to 512 [ 359.009470][T10207] EXT4-fs: Ignoring removed oldalloc option [ 359.059376][T10207] EXT4-fs (loop1): orphan cleanup on readonly fs [ 359.076895][T10207] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -13 [ 359.102571][T10207] EXT4-fs error (device loop1): ext4_clear_blocks:883: inode #13: comm syz.1.1801: attempt to clear invalid blocks 2 len 1 [ 359.163146][T10207] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 359.191049][T10207] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.1801: invalid indirect mapped block 1819239214 (level 0) [ 359.225810][T10207] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.1801: invalid indirect mapped block 1819239214 (level 1) [ 359.253411][T10207] EXT4-fs (loop1): 1 truncate cleaned up [ 359.259322][T10207] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 359.394666][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 359.628932][T10212] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1803'. [ 359.673989][T10201] loop4: detected capacity change from 0 to 40427 [ 359.689709][T10212] 8021q: adding VLAN 0 to HW filter on device bond1 [ 359.748764][T10201] F2FS-fs (loop4): build fault injection attr: rate: 690, type: 0x3ffff [ 359.841520][T10201] F2FS-fs (loop4): invalid crc value [ 359.882857][T10201] F2FS-fs (loop4): Found nat_bits in checkpoint [ 359.934885][T10214] bond1: (slave veth3): Enslaving as an active interface with an up link [ 360.821107][T10201] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 361.135887][T10205] loop3: detected capacity change from 0 to 40427 [ 361.208360][T10205] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 361.248048][T10205] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 361.336845][T10205] F2FS-fs (loop3): invalid crc value [ 362.204902][T10205] F2FS-fs (loop3): Failed to initialize F2FS segment manager (-4) [ 362.641551][T10242] loop3: detected capacity change from 0 to 1024 [ 362.661365][T10242] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 362.721675][T10242] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 362.904255][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 363.366269][ T26] audit: type=1800 audit(1790431045.174:283): pid=10253 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1812" name="file2" dev="sda1" ino=2053 res=0 errno=0 [ 363.725513][T10258] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1815'. [ 363.797657][T10258] 8021q: adding VLAN 0 to HW filter on device bond6 [ 364.906279][T10229] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 364.940956][T10271] loop0: detected capacity change from 0 to 256 [ 365.156243][T10271] exFAT-fs (loop0): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 365.824950][T10276] loop1: detected capacity change from 0 to 512 [ 365.858505][T10259] bond6: (slave veth3): Enslaving as an active interface with an up link [ 365.913200][T10276] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 365.914306][T10273] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 366.001167][T10276] ext4 filesystem being mounted at /401/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 366.192032][T10276] EXT4-fs error (device loop1): ext4_get_first_dir_block:3585: inode #12: comm syz.1.1820: Attempting to read directory block (0) that is past i_size (3) [ 366.362346][T10288] loop3: detected capacity change from 0 to 1024 [ 366.390281][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 366.405127][T10288] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 366.431235][T10288] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 366.531069][T10288] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 366.547712][T10288] System zones: 0-1, 3-36 [ 366.605984][T10288] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 366.648431][ T26] audit: type=1800 audit(1790431048.454:284): pid=10288 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1824" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 366.941593][ T8972] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 366.966757][ T8972] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 367.255754][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 367.273345][ T8972] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 367.342282][T10307] loop5: detected capacity change from 0 to 512 [ 367.363228][T10307] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 367.375967][ T8972] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 367.513795][T10307] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 367.612597][T10307] System zones: 1-12 [ 367.630903][T10307] EXT4-fs error (device loop5): ext4_orphan_get:1435: comm syz.5.1832: bad orphan inode 131072 [ 367.703231][T10307] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 367.919094][ T8972] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 367.940873][ T8972] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 367.955066][T10307] overlayfs: upper fs needs to support d_type. [ 367.964928][T10313] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1833'. [ 367.998073][ T8832] EXT4-fs error (device loop5): ext4_readdir:263: inode #2: block 13: comm syz-executor: path /56/bus: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 368.009539][T10313] 8021q: adding VLAN 0 to HW filter on device bond8 [ 368.047602][T10314] bond8: (slave veth5): Enslaving as an active interface with an up link [ 368.154358][ T8972] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.166353][ T4279] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 368.177597][ T4279] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 368.188926][ T4279] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 368.196281][ T8972] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.230093][ T4284] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 368.245309][ T4284] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 368.255357][ T4284] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 368.296877][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): bond8: link becomes ready [ 368.343795][ T8832] EXT4-fs (loop5): unmounting filesystem. [ 368.537159][T10323] netlink: 'syz.1.1837': attribute type 19 has an invalid length. [ 368.564005][T10323] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1837'. [ 368.596036][T10323] netlink: 'syz.1.1837': attribute type 19 has an invalid length. [ 368.611228][T10323] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1837'. [ 368.690336][T10325] loop3: detected capacity change from 0 to 512 [ 368.806869][T10325] EXT4-fs (loop3): Test dummy encryption mode enabled [ 368.889013][T10325] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.1831: bg 0: block 7: invalid block bitmap [ 368.961857][T10325] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 368.986482][T10325] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2921: inode #11: comm syz.3.1831: corrupted xattr block 95 [ 369.057790][T10325] EXT4-fs warning (device loop3): ext4_evict_inode:301: xattr delete (err -117) [ 369.078197][T10325] EXT4-fs (loop3): 1 orphan inode deleted [ 369.113239][T10325] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 369.485654][T10317] chnl_net:caif_netlink_parms(): no params data found [ 369.706202][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 369.757919][ T4279] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 369.769758][ T4279] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 369.781563][ T4279] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 369.791045][ T4279] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 369.800575][ T4279] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 369.808308][ T4279] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 369.958604][T10349] loop3: detected capacity change from 0 to 1024 [ 370.026390][T10349] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 370.103427][T10349] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 370.130336][T10317] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.151687][T10349] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 370.179959][T10317] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.195134][T10349] System zones: 0-1, 3-36 [ 370.231114][T10317] device bridge_slave_0 entered promiscuous mode [ 370.254502][T10349] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 370.262153][T10317] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.291127][ T4279] Bluetooth: hci3: command 0x0409 tx timeout [ 370.311003][T10317] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.339971][T10359] loop0: detected capacity change from 0 to 4096 [ 370.357514][T10317] device bridge_slave_1 entered promiscuous mode [ 370.397809][ T26] audit: type=1800 audit(1790431052.204:285): pid=10349 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1842" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 370.572565][T10359] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 370.748958][T10317] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 370.872185][T10317] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 370.921916][ T4274] EXT4-fs (loop0): unmounting filesystem. [ 371.255658][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 371.269582][T10317] team0: Port device team_slave_0 added [ 371.277215][T10371] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1845'. [ 371.285130][T10317] team0: Port device team_slave_1 added [ 371.560614][T10376] loop3: detected capacity change from 0 to 16 [ 371.603040][T10376] erofs: (device loop3): mounted with root inode @ nid 36. [ 371.641334][T10376] syz.3.1848: attempt to access beyond end of device [ 371.641334][T10376] loop3: rw=0, sector=13478624032, nr_sectors = 8 limit=16 [ 371.660651][T10376] erofs: (device loop3): erofs_readdir: fail to readdir of logical block 0 of nid 36 [ 371.740198][T10317] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 371.748975][T10317] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 371.818478][T10317] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 371.853776][T10378] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1847'. [ 371.868505][T10382] loop3: detected capacity change from 0 to 1024 [ 371.891415][ T4279] Bluetooth: hci2: command 0x0409 tx timeout [ 371.957675][T10378] 8021q: adding VLAN 0 to HW filter on device bond4 [ 371.965560][T10382] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 372.101095][T10365] loop1: detected capacity change from 0 to 1024 [ 372.128600][T10379] bond4: (slave veth3): Enslaving as an active interface with an up link [ 372.198643][T10317] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 372.212740][T10317] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 372.274634][T10365] EXT4-fs: quotafile must be on filesystem root [ 372.318188][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 372.325219][T10317] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 372.371295][ T4279] Bluetooth: hci3: command 0x041b tx timeout [ 372.441075][ T8972] device hsr_slave_0 left promiscuous mode [ 372.487866][ T8972] device hsr_slave_1 left promiscuous mode [ 372.532365][ T8972] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 372.540009][ T8972] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 372.555393][T10394] process 'syz.3.1850' launched './file0' with NULL argv: empty string added [ 372.632392][ T8972] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 372.640369][ T8972] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 372.677096][ T8972] device bridge_slave_1 left promiscuous mode [ 372.712422][ T8972] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.747751][ T8972] device bridge_slave_0 left promiscuous mode [ 372.768327][ T8972] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.879554][ T8972] device veth1_macvtap left promiscuous mode [ 372.887625][ T8972] device veth0_macvtap left promiscuous mode [ 372.913342][T10365] loop1: detected capacity change from 0 to 512 [ 372.916294][ T8972] device veth1_vlan left promiscuous mode [ 372.958778][ T8972] device veth0_vlan left promiscuous mode [ 373.135156][T10365] EXT4-fs: Ignoring removed i_version option [ 373.254131][T10365] EXT4-fs: Ignoring removed oldalloc option [ 373.388990][T10365] EXT4-fs (loop1): Test dummy encryption mode enabled [ 373.512486][ T8972] bond5 (unregistering): (slave veth3): Releasing backup interface [ 373.747389][T10365] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 373.887960][ C0] vxcan0: j1939_tp_rxtimer: 0xffff888056894800: rx timeout, send abort [ 373.918775][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 373.970981][ T4279] Bluetooth: hci2: command 0x041b tx timeout [ 374.077338][ T8972] bond5 (unregistering): Released all slaves [ 374.088875][ T8972] bond4 (unregistering): Released all slaves [ 374.099528][ T8972] bond3 (unregistering): Released all slaves [ 374.110028][ T8972] bond2 (unregistering): Released all slaves [ 374.138840][ T8972] bond1 (unregistering): Released all slaves [ 374.388076][ C0] vxcan0: j1939_tp_rxtimer: 0xffff8880294ab400: rx timeout, send abort [ 374.396815][ C0] vxcan0: j1939_tp_rxtimer: 0xffff888056894800: abort rx timeout. Force session deactivation [ 374.454782][ T4279] Bluetooth: hci3: command 0x040f tx timeout [ 374.838740][ T8972] team0 (unregistering): Port device team_slave_1 removed [ 374.888321][ T8972] team0 (unregistering): Port device team_slave_0 removed [ 374.896541][ C0] vxcan0: j1939_tp_rxtimer: 0xffff8880294ab400: abort rx timeout. Force session deactivation [ 374.942954][ T8972] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 374.994446][ T8972] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 375.360029][ T8972] bond0 (unregistering): Released all slaves [ 375.463797][T10345] chnl_net:caif_netlink_parms(): no params data found [ 375.576646][T10403] device syzkaller0 entered promiscuous mode [ 375.583753][T10416] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1853'. [ 376.052656][ T4279] Bluetooth: hci2: command 0x040f tx timeout [ 376.253621][T10443] loop3: detected capacity change from 0 to 256 [ 376.277311][T10443] exFAT-fs (loop3): Invalid boot checksum (boot checksum : 0x11190001, checksum : 0x1119abd0) [ 376.287941][T10443] exFAT-fs (loop3): invalid boot region [ 376.293711][T10443] exFAT-fs (loop3): failed to recognize exfat type [ 376.546672][ T4279] Bluetooth: hci3: command 0x0419 tx timeout [ 378.132311][ T4288] Bluetooth: hci2: command 0x0419 tx timeout [ 378.489453][T10454] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1858'. [ 378.942015][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.948491][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.172013][T10317] device hsr_slave_0 entered promiscuous mode [ 380.194012][T10317] device hsr_slave_1 entered promiscuous mode [ 380.208166][T10317] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 380.221319][T10317] Cannot create hsr debugfs directory [ 380.246131][T10459] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1860'. [ 380.297452][T10459] 8021q: adding VLAN 0 to HW filter on device bond7 [ 380.397013][T10460] bond7: (slave veth5): Enslaving as an active interface with an up link [ 380.633432][T10478] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1865'. [ 380.655893][T10476] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1864'. [ 380.827947][T10478] device bond8 entered promiscuous mode [ 380.908680][T10345] bridge0: port 1(bridge_slave_0) entered blocking state [ 380.928066][T10345] bridge0: port 1(bridge_slave_0) entered disabled state [ 380.939313][T10345] device bridge_slave_0 entered promiscuous mode [ 380.989179][T10345] bridge0: port 2(bridge_slave_1) entered blocking state [ 381.011493][T10345] bridge0: port 2(bridge_slave_1) entered disabled state [ 381.055875][T10345] device bridge_slave_1 entered promiscuous mode [ 381.144102][T10345] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 381.235877][T10345] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 381.369355][T10345] team0: Port device team_slave_0 added [ 381.369405][T10485] loop3: detected capacity change from 0 to 8192 [ 381.423139][T10345] team0: Port device team_slave_1 added [ 381.983114][ T8972] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.047341][T10513] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1871'. [ 382.276484][T10502] device syzkaller0 entered promiscuous mode [ 382.289753][T10518] (unnamed net_device) (uninitialized): Unable to set up delay as MII monitoring is disabled [ 382.307232][T10345] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 382.316190][T10345] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 382.342705][T10345] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 382.408674][ T8972] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.889299][T10345] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 384.896371][T10345] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 384.923333][T10345] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 385.017352][ T8972] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.038314][T10526] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1876'. [ 386.030387][ T8972] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.529352][T10345] device hsr_slave_0 entered promiscuous mode [ 387.242784][T10345] device hsr_slave_1 entered promiscuous mode [ 387.291065][T10345] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 387.299652][T10345] Cannot create hsr debugfs directory [ 387.329807][T10317] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 387.364361][T10317] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 387.373960][T10561] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1884'. [ 387.499729][T10317] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 387.564750][T10317] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 387.732922][T10568] (unnamed net_device) (uninitialized): Unable to set up delay as MII monitoring is disabled [ 388.838003][T10569] device syzkaller0 entered promiscuous mode [ 389.854656][T10597] loop1: detected capacity change from 0 to 40427 [ 389.878910][T10597] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 389.889859][T10597] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 389.899865][T10597] F2FS-fs (loop1): invalid crc value [ 389.949970][T10597] F2FS-fs (loop1): Found nat_bits in checkpoint [ 390.029028][T10597] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 390.037493][T10597] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 390.607685][ T8132] kworker/u4:11: attempt to access beyond end of device [ 390.607685][ T8132] loop1: rw=1, sector=77824, nr_sectors = 192 limit=40427 [ 391.151925][T10613] loop0: detected capacity change from 0 to 512 [ 391.312654][T10613] EXT4-fs error (device loop0): ext4_orphan_get:1409: inode #15: comm syz.0.1897: iget: bad i_size value: 38620345925642 [ 391.328854][T10613] EXT4-fs error (device loop0): ext4_orphan_get:1414: comm syz.0.1897: couldn't read orphan inode 15 (err -117) [ 391.343760][T10613] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 391.367286][T10613] EXT4-fs (loop0): unmounting filesystem. [ 392.598563][T10619] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1896'. [ 395.628174][T10317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 395.825347][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 395.829111][T10633] loop1: detected capacity change from 0 to 512 [ 395.842010][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 395.877066][T10317] 8021q: adding VLAN 0 to HW filter on device team0 [ 395.920282][T10633] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -2 [ 395.931831][T10633] EXT4-fs error (device loop1): ext4_iget_extra_inode:4763: inode #15: comm syz.1.1902: corrupted in-inode xattr [ 395.945212][T10633] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.1902: couldn't read orphan inode 15 (err -117) [ 395.969067][T10633] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 395.995702][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 396.031847][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 396.041838][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 396.088344][ T5191] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.095667][ T5191] bridge0: port 1(bridge_slave_0) entered forwarding state [ 396.139460][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 396.165150][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 396.191455][ T5191] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.198613][ T5191] bridge0: port 2(bridge_slave_1) entered forwarding state [ 396.231440][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 396.313895][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 396.388423][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 396.471572][ T8132] af_packet: tpacket_rcv: packet too big, clamped from 24 to 4294967272. macoff=96 [ 396.510391][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 396.532171][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 396.562014][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 396.572702][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 396.643897][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 396.663560][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 396.683268][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 396.701206][T10345] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 396.747938][T10630] loop0: detected capacity change from 0 to 40427 [ 396.757400][T10345] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 396.775448][T10630] F2FS-fs (loop0): invalid crc value [ 396.792686][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 396.809893][T10630] F2FS-fs (loop0): Found nat_bits in checkpoint [ 396.810280][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 396.896922][T10345] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 396.920124][T10630] F2FS-fs (loop0): Start checkpoint disabled! [ 396.924024][T10317] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 397.007829][T10630] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 397.038463][T10345] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 397.996291][T10345] 8021q: adding VLAN 0 to HW filter on device bond0 [ 398.047732][ T8972] device hsr_slave_0 left promiscuous mode [ 398.060200][ T8972] device hsr_slave_1 left promiscuous mode [ 398.074969][ T8972] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 398.094510][ T8972] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 398.120565][ T8972] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 398.142483][ T8972] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 398.170583][ T8972] device bridge_slave_1 left promiscuous mode [ 398.191346][ T8972] bridge0: port 2(bridge_slave_1) entered disabled state [ 398.211711][ T8972] device bridge_slave_0 left promiscuous mode [ 398.218093][ T8972] bridge0: port 1(bridge_slave_0) entered disabled state [ 398.286883][ T8132] kworker/u4:11: attempt to access beyond end of device [ 398.286883][ T8132] loop0: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 398.331635][ T8972] device veth1_macvtap left promiscuous mode [ 398.342698][ T8972] device veth0_macvtap left promiscuous mode [ 398.355550][ T8972] device veth1_vlan left promiscuous mode [ 398.364942][ T8972] device veth0_vlan left promiscuous mode [ 398.798764][ T8972] bond1 (unregistering): (slave veth3): Releasing backup interface [ 399.175216][ T8972] bond1 (unregistering): Released all slaves [ 399.203332][T10710] loop3: detected capacity change from 0 to 512 [ 399.216443][T10710] EXT4-fs: inline encryption not supported [ 399.259712][T10710] EXT4-fs (loop3): Test dummy encryption mode enabled [ 399.267110][T10710] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 399.285591][T10710] EXT4-fs (loop3): can't mount with commit=2, fs mounted w/o journal [ 399.815783][ T8972] team0 (unregistering): Port device team_slave_1 removed [ 399.868934][ T8972] team0 (unregistering): Port device team_slave_0 removed [ 399.918836][ T8972] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 399.971421][ T8972] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 400.345787][ T8972] bond0 (unregistering): Released all slaves [ 400.467687][T10681] device syzkaller0 entered promiscuous mode [ 402.803407][T10708] tap0: tun_chr_ioctl cmd 2148553947 [ 402.822819][T10345] 8021q: adding VLAN 0 to HW filter on device team0 [ 402.849704][T10317] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 402.874691][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 402.892512][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 402.975161][T10713] loop1: detected capacity change from 0 to 1024 [ 403.014697][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 403.030102][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 403.040431][T10713] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 403.078951][T10713] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 403.088358][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 403.120233][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 403.160272][T10713] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 403.173201][ T7365] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.180964][ T7365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 403.189022][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 403.199590][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 403.201420][T10713] System zones: [ 403.208567][ T7365] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.219588][ T7365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 403.228076][T10713] 0-1, 3-36 [ 403.235731][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 403.312434][T10713] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 403.355153][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 403.374051][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 403.414558][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 403.450639][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 403.489065][ T26] audit: type=1800 audit(1790431085.294:286): pid=10713 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1918" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 403.515488][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 403.559821][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 403.619640][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 403.642820][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 403.672542][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 403.695842][T10345] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 403.733792][ T4286] EXT4-fs (loop1): unmounting filesystem. [ 403.779178][T10345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 403.807950][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 403.834985][ T7365] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 405.509914][T10758] device syzkaller0 entered promiscuous mode [ 405.530279][T10765] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1928'. [ 410.123864][T10765] device bond9 entered promiscuous mode [ 410.181746][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 410.192159][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 410.203438][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 410.229615][ T5191] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 410.246127][T10345] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 410.387220][T10782] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1930'. [ 410.441113][T10784] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1931'. [ 410.547267][T10317] device veth0_vlan entered promiscuous mode [ 410.574762][T10782] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1930'. [ 410.587616][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 410.631653][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 410.719983][T10317] device veth1_vlan entered promiscuous mode [ 410.733312][T10801] loop3: detected capacity change from 0 to 512 [ 410.773122][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 410.794483][T10801] FAT-fs (loop3): error, corrupted directory (invalid entries) [ 410.818652][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 410.881759][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 410.895768][T10801] FAT-fs (loop3): Filesystem has been set read-only [ 410.952570][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 410.973555][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 411.034436][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 411.070422][T10317] device veth0_macvtap entered promiscuous mode [ 411.092571][T10317] device veth1_macvtap entered promiscuous mode [ 411.133507][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 411.161985][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 411.192583][T10317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 411.226616][T10317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.272009][T10317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 411.294229][T10317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.321249][T10317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 411.357698][T10317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.392502][T10317] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 411.498289][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 411.521609][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 411.565411][T10317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 411.595646][T10317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.626329][T10317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 411.645424][T10317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.740915][T10317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 411.783125][T10317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.823053][T10317] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 411.836940][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 411.858376][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 411.885311][T10317] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.902440][T10317] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.921877][T10317] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.931936][T10317] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.973568][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 411.992693][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 412.016175][T10832] tap0: tun_chr_ioctl cmd 1074025692 [ 412.080625][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 412.091933][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 412.124519][T10345] device veth0_vlan entered promiscuous mode [ 412.152898][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 412.186398][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 412.233681][T10345] device veth1_vlan entered promiscuous mode [ 412.297964][ T7282] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 412.341485][ T7282] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 412.349623][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 412.375259][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 412.402274][ T8730] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 412.424220][T10345] device veth0_macvtap entered promiscuous mode [ 412.468322][T10345] device veth1_macvtap entered promiscuous mode [ 412.494139][ T8170] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 412.516321][ T8170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 412.570938][T10345] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 412.622888][T10345] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.656295][T10345] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 412.691655][T10345] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.738121][T10345] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 412.767998][T10345] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.802612][T10345] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 412.814114][T10345] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.826466][T10345] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 412.857147][T10846] device bond5 entered promiscuous mode [ 413.412996][T10840] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1940'. [ 413.598598][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 413.607845][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 413.635978][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 413.671760][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 413.689584][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 413.888256][T10855] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1943'. [ 413.918366][T10855] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1943'. [ 414.159269][T10858] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1944'. [ 414.364194][T10345] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 414.375182][T10345] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.397936][T10345] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 414.426739][T10345] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.449023][T10345] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 414.535640][T10345] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.563606][T10345] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 414.590700][T10345] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.642840][T10345] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 414.790774][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 414.799688][ T7282] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 415.158595][T10871] loop3: detected capacity change from 0 to 128 [ 415.206553][T10871] FAT-fs (loop3): Directory bread(block 32) failed [ 415.230025][T10871] FAT-fs (loop3): Directory bread(block 33) failed [ 415.241423][T10871] FAT-fs (loop3): Directory bread(block 34) failed [ 415.248118][T10871] FAT-fs (loop3): Directory bread(block 35) failed [ 415.255620][T10871] FAT-fs (loop3): Directory bread(block 36) failed [ 415.262537][T10871] FAT-fs (loop3): Directory bread(block 37) failed [ 415.269643][T10871] FAT-fs (loop3): Directory bread(block 38) failed [ 415.276646][T10871] FAT-fs (loop3): Directory bread(block 39) failed [ 415.283693][T10871] FAT-fs (loop3): Directory bread(block 40) failed [ 415.292312][T10871] FAT-fs (loop3): Directory bread(block 41) failed [ 417.997882][T10883] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1953'. [ 418.017111][T10890] device syzkaller1 entered promiscuous mode [ 418.032907][T10345] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.047041][T10345] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.073755][T10345] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.089145][T10345] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.178240][T10883] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1953'. [ 418.196307][T10896] loop1: detected capacity change from 0 to 256 [ 418.387431][ T7365] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 418.399279][ T7365] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 418.449325][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 418.718297][ T8132] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 418.740007][ T8132] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 418.800894][ T8132] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 419.186961][T10919] loop1: detected capacity change from 0 to 128 [ 419.288800][T10919] FAT-fs (loop1): Directory bread(block 32) failed [ 419.317148][T10919] FAT-fs (loop1): Directory bread(block 33) failed [ 419.360983][T10919] FAT-fs (loop1): Directory bread(block 34) failed [ 419.367586][T10919] FAT-fs (loop1): Directory bread(block 35) failed [ 419.451762][T10919] FAT-fs (loop1): Directory bread(block 36) failed [ 419.477375][T10919] FAT-fs (loop1): Directory bread(block 37) failed [ 419.494845][T10919] FAT-fs (loop1): Directory bread(block 38) failed [ 419.532622][T10919] FAT-fs (loop1): Directory bread(block 39) failed [ 419.570719][T10919] FAT-fs (loop1): Directory bread(block 40) failed [ 419.588471][T10919] FAT-fs (loop1): Directory bread(block 41) failed [ 419.809483][T10934] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1966'. [ 419.882621][T10934] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1966'. [ 419.944932][T10937] device syzkaller1 entered promiscuous mode [ 420.122284][T10941] tap0: tun_chr_ioctl cmd 1074025677 [ 420.128178][T10941] tap0: linktype set to 1 [ 421.223922][T10966] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1978'. [ 421.283844][T10966] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1978'. [ 421.465067][T10970] device syzkaller1 entered promiscuous mode [ 421.606257][T10979] loop4: detected capacity change from 0 to 128 [ 421.689099][T10979] FAT-fs (loop4): Directory bread(block 32) failed [ 421.717533][T10979] FAT-fs (loop4): Directory bread(block 33) failed [ 421.768247][T10979] FAT-fs (loop4): Directory bread(block 34) failed [ 421.804798][T10983] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1983'. [ 421.820992][T10979] FAT-fs (loop4): Directory bread(block 35) failed [ 421.837964][T10979] FAT-fs (loop4): Directory bread(block 36) failed [ 421.847991][T10979] FAT-fs (loop4): Directory bread(block 37) failed [ 421.878458][T10979] FAT-fs (loop4): Directory bread(block 38) failed [ 421.918824][T10979] FAT-fs (loop4): Directory bread(block 39) failed [ 421.952699][T10979] FAT-fs (loop4): Directory bread(block 40) failed [ 421.971772][T10979] FAT-fs (loop4): Directory bread(block 41) failed [ 422.672759][T11004] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1990'. [ 422.711885][T11004] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1990'. [ 423.187794][T11010] device syzkaller0 entered promiscuous mode [ 423.216843][T11022] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1995'. [ 426.994448][T11068] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2004'. [ 427.015458][T11068] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2004'. [ 427.195566][T11071] loop6: detected capacity change from 0 to 128 [ 427.289189][T11071] FAT-fs (loop6): Directory bread(block 32) failed [ 427.319445][T11076] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2008'. [ 427.349696][T11071] FAT-fs (loop6): Directory bread(block 33) failed [ 427.368105][T11071] FAT-fs (loop6): Directory bread(block 34) failed [ 427.388267][T11071] FAT-fs (loop6): Directory bread(block 35) failed [ 427.417370][T11071] FAT-fs (loop6): Directory bread(block 36) failed [ 427.454920][T11071] FAT-fs (loop6): Directory bread(block 37) failed [ 427.481063][T11071] FAT-fs (loop6): Directory bread(block 38) failed [ 427.508652][T11071] FAT-fs (loop6): Directory bread(block 39) failed [ 427.560223][T11071] FAT-fs (loop6): Directory bread(block 40) failed [ 427.582726][T11071] FAT-fs (loop6): Directory bread(block 41) failed [ 427.767185][T11092] ------------[ cut here ]------------ [ 427.773694][T11092] kobject: '(null)' (ffff8880740f4060): is not initialized, yet kobject_get() is being called. [ 427.892167][T11092] WARNING: CPU: 1 PID: 11092 at lib/kobject.c:634 kobject_add_internal+0x115/0xca0 [ 427.901656][T11092] Modules linked in: [ 427.905600][T11092] CPU: 1 PID: 11092 Comm: syz.3.2011 Not tainted syzkaller #0 [ 427.913245][T11092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 427.923596][T11092] RIP: 0010:kobject_add_internal+0x115/0xca0 [ 427.929713][T11092] Code: b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 de f4 b4 f7 49 8b 34 24 48 c7 c7 40 c6 b1 8b 4c 89 e2 e8 eb 36 2f f7 <0f> 0b e9 e5 00 00 00 e8 ff af 63 f7 b8 fe ff ff ff e9 eb 06 00 00 [ 427.949711][T11092] RSP: 0018:ffffc900060bf808 EFLAGS: 00010246 [ 427.955974][T11092] RAX: 846aa89e322ffd00 RBX: ffff88805935b878 RCX: 0000000000080000 [ 427.964069][T11092] RDX: ffffc9000f774000 RSI: 00000000000099db RDI: 00000000000099dc [ 427.972233][T11092] RBP: 0000000000000000 R08: ffffc900060bf487 R09: 1ffff92000c17e90 [ 427.980272][T11092] R10: dffffc0000000000 R11: fffff52000c17e91 R12: ffff8880740f4060 [ 427.988432][T11092] R13: dffffc0000000000 R14: ffff8880740f409c R15: dffffc0000000000 [ 427.996583][T11092] FS: 00007fbdf96746c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 428.005633][T11092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 428.012416][T11092] CR2: 00007f08321556c8 CR3: 00000000756d7000 CR4: 00000000003506e0 [ 428.020457][T11092] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 428.028620][T11092] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 428.036679][T11092] Call Trace: [ 428.040154][T11092] [ 428.043271][T11092] ? kfree+0x30/0x1a0 [ 428.047446][T11092] kobject_add+0x160/0x230 [ 428.052071][T11092] ? bind_rdev_to_array+0x5fd/0x1260 [ 428.057544][T11092] ? kobject_init+0x1c0/0x1c0 [ 428.062396][T11092] ? mddev_create_serial_pool+0x20f/0x470 [ 428.068397][T11092] bind_rdev_to_array+0xb50/0x1260 [ 428.073725][T11092] ? bind_rdev_to_array+0x5fd/0x1260 [ 428.079073][T11092] ? md_import_device+0x800/0x800 [ 428.084306][T11092] ? kobject_init+0x7b/0x1c0 [ 428.088953][T11092] ? md_import_device+0x633/0x800 [ 428.094086][T11092] md_add_new_disk+0xe43/0x17b0 [ 428.098995][T11092] md_ioctl+0x24f5/0x2880 [ 428.103521][T11092] ? tomoyo_path_number_perm+0x205/0x650 [ 428.109284][T11092] ? md_release+0xa0/0xa0 [ 428.113736][T11092] ? __lock_acquire+0x7c40/0x7c40 [ 428.119102][T11092] ? slab_free_freelist_hook+0x133/0x1b0 [ 428.124937][T11092] ? tomoyo_path_number_perm+0x4fb/0x650 [ 428.130722][T11092] ? blkdev_common_ioctl+0x6c1/0x2090 [ 428.136669][T11092] ? tomoyo_path_number_perm+0x205/0x650 [ 428.142435][T11092] ? tomoyo_path_number_perm+0x5a4/0x650 [ 428.148124][T11092] ? blkdev_bszset+0x200/0x200 [ 428.153075][T11092] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 428.158630][T11092] ? md_release+0xa0/0xa0 [ 428.163061][T11092] blkdev_ioctl+0x37b/0x740 [ 428.167702][T11092] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 428.173277][T11092] ? bpf_lsm_file_ioctl+0x5/0x10 [ 428.178441][T11092] ? security_file_ioctl+0x7c/0xa0 [ 428.183838][T11092] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 428.189386][T11092] __se_sys_ioctl+0xfa/0x170 [ 428.194157][T11092] do_syscall_64+0x4c/0xa0 [ 428.198645][T11092] ? clear_bhb_loop+0x60/0xb0 [ 428.203454][T11092] ? clear_bhb_loop+0x60/0xb0 [ 428.208177][T11092] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 428.214352][T11092] RIP: 0033:0x7fbdf879e159 [ 428.218815][T11092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 428.238894][T11092] RSP: 002b:00007fbdf9674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 428.247607][T11092] RAX: ffffffffffffffda RBX: 00007fbdf8a26090 RCX: 00007fbdf879e159 [ 428.255892][T11092] RDX: 0000200000000420 RSI: 0000000040140921 RDI: 0000000000000004 [ 428.263964][T11092] RBP: 00007fbdf883506b R08: 0000000000000000 R09: 0000000000000000 [ 428.272122][T11092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.280250][T11092] R13: 00007fbdf8a26128 R14: 00007fbdf8a26090 R15: 00007ffd81e6b5a8 [ 428.288453][T11092] [ 428.291570][T11092] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 428.299055][T11092] CPU: 1 PID: 11092 Comm: syz.3.2011 Not tainted syzkaller #0 [ 428.307014][T11092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 428.317077][T11092] Call Trace: [ 428.320449][T11092] [ 428.323390][T11092] dump_stack_lvl+0x188/0x24e [ 428.328173][T11092] ? memcpy+0x3c/0x60 [ 428.332427][T11092] ? show_regs_print_info+0x12/0x12 [ 428.337716][T11092] ? load_image+0x410/0x410 [ 428.342276][T11092] panic+0x2d3/0x710 [ 428.346271][T11092] ? bpf_jit_dump+0xd0/0xd0 [ 428.350797][T11092] __warn+0x2f8/0x4f0 [ 428.354801][T11092] ? kobject_add_internal+0x115/0xca0 [ 428.360211][T11092] ? kobject_add_internal+0x115/0xca0 [ 428.365688][T11092] report_bug+0x2ba/0x4f0 [ 428.370070][T11092] ? kobject_add_internal+0x115/0xca0 [ 428.375635][T11092] handle_bug+0x3a/0x70 [ 428.379806][T11092] exc_invalid_op+0x16/0x40 [ 428.384406][T11092] asm_exc_invalid_op+0x16/0x20 [ 428.389264][T11092] RIP: 0010:kobject_add_internal+0x115/0xca0 [ 428.395457][T11092] Code: b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 de f4 b4 f7 49 8b 34 24 48 c7 c7 40 c6 b1 8b 4c 89 e2 e8 eb 36 2f f7 <0f> 0b e9 e5 00 00 00 e8 ff af 63 f7 b8 fe ff ff ff e9 eb 06 00 00 [ 428.415175][T11092] RSP: 0018:ffffc900060bf808 EFLAGS: 00010246 [ 428.421460][T11092] RAX: 846aa89e322ffd00 RBX: ffff88805935b878 RCX: 0000000000080000 [ 428.429549][T11092] RDX: ffffc9000f774000 RSI: 00000000000099db RDI: 00000000000099dc [ 428.437982][T11092] RBP: 0000000000000000 R08: ffffc900060bf487 R09: 1ffff92000c17e90 [ 428.445964][T11092] R10: dffffc0000000000 R11: fffff52000c17e91 R12: ffff8880740f4060 [ 428.454028][T11092] R13: dffffc0000000000 R14: ffff8880740f409c R15: dffffc0000000000 [ 428.462128][T11092] ? kobject_add_internal+0x115/0xca0 [ 428.467520][T11092] ? kfree+0x30/0x1a0 [ 428.471519][T11092] kobject_add+0x160/0x230 [ 428.475969][T11092] ? bind_rdev_to_array+0x5fd/0x1260 [ 428.481394][T11092] ? kobject_init+0x1c0/0x1c0 [ 428.486133][T11092] ? mddev_create_serial_pool+0x20f/0x470 [ 428.492184][T11092] bind_rdev_to_array+0xb50/0x1260 [ 428.498043][T11092] ? bind_rdev_to_array+0x5fd/0x1260 [ 428.503362][T11092] ? md_import_device+0x800/0x800 [ 428.508409][T11092] ? kobject_init+0x7b/0x1c0 [ 428.513017][T11092] ? md_import_device+0x633/0x800 [ 428.518058][T11092] md_add_new_disk+0xe43/0x17b0 [ 428.522934][T11092] md_ioctl+0x24f5/0x2880 [ 428.527287][T11092] ? tomoyo_path_number_perm+0x205/0x650 [ 428.533198][T11092] ? md_release+0xa0/0xa0 [ 428.537542][T11092] ? __lock_acquire+0x7c40/0x7c40 [ 428.542587][T11092] ? slab_free_freelist_hook+0x133/0x1b0 [ 428.548317][T11092] ? tomoyo_path_number_perm+0x4fb/0x650 [ 428.553964][T11092] ? blkdev_common_ioctl+0x6c1/0x2090 [ 428.559351][T11092] ? tomoyo_path_number_perm+0x205/0x650 [ 428.564990][T11092] ? tomoyo_path_number_perm+0x5a4/0x650 [ 428.570811][T11092] ? blkdev_bszset+0x200/0x200 [ 428.575583][T11092] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 428.581076][T11092] ? md_release+0xa0/0xa0 [ 428.585428][T11092] blkdev_ioctl+0x37b/0x740 [ 428.589946][T11092] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 428.595419][T11092] ? bpf_lsm_file_ioctl+0x5/0x10 [ 428.600454][T11092] ? security_file_ioctl+0x7c/0xa0 [ 428.605604][T11092] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 428.611079][T11092] __se_sys_ioctl+0xfa/0x170 [ 428.615682][T11092] do_syscall_64+0x4c/0xa0 [ 428.620193][T11092] ? clear_bhb_loop+0x60/0xb0 [ 428.624874][T11092] ? clear_bhb_loop+0x60/0xb0 [ 428.629556][T11092] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 428.635589][T11092] RIP: 0033:0x7fbdf879e159 [ 428.640030][T11092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 428.659829][T11092] RSP: 002b:00007fbdf9674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 428.668264][T11092] RAX: ffffffffffffffda RBX: 00007fbdf8a26090 RCX: 00007fbdf879e159 [ 428.676244][T11092] RDX: 0000200000000420 RSI: 0000000040140921 RDI: 0000000000000004 [ 428.684220][T11092] RBP: 00007fbdf883506b R08: 0000000000000000 R09: 0000000000000000 [ 428.692197][T11092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.700372][T11092] R13: 00007fbdf8a26128 R14: 00007fbdf8a26090 R15: 00007ffd81e6b5a8 [ 428.708453][T11092] [ 428.711722][T11092] Kernel Offset: disabled [ 428.716140][T11092] Rebooting in 86400 seconds..