last executing test programs: 47.430196371s ago: executing program 1 (id=2928): r0 = open(&(0x7f0000000080)='./bus\x00', 0x148447, 0x10) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r3, 0x29, 0x11, 0x0, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000010c0), 0x403, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000480)={{0x0, 0x3, 0x0, 0x3}, 'syz0\x00', 0x2}) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x100000, 0x400, {}, {0x0, 0x2, 0x0, 0x2, 0x0, 0x0, "f4ffffff"}, 0x20000000, 0x1, {0x0}, 0x0, 0x0, 0xffffffffffffffff}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, 0x0) ioctl$vim2m_VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000340)=@multiplanar_userptr={0x0, 0x2, 0x4, 0x10, 0x5, {}, {0x1, 0xc, 0xd7, 0x7, 0x1, 0x3, "621a65f4"}, 0x1ff, 0x2, {0x0}, 0x6, 0x0, r6}) ioctl$UI_SET_KEYBIT(r4, 0x40045565, 0x2c0) ioctl$UI_DEV_CREATE(r4, 0x5501) mmap$IORING_OFF_CQ_RING(0x0, 0xc00000, 0x1000005, 0x13, r0, 0x8000000) 44.584703188s ago: executing program 1 (id=2934): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xd, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000003000000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1e, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000001000000000000"], &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x63, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3fffffc}, 0x94) pipe(&(0x7f00000001c0)) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0xf0ffffffffffff, 0x0, 0x60001d0}, 0xc084) 44.345624559s ago: executing program 1 (id=2935): r0 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x1}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @loopback, 0x4e22, 0x3, 'lc\x00', 0x34, 0x80001, 0x70}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x7}, 0x50) socket$inet_smc(0x2b, 0x1, 0x0) pselect6(0x40, &(0x7f0000000a00)={0x8, 0x9, 0x6, 0x1000, 0xa, 0x7e, 0x72, 0x7f1c}, 0x0, 0x0, &(0x7f0000000ac0), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x24, &(0x7f00000009c0)=ANY=[@ANYBLOB="18080000cbb60000000000001000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100b00000009500000000000000b7020000000080007b9af8ff00000000d60900001fffffff7baaf0ff00000000bf2720000000000007080000fffdffffbf9400000000000007040000f0ffffff640200000800000018220000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7050000080000004604f0ff7600000018010000696c6c2500000000002020207b1af8b000000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000006000000bf9800000000000056080000000000408500000005000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x94) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r5, 0x10f, 0x80, &(0x7f0000000300), &(0x7f0000001080)=0x4) ioctl$SIOCSIFHWADDR(r3, 0x8905, 0x0) sendmsg$sock(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 44.224625134s ago: executing program 1 (id=2936): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="b7f2288d3aaea2bc0000def1260a00"/28, 0x1c) r1 = accept(r0, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f00000013c0), r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$packet(0x11, 0x2, 0x300) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000040)={0x3ff, 0x1, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendmsg$netlink(r1, &(0x7f0000004dc0)={0x0, 0x0, &(0x7f0000004380)=[{&(0x7f0000001400)=ANY=[], 0x131c}], 0x1, 0x0, 0x0, 0x80}, 0x4040000) 43.245817201s ago: executing program 1 (id=2938): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000000), r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x2, 0x2, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x15, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() syz_emit_ethernet(0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f0000005fc0)={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, @empty, 0x7, 0x8010, 0x3b, 0x500, 0x5, 0x18c0012}) r4 = socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) socket$kcm(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000340)={0x1d, r5, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x44, r1, 0x1, 0x0, 0x0, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @loopback}, @NLBL_UNLABEL_A_SECCTX={0xf, 0x7, 'unconfined\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}]}, 0x44}}, 0x0) sendmsg$key(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)={0x2, 0x18, 0x5, 0x6, 0x2, 0x0, 0x60bd27, 0x25dfdbfc}, 0x10}}, 0x24008880) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000900)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @loopback}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @loopback}]}, 0x30}}, 0x0) 40.584585959s ago: executing program 1 (id=2939): sync() sync() sync() r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) bind$can_j1939(r0, &(0x7f00000000c0), 0x18) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000200)=0x1, 0x4) 25.056348321s ago: executing program 32 (id=2939): sync() sync() sync() r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) bind$can_j1939(r0, &(0x7f00000000c0), 0x18) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000200)=0x1, 0x4) 7.869434813s ago: executing program 4 (id=3032): socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb0100180000000000000040000000400000000200000000000000000000060400000000000000000000010500000008000000000000000000000300000000010000000200000004000000000000000000000b"], 0x0, 0x5a}, 0x28) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x28, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/mnt\x00') openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b7"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xf, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68888a887", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 7.388889016s ago: executing program 4 (id=3034): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) 7.012983685s ago: executing program 2 (id=3035): syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') epoll_create1(0x80000) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000040000004000000005"], 0x48) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) socket$can_j1939(0x1d, 0x2, 0x7) socket$netlink(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8040, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{}, 0x0, &(0x7f0000000200)=r1}, 0x1e) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[0x0], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)}) 6.598333894s ago: executing program 2 (id=3038): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) userfaultfd(0x80801) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r5 = memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0) pwrite64(r5, &(0x7f00000008c0)='/', 0x1, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) syz_mount_image$squashfs(&(0x7f0000000240), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f00000002c0), 0x1, 0x228, &(0x7f0000000300)="$eJzKKC4sZmdgYPj7sSaZgUGAAQRYGEQYLjAwMrAwMDDIM4KFGD4yQeipUPomlGaDyl+B0r5Q8XYo/de8KiKKgYExU+meGdMB8RRFRgEGHpGvpx4wJDPwxzJYzvNecykoc8pVobdL94PUe4VWbmJgVE/hXzRnwwSnmbxgYxkjo5DNYT4gM4sDZBADA8PkPxH3HrBIMoggmSXK8U/sVMvyVWad9xlmdExLY2A0mMXBwMCgd0R3pp0BbzcT1MziyqrsxJyc1KLiMwyo5k9m3M+kyAhSd+bv1eAHjHYM3bEMjAxyG/zVFn/7I1W5cVN95PSqiJqp3U03l66PY9im//eKidT7iRlh/x8cEtSyyMv/ME9G6fvmhjkfauqemDh2NirP5W+9/Pfd+5ja4gQ1psfiXYVs/AluWjWfnJ3cLB/PTa9u31KsuCArzWXisakX/yYcX8vAMPnCE1v9mjOH4hVjOKXcKufG3HWLF+Rapn6+7g0Dw8GozxMZGJcz7mdiYJgZtnMPsr/KG6CRwcDMwMCgwsDAwMTAwpCWmZNq4MHAyMAM5RiyQFXBVDMxcIAl9JLzc1LaGRjBSQCsbTkDC9wMw8cMrHCOETLH2KIBahJDO5RWgdIeUHo5lH4MpeXRkg0L2IR+KE+jgYGBjaEisaSkyJCNgQHKgosZwcWMBOA2M0FtncuE6rnjTAyjYBSMglEwCkbBKBgFo2AUjIJRMJIBIAAA///ZbLn7") socket$netlink(0x10, 0x3, 0x0) 6.26546669s ago: executing program 4 (id=3042): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0x7, '.\x00'}}) 5.251929488s ago: executing program 0 (id=3044): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000300)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000c0d000/0xd000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000a23000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000b93000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r0}, 0x68) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) listen(r2, 0x0) 4.999438021s ago: executing program 4 (id=3045): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x74) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r4, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) accept4$inet6(r1, 0x0, 0x0, 0x80800) 4.740319943s ago: executing program 0 (id=3046): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, 0x0, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xf}, 0x94) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x840) write$nci(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="600602"], 0x8) 4.361757601s ago: executing program 2 (id=3050): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) 4.101383484s ago: executing program 3 (id=3052): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg(r0, &(0x7f0000000280)=[{{&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xfffffff8, @private1, 0x13, 0xffffffff}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000002b40)="f7", 0x33}], 0x1}}], 0x1, 0x40408c1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x102, @private1, 0x5}, 0x1c) r2 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3f}}}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000001340)=[{&(0x7f0000004940)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca", 0x24}], 0x1) 3.761451229s ago: executing program 2 (id=3053): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@dev={0xac, 0x14, 0x14, 0x15}, 0x0, 0x5, 0x0, 0x0, 0xa, 0x20, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xac, 0xfff, 0x0, 0x0, 0xffffffffffffffff, 0x7fffffff}, {0x2, 0xa00, 0x40800000000000, 0x800000000000000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@empty, 0x4d2, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3, 0xbf, 0x4c}]}]}, 0xfc}}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000064010100000000000000000000000000fc01000000000000000000000000000000000000000000000a0000"], 0xfc}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x10}}, 0x0) r2 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r2, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x6e22, 0xfffffffc, @remote, 0x7}, 0x80, 0x0}, 0x20000000) 3.209311296s ago: executing program 3 (id=3054): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000300)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000c0d000/0xd000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000a23000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000b93000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r0}, 0x68) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) listen(r2, 0x0) 2.7029342s ago: executing program 2 (id=3055): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000001700)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000200)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) fsopen(0x0, 0x1) r3 = getpgrp(r0) setrlimit(0xe, &(0x7f00000000c0)={0xffffffff, 0x2}) tgkill(r3, r0, 0x3a) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) syz_read_part_table(0x1058, &(0x7f0000002780)="$eJzsz7uNwkAYhdHrnX1ocxIyUhJqMEVQAY04owZaIKIMWqAFAioADTLGogPk4JzozidN8Iep2O6SlCQ1v6902R9rLcNuy3N0w6skp+X778847udb7bXJX9J9jb3JbLWeJ83imvw3ffpONofPnAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0/YIAAD//yOzEzU=") 2.630093444s ago: executing program 3 (id=3056): socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb0100180000000000000040000000400000000200000000000000000000060400000000000000000000010500000008000000000000000000000300000000010000000200000004000000000000000000000b"], 0x0, 0x5a}, 0x28) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x28, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/mnt\x00') openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b700000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xf, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68888a887", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 2.588274896s ago: executing program 3 (id=3057): r0 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x1}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @loopback, 0x4e22, 0x3, 'lc\x00', 0x34, 0x80001, 0x70}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x7}, 0x50) socket$inet_smc(0x2b, 0x1, 0x0) pselect6(0x40, &(0x7f0000000a00)={0x8, 0x9, 0x6, 0x1000, 0xa, 0x7e, 0x72, 0x7f1c}, 0x0, 0x0, &(0x7f0000000ac0), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x24, &(0x7f00000009c0)=ANY=[@ANYBLOB="18080000cbb60000000000001000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100b00000009500000000000000b7020000000080007b9af8ff00000000d60900001fffffff7baaf0ff00000000bf2720000000000007080000fffdffffbf9400000000000007040000f0ffffff640200000800000018220000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7050000080000004604f0ff7600000018010000696c6c2500000000002020207b1af8b000000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000006000000bf9800000000000056080000000000408500000005000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x94) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r5, 0x10f, 0x80, &(0x7f0000000300), &(0x7f0000001080)=0x4) ioctl$SIOCSIFHWADDR(r3, 0x8905, 0x0) sendmsg$sock(r0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 1.317163746s ago: executing program 4 (id=3058): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x214802, &(0x7f0000000980)={[{@nojournal_checksum}, {@nombcache}, {@barrier}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@nodelalloc}, {@usrquota}, {@noauto_da_alloc}, {@bh}, {@init_itable}]}, 0xff, 0x551, &(0x7f0000000cc0)="$eJzs3d9vU1UcAPDv7Tp+KyMhJPpgFnkQg3Rs8wcmPuCjUSKJvmOzXRaylpK1I2ySCA/y4oshJsZIYvwDfPeR+A/4V5AoCTFk0Qdfam53ywprt9EVNuznk9xyzj23nHt67vdwbs8lDWBojWcvhYhXIuLbJOJwR1kx8sLx1eNWHl6fybYkms3P/koiyfe1j0/yPw+2M8WI376OOFl4rMqx7KW+tDxfrlTShXznRKN6ZaK+tHzqUrU8l86ll6emp8+8Mz31/nvvDqytb57/54dP73505pvjK9//cv/I7STOxqG8rLMd23CjMzMe4/lnMhpnnzhwcgCV7SbJTp8AfRnJ43w0sjHgcIzkUQ/8/30VEU1gSCXiH4ZUex7Qvrcf0H3wC+PBh6s3QOvbX1z9biT2te6NDqwkj90ZJe0vMrYpq+PXP+/czrYY3PcQAJu6cTMiTheL68e/JB//+nd6C8c8WYfxD56fu9n8561u85/Co/lPdJn/HOwSu/3YPP4L9wdQTU/Z/O+DrvPffNFqLMZG8txLrexocvFSJc3Gtpcj4kSM7s3yG63nnFm51+xV1jn/y7as/vZcMD+P+8W9j79nttwob6/Vax7cjHi16/w3edT/SZf+zz6P81us41h657VeZZu3/9lq/hzxRtf+X1vRSjZen5xoXQ8T7ativb9vHfu9V/073f6s/w9s3P6xpHO9tv70dfy079+0V1m/1/+e5PNWek++71q50ViYjNiTfLJ+/9Tae9v59vFZ+08c33j863b974+IL7bY/ltHb/U8dFv9P4BF16z9s0/V/0+fuPfxlz/23/6s/99upU7ke7Yy/m31BLfz2QEAAAAAAMBuU4iIQ5EUSo/ShUKptPp8x9E4UKjU6o2TF2uvR6us9fxDob3SfbjjeYjJ/HnYdn7qifx0RByJiO9G9rfypZlaZXanGw8AAAAAAAAAAAAAAAAAAAC7xMEe//8/88fITp8d8Mz5yW8YXpvG/yB+6QnYlfz7D8NL/MPwEv8wvMQ/DC/xD8NL/MPwEv8wvMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAADNT5c+eyrbny8PpMlp+9urQ4X7t6ajatz5eqizOlmdrCldJcrTZXSUsztepmf1+lVrsyORWL1yYaab0xUV9avlCtLV5uXLhULc+lF9LR59IqAAAAAAAAAAAAAAAAAAAAeLHUl5bny5VKuiAh0VeiuDtOQ2LAiZ0emQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgzX8BAAD//7VBN58=") open(&(0x7f0000000040)='./bus\x00', 0x400141042, 0x2a) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0xc6081, 0xcc) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x82200, 0x0) sendfile(r1, r2, 0x0, 0x20fffe89) 1.289375238s ago: executing program 0 (id=3059): socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000004000000010000000000000104000000200000000100000000000001"], 0x0, 0x3c}, 0x28) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000980)={0xffffffffffffffff, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x84, &(0x7f00000000c0)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0x71, 0x8, 0x0, 0x0}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, 0x0, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r2, 0x86dd, 0x26, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee68888a8", 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.288898858s ago: executing program 3 (id=3060): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xd, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000003000000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1e, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000100000000000000"], &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x63, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3fffffc}, 0x94) pipe(&(0x7f00000001c0)) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0xf0ffffffffffff, 0x0, 0x60001d0}, 0xc084) 772.146863ms ago: executing program 0 (id=3061): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) 771.156083ms ago: executing program 3 (id=3062): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg(r0, &(0x7f0000000280)=[{{&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xfffffff8, @private1, 0x13, 0xffffffff}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000002b40)="f7", 0x33}], 0x1}}], 0x1, 0x40408c1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x102, @private1, 0x5}, 0x1c) r2 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3f}}}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000001340)=[{&(0x7f0000004940)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca", 0x24}], 0x1) 419.09514ms ago: executing program 2 (id=3063): bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x4, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f00000003c0)='\x00', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x20, @loopback, 0x1}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffc000/0x3000)=nil) sendmmsg$sock(r0, &(0x7f00000002c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000640)="89", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000000)="c9", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000200)}}], 0x3, 0x0) shutdown(r0, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000070601080008000000000000000000000500010006"], 0x1c}}, 0x8050) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x2) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)={0x5c, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) 178.149531ms ago: executing program 4 (id=3064): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) 65.543837ms ago: executing program 0 (id=3065): socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb0100180000000000000040000000400000000200000000000000000000060400000000000000000000010500000008000000000000000000000300000000010000000200000004000000000000000000000b"], 0x0, 0x5a}, 0x28) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x28, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/mnt\x00') openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b700000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xf, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68888a887", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 0s ago: executing program 0 (id=3066): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x74) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r4, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) accept4$inet6(r1, 0x0, 0x0, 0x80800) kernel console output (not intermixed with test programs): 91] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.231393][ T1101] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.249720][ T1101] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.315060][T12463] syzkaller0: entered promiscuous mode [ 369.321880][T12463] syzkaller0: entered allmulticast mode [ 371.283668][T12478] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2191'. [ 371.287779][T11553] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 371.309171][T11553] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.317564][T12478] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2191'. [ 371.776415][T12488] syzkaller0: entered promiscuous mode [ 371.803011][T12488] syzkaller0: entered allmulticast mode [ 374.494770][T12547] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2201'. [ 374.505857][T12547] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2201'. [ 374.724571][T12560] syzkaller0: entered promiscuous mode [ 374.745528][T12560] syzkaller0: entered allmulticast mode [ 375.198742][T12586] syzkaller0: entered promiscuous mode [ 375.205304][T12586] syzkaller0: entered allmulticast mode [ 375.660162][T12588] syzkaller0: entered promiscuous mode [ 375.715801][T12588] syzkaller0: entered allmulticast mode [ 378.960183][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.966914][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.125902][T12629] loop1: detected capacity change from 0 to 512 [ 379.205377][T12629] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 379.278073][T12629] ext4 filesystem being mounted at /7/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 379.356081][T12641] loop3: detected capacity change from 0 to 512 [ 379.376567][T12641] ext4: Bad value for 'data' [ 379.594408][T12091] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 380.591840][T12654] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2228'. [ 381.045211][T12677] syzkaller0: entered promiscuous mode [ 381.079456][T12677] syzkaller0: entered allmulticast mode [ 381.237009][T12686] loop1: detected capacity change from 0 to 1024 [ 381.941755][T12686] hfsplus: request for non-existent node 131072 in B*Tree [ 382.168675][T12686] hfsplus: request for non-existent node 131072 in B*Tree [ 384.266507][T12736] loop0: detected capacity change from 0 to 8 [ 384.881931][ T1155] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 60 seconds [ 384.893249][ T1155] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 60 seconds [ 384.904562][ T1155] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 60 seconds [ 384.915577][ T1155] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 60 seconds [ 385.283306][T12747] input: syz0 as /devices/virtual/input/input6 [ 386.075412][ T5815] IPVS: starting estimator thread 0... [ 386.118787][T12762] IPVS: lc: FWM 3 0x00000003 - no destination available [ 386.188051][T12763] IPVS: using max 24 ests per chain, 57600 per kthread [ 387.998691][T12793] IPVS: lc: FWM 3 0x00000003 - no destination available [ 389.456205][T12819] IPVS: lc: FWM 3 0x00000003 - no destination available [ 389.473160][T12803] loop1: detected capacity change from 0 to 32768 [ 390.305585][T12823] loop3: detected capacity change from 0 to 40427 [ 390.406501][T12823] F2FS-fs (loop3): invalid crc value [ 390.458347][T12847] IPVS: lc: FWM 3 0x00000003 - no destination available [ 390.465526][ T5814] IPVS: starting estimator thread 0... [ 390.507726][T12823] F2FS-fs (loop3): Found nat_bits in checkpoint [ 391.188699][T12823] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 391.267303][T12848] IPVS: using max 26 ests per chain, 62400 per kthread [ 392.040487][T12882] IPVS: lc: FWM 3 0x00000003 - no destination available [ 392.219800][T12885] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2290'. [ 392.232064][T12885] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2290'. [ 393.653675][T12906] syzkaller0: entered promiscuous mode [ 393.660084][T12906] syzkaller0: entered allmulticast mode [ 393.762815][T12911] IPVS: lc: FWM 3 0x00000003 - no destination available [ 393.849735][T12913] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2306'. [ 393.889167][T12913] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2306'. [ 394.212619][T12923] loop3: detected capacity change from 0 to 4096 [ 394.418103][T12923] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 395.609475][ T27] audit: type=1800 audit(1789270113.494:2): pid=12937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2309" name="file1" dev="loop3" ino=30 res=0 errno=0 [ 395.979855][T12942] IPVS: lc: FWM 3 0x00000003 - no destination available [ 396.011606][T12946] syzkaller0: entered promiscuous mode [ 396.034476][T12946] syzkaller0: entered allmulticast mode [ 396.070779][T12950] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2318'. [ 396.090996][T12950] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2318'. [ 397.622028][T12965] loop1: detected capacity change from 0 to 4096 [ 397.625176][T12973] IPVS: lc: FWM 3 0x00000003 - no destination available [ 397.767337][T12965] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 398.092882][T12984] syzkaller0: entered promiscuous mode [ 398.098807][T12984] syzkaller0: entered allmulticast mode [ 398.509255][ T27] audit: type=1800 audit(1789270116.314:3): pid=12986 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2324" name="file1" dev="loop1" ino=30 res=0 errno=0 [ 398.703091][T12992] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 399.534016][T12999] zero sized request [ 400.363806][T13005] IPVS: lc: FWM 3 0x00000003 - no destination available [ 400.477600][ T23] IPVS: starting estimator thread 0... [ 400.600911][T13006] IPVS: using max 19 ests per chain, 45600 per kthread [ 400.670286][T13012] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2338'. [ 401.509879][T13016] tipc: Enabling of bearer rejected, failed to enable media [ 401.527467][T13018] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2344'. [ 401.666371][T13016] syzkaller0: entered promiscuous mode [ 401.678483][T13016] syzkaller0: entered allmulticast mode [ 401.686675][T13020] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2345'. [ 401.707514][T13020] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2345'. [ 405.122358][T13030] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2348'. [ 405.143345][T13039] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 405.151044][T13039] IPv6: NLM_F_CREATE should be set when creating new route [ 405.159135][T13040] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 405.288891][T13044] IPVS: lc: FWM 3 0x00000003 - no destination available [ 405.391359][T13050] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2355'. [ 405.427428][T13050] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2355'. [ 406.092696][T13071] xt_hashlimit: size too large, truncated to 1048576 [ 406.125876][T13073] tipc: Enabling of bearer rejected, failed to enable media [ 406.204749][ T28] IPVS: starting estimator thread 0... [ 406.222124][T13057] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 406.317477][T13076] IPVS: using max 22 ests per chain, 52800 per kthread [ 406.431820][T13079] IPVS: lc: FWM 3 0x00000003 - no destination available [ 406.652463][T13083] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2367'. [ 406.684152][T13083] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2367'. [ 406.724653][T13085] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2368'. [ 407.107805][T11560] IPVS: stop unused estimator thread 0... [ 407.354087][T13097] tipc: Enabling of bearer rejected, failed to enable media [ 408.592470][T13113] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2377'. [ 408.602854][T13113] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2377'. [ 408.782886][T13115] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2378'. [ 409.224659][T13121] loop0: detected capacity change from 0 to 4096 [ 409.318684][T13121] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 410.151999][T13128] tipc: Enabling of bearer rejected, failed to enable media [ 411.350367][T13138] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2388'. [ 411.380449][T13138] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2388'. [ 411.923719][T13152] loop0: detected capacity change from 0 to 512 [ 411.948589][T13152] ext4: Bad value for 'data' [ 412.085805][ T9865] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 412.258654][T13157] tipc: Enabling of bearer rejected, failed to enable media [ 412.784233][T13160] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2395'. [ 413.140103][T13165] syzkaller0: entered promiscuous mode [ 413.145696][T13165] syzkaller0: entered allmulticast mode [ 413.293147][T13168] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2399'. [ 413.752392][T13177] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2403'. [ 413.868245][ T5786] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 413.884869][ T5786] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 413.894281][ T5786] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 413.905557][ T5786] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 413.923501][ T5786] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 413.931413][ T5786] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 414.515202][T13179] chnl_net:caif_netlink_parms(): no params data found [ 414.758789][T13179] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.776305][T13179] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.784248][T13179] bridge_slave_0: entered allmulticast mode [ 414.791964][T13179] bridge_slave_0: entered promiscuous mode [ 414.809268][T13199] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2405'. [ 414.827407][T13179] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.835081][T13179] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.844486][T13179] bridge_slave_1: entered allmulticast mode [ 414.852364][T13179] bridge_slave_1: entered promiscuous mode [ 414.903200][T13179] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 414.936179][T13179] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.997317][T13179] team0: Port device team_slave_0 added [ 415.011599][T13179] team0: Port device team_slave_1 added [ 415.019435][T13201] IPVS: lc: FWM 3 0x00000003 - no destination available [ 415.061389][T13179] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 415.070141][T13179] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 415.106062][T13179] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 415.130374][T13179] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 415.144478][T13179] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 415.171501][ C1] vkms_vblank_simulate: vblank timer overrun [ 415.189407][T13179] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 415.270386][T13179] hsr_slave_0: entered promiscuous mode [ 415.284450][T13179] hsr_slave_1: entered promiscuous mode [ 415.291827][T13179] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 415.299839][T13179] Cannot create hsr debugfs directory [ 415.306729][T13204] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2407'. [ 415.427959][ T1155] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 90 seconds [ 415.438804][ T1155] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 90 seconds [ 415.450630][ T1155] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 90 seconds [ 415.462216][ T1155] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 90 seconds [ 415.749968][T13179] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.764312][T13179] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.800924][T13208] syzkaller0: entered promiscuous mode [ 415.806475][T13208] syzkaller0: entered allmulticast mode [ 415.983641][T13179] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.987381][ T5786] Bluetooth: hci2: command tx timeout [ 416.000492][T13179] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.803223][T13179] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 416.813829][T13179] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.941485][T13221] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2413'. [ 417.073576][T13179] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 417.093274][T13179] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.329942][T13179] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 417.342018][T13179] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 417.354755][T13179] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 417.366788][T13179] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 417.478106][T13179] 8021q: adding VLAN 0 to HW filter on device bond0 [ 417.502819][T13179] 8021q: adding VLAN 0 to HW filter on device team0 [ 417.523059][ T1101] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.530237][ T1101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 417.546578][ T1101] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.553862][ T1101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 417.630725][T13179] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 417.900393][T13179] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 417.916303][T13253] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2423'. [ 417.996868][T13179] veth0_vlan: entered promiscuous mode [ 418.048077][T13179] veth1_vlan: entered promiscuous mode [ 418.067460][ T5786] Bluetooth: hci2: command tx timeout [ 418.091147][T13179] veth0_macvtap: entered promiscuous mode [ 418.448501][T13179] veth1_macvtap: entered promiscuous mode [ 418.839490][T13179] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 418.855087][T13179] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 418.877286][T13179] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 418.890254][T13179] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 418.913137][T13179] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 418.950396][T13179] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 418.985918][T13179] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 419.015989][T13179] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 419.038231][T13179] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 419.059222][T13179] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 419.077278][T13179] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 419.089226][T13179] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 419.444463][T13179] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.594306][T13179] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.745178][T13179] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.823454][T13179] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.051097][ T3431] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 420.075821][ T3431] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 420.126313][T11576] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 420.136492][T13283] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 420.145476][T11576] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 420.153717][ T5786] Bluetooth: hci2: command tx timeout [ 421.383666][T13285] loop3: detected capacity change from 0 to 32768 [ 421.433155][T13285] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.2434 (13285) [ 421.574327][T13285] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 421.605384][T13285] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 421.784057][T13285] BTRFS info (device loop3): setting nodatasum [ 421.895247][T13285] BTRFS info (device loop3): force zlib compression, level 3 [ 422.014401][T13285] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_LZO (0x8) [ 422.227368][T13285] BTRFS info (device loop3): use lzo compression, level 0 [ 422.257457][ T5786] Bluetooth: hci2: command tx timeout [ 422.267304][T13285] BTRFS info (device loop3): turning on flush-on-commit [ 422.333615][T13285] BTRFS info (device loop3): enabling auto defrag [ 422.340416][T13285] BTRFS info (device loop3): max_inline at 0 [ 422.367584][T13285] BTRFS info (device loop3): using free space tree [ 422.392073][T13299] loop1: detected capacity change from 0 to 4096 [ 422.544307][T13285] BTRFS info (device loop3): enabling ssd optimizations [ 422.583614][T13299] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 422.684367][T13323] netlink: 472 bytes leftover after parsing attributes in process `syz.2.2442'. [ 422.770571][T13323] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2442'. [ 423.359321][ T5779] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 423.568259][T13336] syzkaller0: entered promiscuous mode [ 423.587711][T13336] syzkaller0: entered allmulticast mode [ 423.764385][T13341] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2448'. [ 424.313532][T13353] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2450'. [ 425.129073][ T5778] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 425.150311][ T5778] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 425.178424][ T5778] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 425.196331][ T5778] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 425.214434][ T5778] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 425.224268][ T5778] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 426.246785][ T42] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 426.280642][ T42] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.437325][T13372] loop0: detected capacity change from 0 to 8 [ 427.111269][ T42] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 427.137502][ T42] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 427.268465][ T5786] Bluetooth: hci3: command tx timeout [ 427.298396][ T42] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 427.337320][ T42] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 427.493197][ T42] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 427.611994][ T42] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 427.679514][T13385] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2459'. [ 428.532024][T13390] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2462'. [ 428.627648][T13356] chnl_net:caif_netlink_parms(): no params data found [ 428.800538][ T42] tipc: Left network mode [ 428.837958][ T28] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 428.881960][T13398] jffs2: notice: (13398) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 429.258851][T13411] input: syz0 as /devices/virtual/input/input9 [ 429.357441][ T5786] Bluetooth: hci3: command tx timeout [ 429.493050][ T28] usb 1-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 429.622749][ T28] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.695764][ T28] usb 1-1: Product: syz [ 429.703202][ T28] usb 1-1: Manufacturer: syz [ 429.708741][ T28] usb 1-1: SerialNumber: syz [ 429.955247][T13356] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.964364][T13356] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.972252][T13356] bridge_slave_0: entered allmulticast mode [ 429.989044][T13356] bridge_slave_0: entered promiscuous mode [ 430.151672][T13356] bridge0: port 2(bridge_slave_1) entered blocking state [ 430.160733][T13356] bridge0: port 2(bridge_slave_1) entered disabled state [ 430.176327][T13356] bridge_slave_1: entered allmulticast mode [ 430.189077][T13356] bridge_slave_1: entered promiscuous mode [ 430.251155][ T28] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 430.465365][T13356] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 430.500096][T13356] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 430.759331][T13356] team0: Port device team_slave_0 added [ 430.805346][T13356] team0: Port device team_slave_1 added [ 431.003280][T13356] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 431.048676][T13356] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 431.106582][T13356] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 431.177888][T13356] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 431.184904][T13356] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 431.257615][T13356] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 431.334866][T13433] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2471'. [ 431.437314][ T5786] Bluetooth: hci3: command tx timeout [ 431.570688][ T28] usb 1-1: USB disconnect, device number 2 [ 431.619190][ T28] usblp0: removed [ 431.654371][T13356] hsr_slave_0: entered promiscuous mode [ 431.708961][T13356] hsr_slave_1: entered promiscuous mode [ 431.763871][T13356] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 431.776488][T13356] Cannot create hsr debugfs directory [ 431.816297][T13449] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2474'. [ 432.047511][T13456] input: syz0 as /devices/virtual/input/input10 [ 432.339812][ T42] hsr_slave_0: left promiscuous mode [ 432.660260][ T42] hsr_slave_1: left promiscuous mode [ 432.817398][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 432.824911][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 432.941481][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 432.960354][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 433.000601][ T42] bridge_slave_1: left allmulticast mode [ 433.023379][ T42] bridge_slave_1: left promiscuous mode [ 433.055064][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.086149][ T42] bridge_slave_0: left allmulticast mode [ 433.113486][ T42] bridge_slave_0: left promiscuous mode [ 433.138514][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 433.208648][ T42] veth1_vlan: left promiscuous mode [ 433.219674][ T42] veth0_vlan: left promiscuous mode [ 433.507928][ T5786] Bluetooth: hci3: command tx timeout [ 433.781443][ T42] bond5 (unregistering): Released all slaves [ 434.034247][ T42] bond4 (unregistering): Released all slaves [ 434.147557][ T5816] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 434.240014][ T42] bond3 (unregistering): Released all slaves [ 434.258988][ T42] bond2 (unregistering): Released all slaves [ 434.360534][ T5816] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 434.387206][ T5816] usb 2-1: config 0 interface 0 has no altsetting 0 [ 434.397328][ T5816] usb 2-1: New USB device found, idVendor=046d, idProduct=c09b, bcdDevice= 0.00 [ 434.406442][ T5816] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.463735][ T5816] usb 2-1: config 0 descriptor?? [ 434.524579][ T42] bond1 (unregistering): Released all slaves [ 435.441753][ T5816] usbhid 2-1:0.0: can't add hid device: -71 [ 435.460874][ T5816] usbhid: probe of 2-1:0.0 failed with error -71 [ 435.475812][ T5816] usb 2-1: USB disconnect, device number 3 [ 436.003092][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 436.056931][T13501] loop8: detected capacity change from 0 to 16384 [ 436.449923][ T24] I/O error, dev loop8, sector 1928 op 0x1:(WRITE) flags 0x800 phys_seg 15 prio class 2 [ 436.467565][ T24] Buffer I/O error on dev loop8, logical block 241, lost async page write [ 436.476723][ T24] Buffer I/O error on dev loop8, logical block 242, lost async page write [ 436.485809][ T24] Buffer I/O error on dev loop8, logical block 243, lost async page write [ 436.494797][ T24] Buffer I/O error on dev loop8, logical block 244, lost async page write [ 436.503739][ T24] Buffer I/O error on dev loop8, logical block 245, lost async page write [ 436.512982][ T24] Buffer I/O error on dev loop8, logical block 246, lost async page write [ 436.521884][ T24] Buffer I/O error on dev loop8, logical block 247, lost async page write [ 436.530926][ T24] Buffer I/O error on dev loop8, logical block 248, lost async page write [ 436.540365][ T24] Buffer I/O error on dev loop8, logical block 249, lost async page write [ 436.557273][ T24] Buffer I/O error on dev loop8, logical block 250, lost async page write [ 436.595996][T13501] I/O error, dev loop8, sector 2048 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 436.625350][T13498] I/O error, dev loop8, sector 5392 op 0x0:(READ) flags 0x80700 phys_seg 24 prio class 2 [ 437.170455][ T42] bond0 (unregistering): Released all slaves [ 437.312725][T13519] loop1: detected capacity change from 0 to 164 [ 437.320950][T13519] ======================================================= [ 437.320950][T13519] WARNING: The mand mount option has been deprecated and [ 437.320950][T13519] and is ignored by this kernel. Remove the mand [ 437.320950][T13519] option from the mount to silence this warning. [ 437.320950][T13519] ======================================================= [ 437.668271][T13474] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2480'. [ 438.396511][T13528] rock: directory entry would overflow storage [ 438.403389][T13528] rock: sig=0x4f50, size=4, remaining=3 [ 438.409711][T13528] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 438.720854][T13531] loop0: detected capacity change from 0 to 256 [ 438.845683][T13531] exFAT-fs (loop0): failed to load upcase table (idx : 0x00011a39, chksum : 0xd7c18d7b, utbl_chksum : 0xe619d30d) [ 438.975643][ T27] audit: type=1800 audit(1789270156.864:4): pid=13531 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2494" name="file0" dev="loop0" ino=1048599 res=0 errno=0 [ 439.073436][T13533] netlink: 16142 bytes leftover after parsing attributes in process `syz.1.2495'. [ 439.859552][ T42] IPVS: stop unused estimator thread 0... [ 440.391263][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.417032][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.854250][T13546] loop1: detected capacity change from 0 to 32768 [ 440.936823][T13546] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.2498 (13546) [ 440.989673][T13356] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 441.016059][T13546] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 441.018166][T13356] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 441.044339][T13546] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 441.072748][T13546] BTRFS info (device loop1): setting nodatasum [ 441.079381][T13546] BTRFS info (device loop1): force zlib compression, level 3 [ 441.084823][T13569] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2501'. [ 441.086819][T13546] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 441.106709][T13546] BTRFS info (device loop1): use lzo compression, level 0 [ 441.114684][T13546] BTRFS info (device loop1): turning on flush-on-commit [ 441.127783][T13546] BTRFS info (device loop1): enabling auto defrag [ 441.134445][T13546] BTRFS info (device loop1): max_inline at 0 [ 441.141382][T13356] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 441.166670][T13546] BTRFS info (device loop1): using free space tree [ 441.178892][T13356] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 441.303137][T13546] BTRFS info (device loop1): enabling ssd optimizations [ 441.381069][T13592] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2502'. [ 441.496770][T13356] 8021q: adding VLAN 0 to HW filter on device bond0 [ 441.568462][T13356] 8021q: adding VLAN 0 to HW filter on device team0 [ 441.611634][T11576] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.619026][T11576] bridge0: port 1(bridge_slave_0) entered forwarding state [ 441.695006][ T1101] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.702292][ T1101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 441.733728][T12091] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 442.715889][T13356] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 443.182549][T13356] veth0_vlan: entered promiscuous mode [ 443.615392][T13356] veth1_vlan: entered promiscuous mode [ 443.812481][T13356] veth0_macvtap: entered promiscuous mode [ 443.856136][T13356] veth1_macvtap: entered promiscuous mode [ 443.952192][T13356] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 443.983496][T13356] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 443.994212][T13356] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 444.010810][T13356] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 444.024672][T13356] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 444.067686][T13356] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 444.109360][T13356] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 444.148520][T13356] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 444.183678][T13356] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 444.204190][T13356] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 444.213729][T13650] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2513'. [ 444.232531][T13356] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 444.246160][T13356] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 444.260412][T13356] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.271711][T13356] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.281054][T13356] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.290186][T13356] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.934789][T11560] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 445.110783][T11560] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.508001][T13352] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 120 seconds [ 445.549953][T13352] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 120 seconds [ 445.598374][T13352] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 120 seconds [ 445.646038][T13352] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 120 seconds [ 447.726186][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.878066][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 449.334326][T13685] input: syz0 as /devices/virtual/input/input11 [ 449.374369][T13684] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2518'. [ 451.211844][ T969] hid-generic 0005:16C0:5505.0002: item fetching failed at offset 0/1 [ 451.264931][ T969] hid-generic: probe of 0005:16C0:5505.0002 failed with error -22 [ 451.359579][T13694] syzkaller0: entered promiscuous mode [ 451.381742][T13694] syzkaller0: entered allmulticast mode [ 451.592521][ T172] IPVS: starting estimator thread 0... [ 451.608842][T13712] IPVS: lc: FWM 3 0x00000003 - no destination available [ 451.717547][T13715] IPVS: using max 22 ests per chain, 52800 per kthread [ 451.731160][ T5778] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 451.755895][ T5778] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 451.799566][ T5778] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 451.809306][ T5778] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 451.817085][ T5778] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 451.824734][ T5778] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 453.063942][T13724] loop3: detected capacity change from 0 to 32768 [ 453.091287][T13724] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.2525 (13724) [ 453.151873][T13724] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 453.172825][T13724] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 453.193926][T13724] BTRFS info (device loop3): setting nodatasum [ 453.205151][T13724] BTRFS info (device loop3): force zlib compression, level 3 [ 453.212851][T13724] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_LZO (0x8) [ 453.229541][T13724] BTRFS info (device loop3): use lzo compression, level 0 [ 453.248282][T13724] BTRFS info (device loop3): turning on flush-on-commit [ 453.261319][T13724] BTRFS info (device loop3): enabling auto defrag [ 453.268832][T13724] BTRFS info (device loop3): max_inline at 0 [ 453.280553][T13724] BTRFS info (device loop3): using free space tree [ 453.526969][T13724] BTRFS info (device loop3): enabling ssd optimizations [ 453.764097][T13356] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 453.912361][ T5778] Bluetooth: hci0: command tx timeout [ 454.563752][T13764] input: syz0 as /devices/virtual/input/input12 [ 455.843862][T13771] loop3: detected capacity change from 0 to 32768 [ 455.946589][ T27] audit: type=1800 audit(1789270173.834:5): pid=13771 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2532" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 455.992718][ T5778] Bluetooth: hci0: command tx timeout [ 457.071213][ T5775] bond1: (slave syz_tun): Removing an active aggregator [ 457.079663][ T5775] bond1: (slave syz_tun): Releasing backup interface [ 457.397796][T13778] IPVS: lc: FWM 3 0x00000003 - no destination available [ 457.797071][ T49] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 457.984644][ T49] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.070426][ T5778] Bluetooth: hci0: command tx timeout [ 458.331770][T13790] loop0: detected capacity change from 0 to 256 [ 458.359513][T13790] exfat: Deprecated parameter 'namecase' [ 458.380958][ T49] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 458.392449][ T49] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.467236][T13796] loop1: detected capacity change from 0 to 8 [ 458.580973][T13790] exFAT-fs (loop0): failed to load upcase table (idx : 0x0001fe89, chksum : 0x84f53455, utbl_chksum : 0xe619d30d) [ 459.221077][T13792] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2535'. [ 459.349327][ T49] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.388947][ T49] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.541855][ T49] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.558809][ T49] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.842657][T13717] chnl_net:caif_netlink_parms(): no params data found [ 459.965598][T13817] syzkaller0: entered promiscuous mode [ 459.982621][T13817] syzkaller0: entered allmulticast mode [ 460.137733][T13824] IPVS: lc: FWM 3 0x00000003 - no destination available [ 460.147564][ T5778] Bluetooth: hci0: command tx timeout [ 460.438717][T13811] loop3: detected capacity change from 0 to 32768 [ 460.563773][T13811] ERROR: (device loop3): diAllocAG: nfreeinos = 0, but iag on freelist [ 460.563773][T13811] [ 460.659613][T13811] ERROR: (device loop3): remounting filesystem as read-only [ 460.776729][T13811] ialloc: diAlloc returned -5! [ 461.796998][T13842] loop0: detected capacity change from 0 to 8 [ 463.018898][T13847] loop0: detected capacity change from 0 to 32768 [ 463.037690][T13847] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.2548 (13847) [ 463.056638][T13847] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 463.067584][T13847] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 463.076404][T13847] BTRFS info (device loop0): use zlib compression, level 3 [ 463.084309][T13847] BTRFS info (device loop0): turning on sync discard [ 463.091076][T13847] BTRFS info (device loop0): using free space tree [ 463.252037][T13847] BTRFS info (device loop0): enabling ssd optimizations [ 463.927944][ T27] audit: type=1800 audit(1789270181.644:6): pid=13868 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2548" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 464.422435][T13179] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 466.214828][T13880] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2552'. [ 466.227812][T13880] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2552'. [ 467.858096][T13890] loop8: detected capacity change from 0 to 16384 [ 468.453404][ T49] tipc: Left network mode [ 468.498084][T13717] bridge0: port 1(bridge_slave_0) entered blocking state [ 468.514782][T13717] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.563193][T13717] bridge_slave_0: entered allmulticast mode [ 468.638684][T13717] bridge_slave_0: entered promiscuous mode [ 468.665379][T13896] loop3: detected capacity change from 0 to 4096 [ 468.682228][T13717] bridge0: port 2(bridge_slave_1) entered blocking state [ 468.689555][T13717] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.703056][T13717] bridge_slave_1: entered allmulticast mode [ 468.712657][T13717] bridge_slave_1: entered promiscuous mode [ 468.865776][T13896] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 469.131873][T13904] loop1: detected capacity change from 0 to 512 [ 469.179811][T13717] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 469.408344][T13904] EXT4-fs (loop1): bad s_min_extra_isize: 544 [ 469.583284][T13717] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 470.257728][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 470.526337][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 470.662722][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 470.782594][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 470.942387][ T9] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 471.016677][T13717] team0: Port device team_slave_0 added [ 471.049747][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.087115][T13717] team0: Port device team_slave_1 added [ 471.109442][ T9] usb 1-1: config 0 descriptor?? [ 471.422550][T13924] syzkaller0: entered promiscuous mode [ 471.430085][T13924] syzkaller0: entered allmulticast mode [ 471.821130][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 471.910882][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 471.980043][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.311027][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.318643][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.326125][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.344826][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.371164][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.391671][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.417046][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.446664][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.472283][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.483308][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.508627][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.532695][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 472.566653][ T9] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 472.648923][ T9] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 473.364053][ T5833] usb 1-1: USB disconnect, device number 3 [ 474.512300][T13942] loop1: detected capacity change from 0 to 2048 [ 474.623729][T13943] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 475.131969][T13943] NILFS (loop1): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3) [ 475.146963][T13943] NILFS error (device loop1): nilfs_bmap_propagate: broken bmap (inode number=4) [ 475.175011][T13943] Remounting filesystem read-only [ 475.185810][T11576] NILFS (loop1): discard dirty page: offset=4096, ino=6 [ 475.193411][T11576] NILFS (loop1): discard dirty block: blocknr=39, size=1024 [ 475.200905][T11576] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.210293][T11576] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.219393][T11576] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.230319][T11576] NILFS (loop1): discard dirty page: offset=0, ino=2 [ 475.237091][T11576] NILFS (loop1): discard dirty block: blocknr=18, size=1024 [ 475.249010][T11576] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.258443][T11576] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.268276][T11576] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.277660][T11576] NILFS (loop1): discard dirty page: offset=0, ino=5 [ 475.284522][T11576] NILFS (loop1): discard dirty block: blocknr=41, size=1024 [ 475.292323][T11576] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.301328][T11576] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.310326][T11576] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.390049][T12091] NILFS (loop1): disposed unprocessed dirty file(s) when stopping log writer [ 475.531045][T12091] NILFS (loop1): discard dirty page: offset=0, ino=6 [ 475.546155][T12091] NILFS (loop1): discard dirty block: blocknr=35, size=1024 [ 475.556762][T12091] NILFS (loop1): discard dirty block: blocknr=36, size=1024 [ 475.565164][T12091] NILFS (loop1): discard dirty block: blocknr=37, size=1024 [ 475.573176][T12091] NILFS (loop1): discard dirty block: blocknr=38, size=1024 [ 475.588089][ T1155] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 150 seconds [ 475.610295][T12091] NILFS (loop1): discard dirty page: offset=0, ino=4 [ 475.617069][T12091] NILFS (loop1): discard dirty block: blocknr=40, size=1024 [ 475.618624][ T1155] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 150 seconds [ 475.625926][T12091] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.647503][ T1155] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 150 seconds [ 475.659689][T12091] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.668785][T12091] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.678122][T12091] NILFS (loop1): discard dirty page: offset=0, ino=3 [ 475.685220][T12091] NILFS (loop1): discard dirty block: blocknr=42, size=1024 [ 475.696453][T12091] NILFS (loop1): discard dirty block: blocknr=43, size=1024 [ 475.704390][ T1155] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 150 seconds [ 475.715523][T12091] NILFS (loop1): discard dirty block: blocknr=44, size=1024 [ 475.722935][T12091] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.732707][T12091] NILFS (loop1): discard dirty page: offset=196608, ino=3 [ 475.740394][T12091] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.749472][T12091] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.759688][T12091] NILFS (loop1): discard dirty block: blocknr=49, size=1024 [ 475.767040][T12091] NILFS (loop1): discard dirty block: blocknr=18446744073709551615, size=1024 [ 475.886374][T13945] loop1: detected capacity change from 0 to 4096 [ 476.005927][T13945] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 477.002978][T13949] input: syz1 as /devices/virtual/input/input13 [ 478.405041][T13717] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 478.439096][T13717] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 478.517198][T13717] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 478.560810][T13717] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 478.583028][T13717] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 478.743196][T13717] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 479.755967][T13964] syzkaller0: entered promiscuous mode [ 479.761954][T13964] syzkaller0: entered allmulticast mode [ 479.850637][T13976] loop1: detected capacity change from 0 to 4096 [ 479.930125][T13976] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 484.740953][ T49] batman_adv: batadv0: Interface deactivated: gretap1 [ 484.805100][ T49] batman_adv: batadv0: Removing interface: gretap1 [ 485.006622][T13995] syzkaller0: entered promiscuous mode [ 485.017233][T13995] syzkaller0: entered allmulticast mode [ 488.486683][T13717] hsr_slave_0: entered promiscuous mode [ 488.493791][T13717] hsr_slave_1: entered promiscuous mode [ 488.500635][T13717] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 488.511498][T13717] Cannot create hsr debugfs directory [ 488.563508][T14023] syzkaller0: entered promiscuous mode [ 488.575464][T14023] syzkaller0: entered allmulticast mode [ 488.819676][T14048] loop1: detected capacity change from 0 to 4096 [ 488.881472][T14048] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 489.970915][T14060] loop1: detected capacity change from 0 to 4096 [ 490.003113][T14060] EXT4-fs (loop1): Test dummy encryption mode enabled [ 490.034420][T14060] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 491.391296][T12091] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 493.094051][T14077] loop1: detected capacity change from 0 to 4096 [ 493.224350][ T9865] I/O error, dev loop1, sector 3968 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 494.622011][T14085] syzkaller0: entered promiscuous mode [ 494.628400][T14085] syzkaller0: entered allmulticast mode [ 494.794302][T14098] jffs2: notice: (14098) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 497.133679][T14113] loop3: detected capacity change from 0 to 32768 [ 500.280162][T14135] loop3: detected capacity change from 0 to 8 [ 500.346314][T14136] jffs2: notice: (14136) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 500.958417][ T49] hsr_slave_0: left promiscuous mode [ 501.207559][ T49] hsr_slave_1: left promiscuous mode [ 501.241372][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 501.313155][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 501.388269][ T49] bridge_slave_1: left allmulticast mode [ 501.396733][ T49] bridge_slave_1: left promiscuous mode [ 501.414356][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.443280][ T49] bridge_slave_0: left allmulticast mode [ 501.461995][ T49] bridge_slave_0: left promiscuous mode [ 501.482380][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.663294][ T49] veth1_vlan: left promiscuous mode [ 501.679112][ T49] veth0_vlan: left promiscuous mode [ 501.833854][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.849136][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.922366][ T5816] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 503.176970][ T5816] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 8192, setting to 64 [ 503.266398][ T5816] usb 4-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice= 1.00 [ 503.303273][ T5816] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 503.348800][ T49] bond5 (unregistering): Released all slaves [ 503.390636][ T5816] usb 4-1: Product: syz [ 503.432417][ T5816] usb 4-1: Manufacturer: syz [ 503.768081][ T49] bond4 (unregistering): Released all slaves [ 503.779503][ T5816] input: Samsung SUR40 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input14 [ 503.818489][ T5816] usb 4-1: USB disconnect, device number 2 [ 503.852179][ T49] bond3 (unregistering): Released all slaves [ 503.940329][ T49] bond2 (unregistering): Released all slaves [ 504.224753][ T49] bond1 (unregistering): Released all slaves [ 505.012609][ T49] team0 (unregistering): Port device team_slave_1 removed [ 505.074704][ T49] team0 (unregistering): Port device team_slave_0 removed [ 505.131334][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 505.557340][ T49] bond0 (unregistering): Released all slaves [ 505.675035][ T1155] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 180 seconds [ 505.686027][ T1155] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 180 seconds [ 505.697411][ T1155] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 180 seconds [ 505.720977][ T1155] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 180 seconds [ 505.796445][T14138] syzkaller0: entered promiscuous mode [ 505.802103][T14138] syzkaller0: entered allmulticast mode [ 507.437648][ T5141] udevd[5141]: worker [6535] /devices/virtual/block/nbd0 timeout; kill it [ 507.464923][ T5141] udevd[5141]: seq 15563 '/devices/virtual/block/nbd0' killed [ 508.567791][T14208] loop1: detected capacity change from 0 to 8 [ 508.686000][T14212] loop3: detected capacity change from 0 to 256 [ 508.829565][T14212] exfat: Deprecated parameter 'namecase' [ 509.053928][ T5778] Bluetooth: hci4: command 0x0406 tx timeout [ 509.169519][T14212] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0x84f53455, utbl_chksum : 0xe619d30d) [ 509.672512][ T49] IPVS: stop unused estimator thread 0... [ 509.788085][ T5778] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 509.799848][ T5778] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 509.825647][ T5778] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 509.840674][ T5778] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 509.850076][ T5778] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 509.866719][ T5778] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 511.325019][T14238] syzkaller0: entered promiscuous mode [ 511.330746][T14238] syzkaller0: entered allmulticast mode [ 511.917429][ T5778] Bluetooth: hci1: command tx timeout [ 513.988216][ T5778] Bluetooth: hci1: command tx timeout [ 514.176860][T14217] chnl_net:caif_netlink_parms(): no params data found [ 514.628112][T14295] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2623'. [ 514.807685][T14217] bridge0: port 1(bridge_slave_0) entered blocking state [ 514.826172][T14217] bridge0: port 1(bridge_slave_0) entered disabled state [ 514.857627][T14217] bridge_slave_0: entered allmulticast mode [ 514.880570][T14217] bridge_slave_0: entered promiscuous mode [ 514.923657][T14217] bridge0: port 2(bridge_slave_1) entered blocking state [ 514.930792][T14305] loop0: detected capacity change from 0 to 4096 [ 514.979558][T14309] process 'syz.1.2621' launched './file0' with NULL argv: empty string added [ 514.981151][T14217] bridge0: port 2(bridge_slave_1) entered disabled state [ 515.005921][T14217] bridge_slave_1: entered allmulticast mode [ 515.020267][T14305] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 515.023786][T14217] bridge_slave_1: entered promiscuous mode [ 515.071449][T11560] hsr_slave_0: left promiscuous mode [ 515.287325][T11560] hsr_slave_1: left promiscuous mode [ 515.305505][T11560] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 515.331231][T11560] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 515.380274][T11560] bridge_slave_1: left allmulticast mode [ 515.386073][T11560] bridge_slave_1: left promiscuous mode [ 515.393089][T11560] bridge0: port 2(bridge_slave_1) entered disabled state [ 515.408931][T11560] bridge_slave_0: left allmulticast mode [ 515.428837][T11560] bridge_slave_0: left promiscuous mode [ 515.445654][T11560] bridge0: port 1(bridge_slave_0) entered disabled state [ 516.037920][T11560] team0 (unregistering): Port device team_slave_1 removed [ 516.074858][ T5778] Bluetooth: hci1: command tx timeout [ 516.151560][T11560] team0 (unregistering): Port device team_slave_0 removed [ 516.214571][T14325] loop0: detected capacity change from 0 to 512 [ 516.233001][T11560] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 516.238578][T14325] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 516.292120][T14325] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 516.357793][T14325] EXT4-fs (loop0): 1 truncate cleaned up [ 516.368780][T14325] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 516.383099][T11560] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 517.070602][T13179] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 517.150343][T11560] bond0 (unregistering): Released all slaves [ 517.411914][T14217] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 517.450286][T14217] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 517.563113][T14217] team0: Port device team_slave_0 added [ 517.605895][T14217] team0: Port device team_slave_1 added [ 517.651570][T14340] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 517.693866][T14217] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 517.747295][T14217] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 517.811341][T14217] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 517.840413][T14217] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 517.879167][T14217] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 517.960915][T14217] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 518.147238][ T5778] Bluetooth: hci1: command tx timeout [ 519.747986][T14217] hsr_slave_0: entered promiscuous mode [ 519.794035][T14217] hsr_slave_1: entered promiscuous mode [ 520.173982][T14365] jffs2: notice: (14365) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 520.212360][T14363] loop0: detected capacity change from 0 to 4096 [ 520.342388][T14363] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 520.615582][T14376] loop1: detected capacity change from 0 to 4096 [ 520.808534][T14373] block device autoloading is deprecated and will be removed. [ 522.387836][ T5816] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 522.718544][ T5816] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 522.788187][ T5816] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 522.823104][ T5816] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.860771][ T5816] usb 2-1: config 0 descriptor?? [ 522.904052][ T5816] pwc: Askey VC010 type 2 USB webcam detected. [ 523.097480][ T5816] pwc: send_video_command error -71 [ 523.123279][ T5816] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 523.157315][ T5816] Philips webcam: probe of 2-1:0.0 failed with error -71 [ 523.195953][ T5816] usb 2-1: USB disconnect, device number 4 [ 523.252699][T14406] netlink: 300 bytes leftover after parsing attributes in process `syz.3.2646'. [ 523.416052][T14398] syzkaller0: entered promiscuous mode [ 523.432654][T14398] syzkaller0: entered allmulticast mode [ 523.557538][T14411] loop3: detected capacity change from 0 to 4096 [ 523.640292][T14411] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 523.697367][ T5816] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 523.899477][ T5816] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 523.915607][ T5816] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 523.940418][ T5816] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.951123][ T5816] usb 2-1: config 0 descriptor?? [ 523.961073][ T5816] pwc: Askey VC010 type 2 USB webcam detected. [ 524.377900][ T5816] pwc: recv_control_msg error -32 req 02 val 2b00 [ 524.386926][ T5816] pwc: recv_control_msg error -32 req 02 val 2700 [ 524.395867][ T5816] pwc: recv_control_msg error -32 req 02 val 2c00 [ 524.410258][ T5816] pwc: recv_control_msg error -32 req 04 val 1000 [ 524.427864][ T5816] pwc: recv_control_msg error -32 req 04 val 1300 [ 524.437555][ T5816] pwc: recv_control_msg error -32 req 04 val 1400 [ 524.453433][ T5816] pwc: recv_control_msg error -32 req 02 val 2000 [ 524.461461][ T5816] pwc: recv_control_msg error -32 req 02 val 2100 [ 524.474994][ T5816] pwc: recv_control_msg error -32 req 04 val 1500 [ 524.483256][ T5816] pwc: recv_control_msg error -32 req 02 val 2500 [ 524.703963][ T5816] pwc: recv_control_msg error -71 req 02 val 2600 [ 524.714403][ T5816] pwc: recv_control_msg error -71 req 02 val 2900 [ 524.741719][ T5816] pwc: recv_control_msg error -71 req 02 val 2800 [ 524.751442][ T5816] pwc: recv_control_msg error -71 req 04 val 1100 [ 524.763550][ T5816] pwc: recv_control_msg error -71 req 04 val 1200 [ 524.808837][ T5816] pwc: Registered as video103. [ 524.824743][ T5816] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input15 [ 524.850688][ T5816] usb 2-1: USB disconnect, device number 5 [ 525.836029][T14429] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2651'. [ 525.848762][T14429] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2651'. [ 527.849694][T14217] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 527.856674][T14436] loop1: detected capacity change from 0 to 256 [ 527.874250][T14436] exfat: Deprecated parameter 'namecase' [ 527.894470][T14217] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 527.931169][T14436] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001fe89, chksum : 0x84f53455, utbl_chksum : 0xe619d30d) [ 528.026385][T14217] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 528.056912][T14217] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 528.149447][T14445] syzkaller0: entered promiscuous mode [ 528.174903][T14445] syzkaller0: entered allmulticast mode [ 528.489166][T14459] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2659'. [ 528.503397][T14459] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2659'. [ 528.935455][T14217] 8021q: adding VLAN 0 to HW filter on device bond0 [ 529.331984][T14217] 8021q: adding VLAN 0 to HW filter on device team0 [ 529.420474][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.427703][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 529.469996][T11553] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.477248][T11553] bridge0: port 2(bridge_slave_1) entered forwarding state [ 529.575367][T14468] jffs2: notice: (14468) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 530.094227][T14465] syzkaller0: entered promiscuous mode [ 530.163431][T14465] syzkaller0: entered allmulticast mode [ 530.506847][T14479] loop0: detected capacity change from 0 to 4096 [ 530.582696][T14481] loop3: detected capacity change from 0 to 256 [ 530.595095][T14479] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 530.601926][T14481] exfat: Deprecated parameter 'namecase' [ 530.703747][T14481] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0x84f53455, utbl_chksum : 0xe619d30d) [ 531.548795][T14503] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2669'. [ 531.564152][T14503] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2669'. [ 533.063759][T14512] jffs2: notice: (14512) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 533.834078][T14217] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 533.892182][T14217] veth0_vlan: entered promiscuous mode [ 533.905746][T14217] veth1_vlan: entered promiscuous mode [ 534.045306][T14217] veth0_macvtap: entered promiscuous mode [ 534.161318][T14217] veth1_macvtap: entered promiscuous mode [ 534.276914][T14217] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 534.287966][T14217] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.301551][T14217] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 534.314751][T14217] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.527146][T14217] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 534.570381][T14217] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.624524][T14217] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 534.718664][T14217] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 534.764212][T14217] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.810826][T14217] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 534.863297][T14217] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.895457][T14217] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 534.941087][T14217] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.975019][T14217] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 535.117367][T14528] syzkaller0: entered promiscuous mode [ 535.122945][T14528] syzkaller0: entered allmulticast mode [ 535.174496][T14517] loop3: detected capacity change from 0 to 32768 [ 535.199508][T14517] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.2671 (14517) [ 535.239472][T14517] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 535.261121][T14517] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 535.281848][T14517] BTRFS info (device loop3): using free space tree [ 535.454969][T14517] BTRFS info (device loop3): enabling ssd optimizations [ 535.487788][T14517] BTRFS info (device loop3): auto enabling async discard [ 535.755927][ T1155] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 210 seconds [ 535.767870][ T1155] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 210 seconds [ 535.779167][ T1155] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 210 seconds [ 535.790506][ T1155] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 210 seconds [ 536.094348][T13356] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 538.755092][T14217] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.783490][T14217] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.807413][T14217] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.823167][T14217] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.996248][T14589] loop0: detected capacity change from 0 to 4096 [ 539.142192][T14589] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 539.153545][T11553] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 539.188722][T11553] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 539.285880][T11553] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 539.347367][T11553] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 539.753897][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 539.794942][T14606] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2679'. [ 539.806902][T14606] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2679'. [ 540.538263][T14617] futex_wake_op: syz.2.2516 tries to shift op by 144; fix this program [ 540.606259][T14626] syzkaller0: entered promiscuous mode [ 540.627023][T14626] syzkaller0: entered allmulticast mode [ 541.539580][T14642] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2685'. [ 544.487293][T14672] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2691'. [ 544.499834][T14672] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2691'. [ 546.026684][T14695] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2695'. [ 547.085582][T14700] input: syz0 as /devices/virtual/input/input16 [ 547.679337][T14705] syzkaller0: entered promiscuous mode [ 547.685124][T14705] syzkaller0: entered allmulticast mode [ 547.809996][T14703] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2699'. [ 550.059825][T14755] syzkaller0: entered promiscuous mode [ 550.098384][T14755] syzkaller0: entered allmulticast mode [ 550.126756][T14754] syzkaller0: entered promiscuous mode [ 550.136109][T14754] syzkaller0: entered allmulticast mode [ 550.284099][T14759] input: syz0 as /devices/virtual/input/input17 [ 550.482466][T14761] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2712'. [ 551.516793][T14763] loop3: detected capacity change from 0 to 4096 [ 551.661977][T14763] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 552.143939][T14784] syzkaller0: entered promiscuous mode [ 552.150397][T14784] syzkaller0: entered allmulticast mode [ 552.276950][T14769] loop1: detected capacity change from 0 to 32768 [ 553.015357][T14791] loop0: detected capacity change from 0 to 8 [ 553.085867][T14792] input: syz0 as /devices/virtual/input/input18 [ 553.280409][T14794] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2724'. [ 553.508895][T14796] syzkaller0: entered promiscuous mode [ 553.514923][T14796] syzkaller0: entered allmulticast mode [ 553.780495][T14798] loop3: detected capacity change from 0 to 40427 [ 553.795881][T14798] F2FS-fs (loop3): invalid crc value [ 553.819451][T14798] F2FS-fs (loop3): Found nat_bits in checkpoint [ 553.955090][T14798] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 554.450175][T14808] loop1: detected capacity change from 0 to 32768 [ 554.615961][T14808] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.2729 (14808) [ 555.834689][T14808] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 555.847001][T14808] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 555.855808][T14808] BTRFS info (device loop1): use zlib compression, level 3 [ 555.863086][T14808] BTRFS info (device loop1): turning on sync discard [ 555.869937][T14808] BTRFS info (device loop1): using free space tree [ 556.091520][T14815] loop2: detected capacity change from 0 to 32768 [ 556.142093][T14815] BTRFS warning: duplicate device /dev/loop2 devid 1 generation 8 scanned by syz.2.2730 (14815) [ 556.276965][T14808] BTRFS info (device loop1): enabling ssd optimizations [ 556.364086][T13356] syz-executor: attempt to access beyond end of device [ 556.364086][T13356] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 557.051979][ T27] audit: type=1800 audit(1789270274.934:7): pid=14836 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2729" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 557.383633][T13356] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 557.521446][T12091] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 557.543103][T11939] BTRFS warning: duplicate device /dev/loop2 devid 1 generation 8 scanned by udevd (11939) [ 557.714584][T14842] jffs2: notice: (14842) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 558.635556][T14847] input: syz0 as /devices/virtual/input/input19 [ 558.664308][ T9865] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 10 /dev/loop1 scanned by udevd (9865) [ 559.559056][T14857] syzkaller0: entered promiscuous mode [ 559.616441][T14857] syzkaller0: entered allmulticast mode [ 559.801232][T14861] loop1: detected capacity change from 0 to 4096 [ 559.905470][T14861] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 560.936478][T14879] loop1: detected capacity change from 0 to 32768 [ 560.937642][ T5778] Bluetooth: hci3: SCO packet for unknown connection handle 0 [ 560.953945][T14879] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 560.972567][T14879] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 560.981248][T14879] BTRFS info (device loop1): use zlib compression, level 3 [ 560.988485][T14879] BTRFS info (device loop1): turning on sync discard [ 560.995181][T14879] BTRFS info (device loop1): using free space tree [ 561.066698][T14887] jffs2: notice: (14887) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 561.208067][T14879] BTRFS info (device loop1): enabling ssd optimizations [ 561.888983][T12091] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 561.997937][T14909] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2747'. [ 562.211851][T14922] input: syz0 as /devices/virtual/input/input20 [ 562.275208][T14924] syzkaller0: entered promiscuous mode [ 562.299433][T14924] syzkaller0: entered allmulticast mode [ 563.280937][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.480419][T14931] loop2: detected capacity change from 0 to 32768 [ 563.494790][T14931] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.2755 (14931) [ 563.510938][T14931] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 563.521904][T14931] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 563.530681][T14931] BTRFS info (device loop2): use zlib compression, level 3 [ 563.537966][T14931] BTRFS info (device loop2): turning on sync discard [ 563.544711][T14931] BTRFS info (device loop2): using free space tree [ 563.637686][ T5815] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 563.779382][T14934] loop0: detected capacity change from 0 to 32768 [ 563.787736][T14934] BTRFS warning: duplicate device /dev/loop0 devid 1 generation 8 scanned by syz.0.2756 (14934) [ 563.842169][T14931] BTRFS info (device loop2): enabling ssd optimizations [ 563.850712][ T5815] usb 2-1: Using ep0 maxpacket: 8 [ 563.875028][ T5815] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 563.893562][ T5815] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF9, skipping [ 564.124917][ T5815] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 564.136953][ T5815] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 564.153134][ T5815] usb 2-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 565.207821][ T27] audit: type=1800 audit(1789270282.124:8): pid=14955 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2755" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 565.228290][ C0] vkms_vblank_simulate: vblank timer overrun [ 565.552225][ T5815] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.560530][ T5815] usb 2-1: Product: syz [ 565.566142][ T5815] usb 2-1: Manufacturer: syz [ 565.576912][ T5815] usb 2-1: SerialNumber: syz [ 565.607023][ T5815] usb 2-1: config 0 descriptor?? [ 565.620838][T14929] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 565.671314][T14217] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 565.680111][ T5815] ati_remote 2-1:0.0: ati_remote_probe: Unexpected desc.bNumEndpoints [ 565.849670][ T1155] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 240 seconds [ 565.860566][ T1155] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 240 seconds [ 565.873175][ T1155] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 240 seconds [ 565.887263][ T1155] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 240 seconds [ 565.892178][T14964] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2759'. [ 566.003112][T14968] input: syz0 as /devices/virtual/input/input21 [ 567.183114][T14980] syzkaller0: entered promiscuous mode [ 567.192041][T14980] syzkaller0: entered allmulticast mode [ 567.384851][T14987] IPVS: lc: FWM 3 0x00000003 - no destination available [ 567.392136][ T23] IPVS: starting estimator thread 0... [ 567.487219][T14989] IPVS: using max 18 ests per chain, 43200 per kthread [ 567.662489][T14990] loop0: detected capacity change from 0 to 32768 [ 567.708396][T14990] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.2767 (14990) [ 567.760310][T14992] loop2: detected capacity change from 0 to 32768 [ 567.772381][T14990] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 567.772496][T14992] BTRFS warning: duplicate device /dev/loop2 devid 1 generation 8 scanned by syz.2.2768 (14992) [ 567.782900][T14990] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 567.802028][T14990] BTRFS info (device loop0): use zlib compression, level 3 [ 567.809412][T14990] BTRFS info (device loop0): turning on sync discard [ 567.816817][T14990] BTRFS info (device loop0): using free space tree [ 567.978199][T14990] BTRFS info (device loop0): enabling ssd optimizations [ 569.177378][ T27] audit: type=1800 audit(1789270286.464:9): pid=15011 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2767" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 569.213935][ T5788] BTRFS warning: duplicate device /dev/loop2 devid 1 generation 8 scanned by udevd (5788) [ 569.234250][ T5833] usb 2-1: USB disconnect, device number 6 [ 569.463744][T13179] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 569.564957][T15018] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2771'. [ 569.577131][T15018] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2771'. [ 570.567314][T15022] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1500) ! [ 570.634185][T15022] syzkaller0: entered promiscuous mode [ 570.658691][T15022] syzkaller0: entered allmulticast mode [ 570.816138][T15033] input: syz0 as /devices/virtual/input/input22 [ 570.977468][T15036] syzkaller0: entered promiscuous mode [ 570.983047][T15036] syzkaller0: entered allmulticast mode [ 571.109719][T15040] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2778'. [ 571.146873][T15040] bond1: entered promiscuous mode [ 571.157853][T15040] 8021q: adding VLAN 0 to HW filter on device bond1 [ 571.208523][T15038] loop1: detected capacity change from 0 to 4096 [ 571.231433][T15040] 8021q: adding VLAN 0 to HW filter on device bond1 [ 571.262415][T15040] bond1: (slave sit1): The slave device specified does not support setting the MAC address [ 571.283417][T15040] bond1: (slave sit1): Error -95 calling set_mac_address [ 571.480223][T15043] loop3: detected capacity change from 0 to 32768 [ 571.492263][T15043] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.2779 (15043) [ 571.530668][T15043] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 571.541022][T15043] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 571.550740][T15043] BTRFS info (device loop3): use zlib compression, level 3 [ 571.558455][T15043] BTRFS info (device loop3): turning on sync discard [ 571.565214][T15043] BTRFS info (device loop3): using free space tree [ 571.595226][T15038] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 571.676122][T15043] BTRFS info (device loop3): enabling ssd optimizations [ 571.786417][T15065] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2781'. [ 571.800240][T15065] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2781'. [ 572.447300][ T27] audit: type=1800 audit(1789270290.234:10): pid=15067 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2779" name="file1" dev="loop3" ino=260 res=0 errno=0 [ 573.475984][ T27] audit: type=1800 audit(1789270291.194:11): pid=15070 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2777" name="file1" dev="loop1" ino=30 res=0 errno=0 [ 573.577180][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 573.712379][T13356] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 573.777689][T15077] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1500) ! [ 573.856180][T15077] syzkaller0: entered promiscuous mode [ 573.897323][T15077] syzkaller0: entered allmulticast mode [ 574.126321][T15084] loop1: detected capacity change from 0 to 8 [ 575.125523][T15091] syzkaller0: entered promiscuous mode [ 575.175438][T15091] syzkaller0: entered allmulticast mode [ 575.425242][T15101] input: syz0 as /devices/virtual/input/input23 [ 575.598085][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 575.626831][T15104] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2790'. [ 575.706156][T15104] bond1: entered promiscuous mode [ 575.718716][T15104] 8021q: adding VLAN 0 to HW filter on device bond1 [ 575.764023][T15106] 8021q: adding VLAN 0 to HW filter on device bond1 [ 575.786260][T15106] bond1: (slave sit1): The slave device specified does not support setting the MAC address [ 575.800449][T15106] bond1: (slave sit1): Error -95 calling set_mac_address [ 576.177436][T15108] loop3: detected capacity change from 0 to 32768 [ 576.189130][T15108] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.2791 (15108) [ 576.221156][T15108] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 576.231589][T15108] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 576.240405][T15108] BTRFS info (device loop3): use zlib compression, level 3 [ 576.247813][T15108] BTRFS info (device loop3): turning on sync discard [ 576.254535][T15108] BTRFS info (device loop3): using free space tree [ 576.489690][T15115] loop0: detected capacity change from 0 to 32768 [ 576.515545][T15115] BTRFS warning: duplicate device /dev/loop0 devid 1 generation 8 scanned by syz.0.2792 (15115) [ 576.793459][T15108] BTRFS info (device loop3): enabling ssd optimizations [ 577.543027][ T27] audit: type=1800 audit(1789270295.414:12): pid=15134 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2791" name="file1" dev="loop3" ino=260 res=0 errno=0 [ 577.922903][T11939] BTRFS warning: duplicate device /dev/loop0 devid 1 generation 8 scanned by udevd (11939) [ 578.143671][T13356] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 578.216696][T15143] syzkaller0: entered promiscuous mode [ 578.222939][T15143] syzkaller0: entered allmulticast mode [ 578.504949][T15149] syzkaller0: entered promiscuous mode [ 578.545587][T15149] syzkaller0: entered allmulticast mode [ 578.872656][T15154] loop2: detected capacity change from 0 to 32768 [ 578.881588][T15154] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.2802 (15154) [ 578.918072][T15154] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 578.928386][T15154] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 578.937373][T15154] BTRFS info (device loop2): use zlib compression, level 3 [ 578.944665][T15154] BTRFS info (device loop2): turning on sync discard [ 578.951601][T15154] BTRFS info (device loop2): using free space tree [ 579.103514][T15154] BTRFS info (device loop2): enabling ssd optimizations [ 579.548507][ T27] audit: type=1800 audit(1789270297.424:13): pid=15180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2802" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 579.857631][T14217] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 580.369274][T15186] loop0: detected capacity change from 0 to 32768 [ 580.396357][T15186] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.2807 (15186) [ 580.463729][T15186] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 580.474004][T15186] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 580.483026][T15186] BTRFS info (device loop0): use zlib compression, level 3 [ 580.490290][T15186] BTRFS info (device loop0): turning on sync discard [ 580.497011][T15186] BTRFS info (device loop0): using free space tree [ 581.074891][T15186] BTRFS info (device loop0): enabling ssd optimizations [ 581.397779][ T27] audit: type=1800 audit(1789270299.294:14): pid=15205 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2807" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 581.687630][T13179] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 582.924080][T15216] syzkaller0: entered promiscuous mode [ 582.926194][ T9865] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 10 /dev/loop0 scanned by udevd (9865) [ 582.931776][T15216] syzkaller0: entered allmulticast mode [ 583.160318][T15219] syzkaller0: entered promiscuous mode [ 583.191087][T15219] syzkaller0: entered allmulticast mode [ 583.251583][T15220] loop2: detected capacity change from 0 to 32768 [ 583.260460][T15220] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 583.592296][T11939] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 585.071555][T15246] loop3: detected capacity change from 0 to 512 [ 585.091933][T15248] IPVS: lc: FWM 3 0x00000003 - no destination available [ 585.112436][T15246] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 585.145288][T15246] EXT4-fs (loop3): invalid journal inode [ 585.167839][T15246] EXT4-fs (loop3): can't get journal size [ 585.257692][T15246] EXT4-fs (loop3): 1 truncate cleaned up [ 585.273861][T15246] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 585.368364][T15254] loop2: detected capacity change from 0 to 8 [ 585.392721][T15233] loop0: detected capacity change from 0 to 32768 [ 585.438805][T15233] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 585.465187][T15233] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 585.527340][T15233] BTRFS info (device loop0): using free space tree [ 585.549728][T13356] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 585.719783][T15233] BTRFS info (device loop0): enabling ssd optimizations [ 585.798231][T15233] BTRFS info (device loop0): auto enabling async discard [ 586.003354][T15269] loop1: detected capacity change from 0 to 32768 [ 586.015747][T15269] BTRFS warning: duplicate device /dev/loop1 devid 1 generation 8 scanned by syz.1.2824 (15269) [ 586.157336][ T9865] I/O error, dev loop1, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 586.297613][T13179] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 586.791464][T15288] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2826'. [ 586.852128][T15288] bond2: entered promiscuous mode [ 586.857821][T15288] 8021q: adding VLAN 0 to HW filter on device bond2 [ 586.962087][T15288] 8021q: adding VLAN 0 to HW filter on device bond2 [ 586.995288][T15288] bond2: (slave sit1): The slave device specified does not support setting the MAC address [ 587.022936][T15288] bond2: (slave sit1): Error -95 calling set_mac_address [ 587.255629][T15299] input: syz0 as /devices/virtual/input/input24 [ 587.408213][T15295] syzkaller0: entered promiscuous mode [ 587.439242][T15295] syzkaller0: entered allmulticast mode [ 588.340608][T15308] IPVS: lc: FWM 3 0x00000003 - no destination available [ 589.023153][T15320] loop1: detected capacity change from 0 to 32768 [ 589.037380][T15320] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.2835 (15320) [ 589.081356][T15320] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 589.096453][T15320] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 589.105966][T15320] BTRFS info (device loop1): setting nodatasum [ 589.126326][T15320] BTRFS info (device loop1): force zlib compression, level 3 [ 589.144531][T15320] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 589.165903][T15320] BTRFS info (device loop1): use lzo compression, level 0 [ 589.185668][T15320] BTRFS info (device loop1): turning on flush-on-commit [ 589.193966][T15320] BTRFS info (device loop1): enabling auto defrag [ 589.217184][T15320] BTRFS info (device loop1): max_inline at 0 [ 589.245237][T15320] BTRFS info (device loop1): using free space tree [ 589.388145][T15320] BTRFS info (device loop1): enabling ssd optimizations [ 589.581116][T12091] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 590.683704][T15363] loop1: detected capacity change from 0 to 4096 [ 590.773017][T15363] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 592.241814][T15368] input: syz0 as /devices/virtual/input/input25 [ 594.105494][T15385] loop2: detected capacity change from 0 to 32768 [ 594.117579][T15385] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.2844 (15385) [ 594.138686][T15385] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 594.149254][T15385] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 594.158046][T15385] BTRFS info (device loop2): use zlib compression, level 3 [ 594.165469][T15385] BTRFS info (device loop2): turning on sync discard [ 594.172267][T15385] BTRFS info (device loop2): using free space tree [ 594.282042][T15400] IPVS: lc: FWM 3 0x00000003 - no destination available [ 594.371766][T15407] input: syz0 as /devices/virtual/input/input26 [ 594.484135][T15385] BTRFS info (device loop2): enabling ssd optimizations [ 594.547495][T15409] loop0: detected capacity change from 0 to 32768 [ 594.562185][T15409] BTRFS warning: duplicate device /dev/loop0 devid 1 generation 8 scanned by syz.0.2850 (15409) [ 594.824878][T15413] syzkaller0: entered promiscuous mode [ 594.830666][T15413] syzkaller0: entered allmulticast mode [ 594.845208][ T27] audit: type=1800 audit(1789270312.734:15): pid=15415 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2844" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 594.961658][T15420] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1500) ! [ 594.982501][T11939] BTRFS warning: duplicate device /dev/loop0 devid 1 generation 8 scanned by udevd (11939) [ 595.252667][T14217] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 596.969930][T13352] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 270 seconds [ 596.980884][T13352] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 270 seconds [ 596.992280][T13352] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 270 seconds [ 597.005623][T13352] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 270 seconds [ 597.268989][ T5815] IPVS: starting estimator thread 0... [ 597.275869][T15447] IPVS: lc: FWM 3 0x00000003 - no destination available [ 597.331353][T15449] syzkaller0: entered promiscuous mode [ 597.359735][T15449] syzkaller0: entered allmulticast mode [ 597.459484][T15448] IPVS: using max 19 ests per chain, 45600 per kthread [ 597.625424][T15451] loop0: detected capacity change from 0 to 32768 [ 597.643067][T15451] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.2862 (15451) [ 597.746689][T15455] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1500) ! [ 597.832569][T15453] loop1: detected capacity change from 0 to 32768 [ 597.849812][T15451] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 597.850009][T15453] BTRFS warning: duplicate device /dev/loop1 devid 1 generation 8 scanned by syz.1.2863 (15453) [ 597.861037][T15451] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 597.879831][T15451] BTRFS info (device loop0): use zlib compression, level 3 [ 597.887413][T15451] BTRFS info (device loop0): turning on sync discard [ 597.894142][T15451] BTRFS info (device loop0): using free space tree [ 598.102814][T15451] BTRFS info (device loop0): enabling ssd optimizations [ 598.604840][ T27] audit: type=1800 audit(1789270316.494:16): pid=15480 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2862" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 598.847450][T15484] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2866'. [ 598.860183][T15484] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2866'. [ 599.586297][T13179] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 600.718980][T15501] syzkaller0: entered promiscuous mode [ 600.735166][T15501] syzkaller0: entered allmulticast mode [ 600.804579][T15506] jffs2: notice: (15506) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 601.130027][ T5816] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 601.226448][T15504] loop2: detected capacity change from 0 to 1024 [ 601.478757][ T5816] usb 1-1: Using ep0 maxpacket: 8 [ 601.561792][ T5816] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 601.613292][ T5816] usb 1-1: config 0 has no interface number 0 [ 601.658838][ T5816] usb 1-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 601.697261][ T5816] usb 1-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 601.715270][ T5816] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 601.735685][ T5816] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 601.780590][ T5816] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.781417][T15512] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2875'. [ 601.795703][ T5816] usb 1-1: config 0 descriptor?? [ 601.815265][ T5816] ldusb 1-1:0.55: Interrupt in endpoint not found [ 601.939194][T15512] bond3: entered promiscuous mode [ 601.959971][T15512] 8021q: adding VLAN 0 to HW filter on device bond3 [ 601.970108][T15516] loop1: detected capacity change from 0 to 4096 [ 602.093869][T15517] 8021q: adding VLAN 0 to HW filter on device bond3 [ 602.097356][T15516] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 602.130581][T15517] bond3: (slave sit1): The slave device specified does not support setting the MAC address [ 602.155955][T15517] bond3: (slave sit1): Error -95 calling set_mac_address [ 602.430117][T15519] loop2: detected capacity change from 0 to 32768 [ 602.455281][T15519] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.2877 (15519) [ 602.472040][T15519] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 602.482575][T15519] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 602.491384][T15519] BTRFS info (device loop2): use zlib compression, level 3 [ 602.498763][T15519] BTRFS info (device loop2): turning on sync discard [ 602.505497][T15519] BTRFS info (device loop2): using free space tree [ 602.647448][T15519] BTRFS info (device loop2): enabling ssd optimizations [ 602.910073][T15539] loop3: detected capacity change from 0 to 32768 [ 602.979741][T15539] BTRFS warning: duplicate device /dev/loop3 devid 1 generation 8 scanned by syz.3.2878 (15539) [ 603.103864][ T27] audit: type=1800 audit(1789270320.994:17): pid=15545 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2877" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 603.575642][ T9865] I/O error, dev loop3, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 603.668380][T14217] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 604.204130][T11939] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 10 /dev/loop2 scanned by udevd (11939) [ 604.291331][T15552] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2879'. [ 604.303810][T15552] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2879'. [ 604.661188][T15553] IPVS: lc: FWM 3 0x00000003 - no destination available [ 605.250371][ T5833] usb 1-1: USB disconnect, device number 4 [ 606.343253][T15565] syzkaller0: entered promiscuous mode [ 606.363546][T15565] syzkaller0: entered allmulticast mode [ 606.482328][T15567] loop1: detected capacity change from 0 to 8 [ 607.487898][T15573] FAULT_INJECTION: forcing a failure. [ 607.487898][T15573] name fail_futex, interval 1, probability 0, space 0, times 1 [ 607.512553][T15573] CPU: 1 PID: 15573 Comm: syz.3.2885 Not tainted syzkaller #0 [ 607.520105][T15573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 607.530189][T15573] Call Trace: [ 607.533508][T15573] [ 607.536489][T15573] dump_stack_lvl+0x18c/0x250 [ 607.541234][T15573] ? show_regs_print_info+0x20/0x20 [ 607.546473][T15573] ? load_image+0x420/0x420 [ 607.551030][T15573] ? __lock_acquire+0x1336/0x7d80 [ 607.553639][T15575] syzkaller0: entered promiscuous mode [ 607.556174][T15573] should_fail_ex+0x394/0x4c0 [ 607.556214][T15573] get_futex_key+0x16f/0x1030 [ 607.571159][T15573] ? futex_setup_timer+0xc0/0xc0 [ 607.576131][T15573] ? mark_lock+0x94/0x320 [ 607.579457][T15575] syzkaller0: entered allmulticast mode [ 607.580474][T15573] ? asan.module_dtor+0x20/0x20 [ 607.591113][T15573] futex_wake+0x127/0x4f0 [ 607.595488][T15573] ? futex_wake_mark+0x150/0x150 [ 607.600483][T15573] do_futex+0x35d/0x3e0 [ 607.604765][T15573] ? __might_fault+0xaa/0x120 [ 607.609507][T15573] ? __ia32_sys_get_robust_list+0x110/0x110 [ 607.615445][T15573] ? __might_fault+0xc6/0x120 [ 607.620173][T15573] mm_release+0x184/0x3a0 [ 607.624591][T15573] ? exit_mm_release+0x30/0x30 [ 607.629479][T15573] ? lockdep_hardirqs_on+0x98/0x150 [ 607.634732][T15573] exit_mm+0xa4/0x340 [ 607.638845][T15573] ? sysctl_delayacct+0x220/0x220 [ 607.644089][T15573] ? do_exit+0x2530/0x2530 [ 607.648566][T15573] do_exit+0x909/0x2530 [ 607.652769][T15573] ? put_task_struct+0xc0/0xc0 [ 607.657577][T15573] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 607.663588][T15573] ? get_signal+0x100e/0x1390 [ 607.668299][T15573] ? lock_chain_count+0x20/0x20 [ 607.673193][T15573] ? _raw_spin_lock_irq+0xbb/0xf0 [ 607.678277][T15573] do_group_exit+0x22d/0x2f0 [ 607.682917][T15573] ? lockdep_hardirqs_on+0x98/0x150 [ 607.688162][T15573] get_signal+0x12a6/0x1390 [ 607.692721][T15573] arch_do_signal_or_restart+0xc2/0x7b0 [ 607.698458][T15573] ? asan.module_dtor+0x20/0x20 [ 607.703536][T15573] ? get_sigframe_size+0x20/0x20 [ 607.708546][T15573] exit_to_user_mode_loop+0x70/0x110 [ 607.713879][T15573] exit_to_user_mode_prepare+0xee/0x180 [ 607.719468][T15573] syscall_exit_to_user_mode+0x1a/0x50 [ 607.724965][T15573] do_syscall_64+0x61/0xb0 [ 607.729424][T15573] ? clear_bhb_loop+0x40/0x90 [ 607.734232][T15573] ? clear_bhb_loop+0x40/0x90 [ 607.738947][T15573] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 607.745000][T15573] RIP: 0033:0x7f17c179e159 [ 607.749534][T15573] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.769446][T15573] RSP: 002b:00007f17c26f10e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 607.777888][T15573] RAX: fffffffffffffe00 RBX: 00007f17c1a26098 RCX: 00007f17c179e159 [ 607.786075][T15573] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f17c1a26098 [ 607.794080][T15573] RBP: 00007f17c1a26090 R08: 0000000000000000 R09: 0000000000000000 [ 607.802078][T15573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 607.810158][T15573] R13: 00007f17c1a26128 R14: 00007ffdbda11330 R15: 00007ffdbda11418 [ 607.818168][T15573] [ 608.119585][T15583] loop0: detected capacity change from 0 to 32768 [ 608.131981][T15583] BTRFS error: device /dev/loop0 already registered with a higher generation, found 8 expect 10 [ 608.223722][ T9865] I/O error, dev loop0, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 609.106980][T15597] input: syz0 as /devices/virtual/input/input27 [ 609.990325][T15608] syzkaller0: entered promiscuous mode [ 609.996177][T15608] syzkaller0: entered allmulticast mode [ 611.223698][T15619] jffs2: notice: (15619) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 611.427238][ T5778] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 611.559934][T15623] loop0: detected capacity change from 0 to 32768 [ 611.575740][T15623] BTRFS error: device /dev/loop0 already registered with a higher generation, found 8 expect 10 [ 611.657220][T11939] I/O error, dev loop0, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 612.474206][T15639] loop1: detected capacity change from 0 to 8 [ 613.911597][T15646] input: syz0 as /devices/virtual/input/input28 [ 614.540081][ T5786] Bluetooth: hci2: Unknown advertising packet type: 0x18 [ 614.540160][ T5786] Bluetooth: hci2: Unknown advertising packet type: 0x1e [ 615.102751][T15668] fuse: Bad value for 'fd' [ 615.896409][T15670] loop2: detected capacity change from 0 to 32768 [ 615.985169][T15672] IPVS: lc: FWM 3 0x00000003 - no destination available [ 615.996514][T15670] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 616.006865][T15670] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 616.015668][T15670] BTRFS info (device loop2): use zlib compression, level 3 [ 616.023029][T15670] BTRFS info (device loop2): turning on sync discard [ 616.029829][T15670] BTRFS info (device loop2): using free space tree [ 616.297957][T15670] BTRFS info (device loop2): enabling ssd optimizations [ 616.388713][T15693] loop1: detected capacity change from 0 to 8 [ 617.562537][ T27] audit: type=1800 audit(1789270335.254:18): pid=15699 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2916" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 617.762310][T14217] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 618.091237][T15710] jffs2: notice: (15710) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 618.563471][T15718] IPVS: lc: FWM 3 0x00000003 - no destination available [ 619.137410][T15725] input: syz0 as /devices/virtual/input/input29 [ 619.790301][T15721] loop2: detected capacity change from 0 to 32768 [ 619.892963][T15721] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 619.917935][T15721] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 620.204894][T15721] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 620.287731][ T5816] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 620.353764][ T5816] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 621.161205][ T5816] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 807ms [ 621.274560][ T5816] gfs2: fsid=syz:syz.0: jid=0: Done [ 621.302798][T15721] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 621.878326][T15758] IPVS: lc: FWM 3 0x00000003 - no destination available [ 623.182451][T15768] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2938'. [ 623.194443][T15768] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2938'. [ 624.713954][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 627.267521][T13352] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 300 seconds [ 627.278469][T13352] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 300 seconds [ 627.290002][T13352] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 300 seconds [ 627.301950][T13352] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 300 seconds [ 627.725202][T15786] IPVS: lc: FWM 3 0x00000003 - no destination available [ 627.928706][T15791] jffs2: notice: (15791) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 628.013536][ T5778] Bluetooth: hci0: sending frame failed (-49) [ 628.023966][ T5786] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 628.207892][T15797] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2948'. [ 628.223146][T15797] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2948'. [ 629.394850][T15799] loop2: detected capacity change from 0 to 32768 [ 629.471952][ T27] audit: type=1800 audit(1789270347.364:19): pid=15799 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2949" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 630.125413][T15808] IPVS: lc: FWM 3 0x00000003 - no destination available [ 630.997245][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 631.822859][T15814] input: syz0 as /devices/virtual/input/input30 [ 632.371615][T15824] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2958'. [ 632.418152][T15824] bond4: entered promiscuous mode [ 632.426137][T15824] 8021q: adding VLAN 0 to HW filter on device bond4 [ 632.832318][T15829] loop3: detected capacity change from 0 to 256 [ 632.880413][T15829] exFAT-fs (loop3): failed to load upcase table (idx : 0x00011a39, chksum : 0xd7c18d7b, utbl_chksum : 0xe619d30d) [ 633.030687][T15833] loop0: detected capacity change from 0 to 8 [ 635.387392][T15852] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2967'. [ 635.420537][T15852] bond5: entered promiscuous mode [ 635.426035][T15852] 8021q: adding VLAN 0 to HW filter on device bond5 [ 635.488376][T15850] loop0: detected capacity change from 0 to 32768 [ 635.496762][T15850] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.2966 (15850) [ 635.518757][T15850] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 635.529070][T15850] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 635.538116][T15850] BTRFS info (device loop0): use zlib compression, level 3 [ 635.545369][T15850] BTRFS info (device loop0): turning on sync discard [ 635.552169][T15850] BTRFS info (device loop0): using free space tree [ 635.607373][T15850] BTRFS info (device loop0): enabling ssd optimizations [ 635.641834][ T27] audit: type=1800 audit(1789270353.524:20): pid=15850 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2966" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 635.705079][T13179] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 636.153845][T15878] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2971'. [ 636.164146][T15878] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2971'. [ 636.181816][T15876] overlayfs: statfs failed on './file0' [ 636.349317][T15884] IPVS: lc: FWM 3 0x00000003 - no destination available [ 638.683206][T15907] loop0: detected capacity change from 0 to 32768 [ 638.704836][T15907] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.2978 (15907) [ 638.719890][T15907] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 638.730211][T15907] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 638.738991][T15907] BTRFS info (device loop0): use zlib compression, level 3 [ 638.746398][T15907] BTRFS info (device loop0): turning on sync discard [ 638.753194][T15907] BTRFS info (device loop0): using free space tree [ 638.803236][T15907] BTRFS info (device loop0): enabling ssd optimizations [ 638.838324][ T27] audit: type=1800 audit(1789270356.734:21): pid=15907 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2978" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 638.927908][T13179] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 639.658601][T15930] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2982'. [ 639.671573][T15930] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2982'. [ 639.913707][T15932] loop3: detected capacity change from 0 to 32768 [ 639.922101][T15932] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.2983 (15932) [ 639.948780][T15932] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 639.959140][T15932] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 639.968024][T15932] BTRFS info (device loop3): use zlib compression, level 3 [ 639.975263][T15932] BTRFS info (device loop3): turning on sync discard [ 639.982023][T15932] BTRFS info (device loop3): using free space tree [ 640.027800][T15932] BTRFS info (device loop3): enabling ssd optimizations [ 640.098315][ T27] audit: type=1800 audit(1789270357.974:22): pid=15932 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2983" name="file1" dev="loop3" ino=260 res=0 errno=0 [ 640.203593][T13356] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 641.590990][T15962] loop0: detected capacity change from 0 to 32768 [ 641.609761][T15962] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.2989 (15962) [ 641.625371][T15962] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 641.635709][T15962] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 641.644578][T15962] BTRFS info (device loop0): use zlib compression, level 3 [ 641.652761][T15962] BTRFS info (device loop0): turning on sync discard [ 641.659734][T15962] BTRFS info (device loop0): using free space tree [ 641.847202][T15962] BTRFS info (device loop0): enabling ssd optimizations [ 642.141235][ T5778] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 642.154882][ T5778] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 642.166688][ T5778] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 642.377377][ T27] audit: type=1800 audit(1789270360.124:23): pid=15985 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2989" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 642.443582][ T5778] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 642.458181][ T5778] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 642.469119][ T5778] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 642.818263][T13179] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 642.850424][T15989] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2991'. [ 642.900231][T15988] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2991'. [ 643.397463][T15995] loop3: detected capacity change from 0 to 32768 [ 643.433286][T15995] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.2994 (15995) [ 643.454550][T15995] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 643.466360][T15995] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 643.475334][T15995] BTRFS info (device loop3): use zlib compression, level 3 [ 643.482748][T15995] BTRFS info (device loop3): turning on sync discard [ 643.491040][T15995] BTRFS info (device loop3): using free space tree [ 643.521449][T15981] chnl_net:caif_netlink_parms(): no params data found [ 643.597900][T15995] BTRFS info (device loop3): enabling ssd optimizations [ 643.638258][ T27] audit: type=1800 audit(1789270361.524:24): pid=15995 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2994" name="file1" dev="loop3" ino=260 res=0 errno=0 [ 643.800128][T13356] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 644.052747][T15981] bridge0: port 1(bridge_slave_0) entered blocking state [ 644.062841][T15981] bridge0: port 1(bridge_slave_0) entered disabled state [ 644.071264][T15981] bridge_slave_0: entered allmulticast mode [ 644.079325][T15981] bridge_slave_0: entered promiscuous mode [ 644.090151][T15981] bridge0: port 2(bridge_slave_1) entered blocking state [ 644.098206][T15981] bridge0: port 2(bridge_slave_1) entered disabled state [ 644.274350][T15981] bridge_slave_1: entered allmulticast mode [ 644.425736][T15981] bridge_slave_1: entered promiscuous mode [ 644.642004][ T5786] Bluetooth: hci0: command tx timeout [ 644.838319][T15981] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 644.880734][T15981] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 645.012127][T15981] team0: Port device team_slave_0 added [ 645.050028][T15981] team0: Port device team_slave_1 added [ 645.158008][T15981] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 645.177083][T15981] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 645.237889][T15981] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 645.256344][ T9865] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 10 /dev/loop3 scanned by udevd (9865) [ 645.260754][T15981] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 645.275329][T15981] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 645.427553][T15981] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 645.636875][T15981] hsr_slave_0: entered promiscuous mode [ 645.676663][T15981] hsr_slave_1: entered promiscuous mode [ 645.711821][T15981] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 645.950315][T15981] Cannot create hsr debugfs directory [ 646.787344][ T5786] Bluetooth: hci0: command tx timeout [ 647.545800][T16039] loop0: detected capacity change from 0 to 32768 [ 647.581597][T16039] BTRFS error: device /dev/loop0 already registered with a higher generation, found 8 expect 10 [ 647.659848][T15981] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 647.780489][T15981] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 647.854362][ T9865] I/O error, dev loop0, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 647.949630][T15981] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 648.083035][T16041] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3001'. [ 648.107852][T15981] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 648.525365][T16042] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3001'. [ 648.692836][T15981] 8021q: adding VLAN 0 to HW filter on device bond0 [ 648.792213][T15981] 8021q: adding VLAN 0 to HW filter on device team0 [ 648.842195][ T1101] bridge0: port 1(bridge_slave_0) entered blocking state [ 648.849464][ T1101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 648.867398][ T5786] Bluetooth: hci0: command tx timeout [ 648.944802][T16057] jffs2: notice: (16057) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 648.970690][ T3431] bridge0: port 2(bridge_slave_1) entered blocking state [ 648.978011][ T3431] bridge0: port 2(bridge_slave_1) entered forwarding state [ 649.202275][T15981] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 649.254443][T15981] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 649.356664][T16063] loop2: detected capacity change from 0 to 8 [ 649.774530][T15981] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 650.064557][ T5786] Bluetooth: hci2: unexpected subevent 0x01 length: 4 < 18 [ 650.502289][T15981] veth0_vlan: entered promiscuous mode [ 650.953204][T15981] veth1_vlan: entered promiscuous mode [ 650.959606][ T5786] Bluetooth: hci0: command tx timeout [ 651.502568][T16087] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 651.566727][T15981] veth0_macvtap: entered promiscuous mode [ 651.616982][T15981] veth1_macvtap: entered promiscuous mode [ 651.636832][T16087] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 651.714474][T16087] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 651.721542][T15981] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 651.740077][T16087] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 651.746639][T15981] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 651.762096][T15981] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 651.780585][T15981] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 651.802332][T15981] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 651.813192][T15981] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 651.823477][T15981] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 651.834888][T15981] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 651.849062][T16087] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 651.856884][T15981] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 651.874796][T16087] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 651.877923][T15981] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 651.885811][T16087] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 651.907234][T15981] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 651.920515][T15981] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 651.934705][T15981] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 651.953294][T15981] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 651.965496][T15981] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 651.983427][T15981] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 651.996318][T15981] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 652.016940][T16087] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 652.020721][T15981] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 652.025101][T16087] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 652.049435][T15981] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 652.065222][T15981] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 652.075628][T15981] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 652.097168][T15981] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 652.112475][T16087] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 652.125454][T16087] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 652.141927][T16087] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 652.165655][T16087] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 652.265720][ T1101] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 652.273798][ T1101] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 652.329167][ T3431] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 652.344447][ T3431] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 652.597494][ T28] IPVS: starting estimator thread 0... [ 652.609092][T16099] IPVS: lc: FWM 3 0x00000003 - no destination available [ 652.700075][T16100] IPVS: using max 19 ests per chain, 45600 per kthread [ 653.004151][T16109] loop3: detected capacity change from 0 to 8 [ 653.218229][ T5786] Bluetooth: hci4: command 0x0406 tx timeout [ 653.749830][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 653.930349][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 654.069210][ T5786] Bluetooth: hci1: command 0x0c1a tx timeout [ 654.147495][ T5778] Bluetooth: hci0: command 0x0c1a tx timeout [ 655.347512][ T5778] Bluetooth: hci4: command 0x0406 tx timeout [ 655.827496][ T5778] Bluetooth: hci2: command 0x0406 tx timeout [ 655.987607][ T5778] Bluetooth: hci3: command 0x0406 tx timeout [ 656.177911][ T5778] Bluetooth: hci1: command 0x0c1a tx timeout [ 656.228433][ T5778] Bluetooth: hci0: command 0x0c1a tx timeout [ 656.298335][T16131] IPVS: lc: FWM 3 0x00000003 - no destination available [ 657.363212][T13352] block nbd0: Possible stuck request ffff888021f60000: control (read@0,1024B). Runtime 330 seconds [ 657.374503][T13352] block nbd0: Possible stuck request ffff888021f60200: control (read@1024,1024B). Runtime 330 seconds [ 657.387276][T13352] block nbd0: Possible stuck request ffff888021f60400: control (read@2048,1024B). Runtime 330 seconds [ 657.398681][T13352] block nbd0: Possible stuck request ffff888021f60600: control (read@3072,1024B). Runtime 330 seconds [ 657.591748][T16144] input: syz0 as /devices/virtual/input/input31 [ 657.914773][ T5778] Bluetooth: hci2: command 0x0406 tx timeout [ 658.228036][ T5778] Bluetooth: hci1: command 0x0c1a tx timeout [ 658.307321][ T5778] Bluetooth: hci0: command 0x0c1a tx timeout [ 659.619678][T16167] loop2: detected capacity change from 0 to 8 [ 660.058635][T16178] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 660.068132][T16178] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 660.077636][T16178] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 660.397352][ T5778] Bluetooth: hci0: command 0x0c1a tx timeout [ 662.480624][ T5778] Bluetooth: hci0: command 0x0c1a tx timeout [ 663.988061][T16223] loop2: detected capacity change from 0 to 8192 [ 664.628579][T16187] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 665.093067][T16227] loop4: detected capacity change from 0 to 1024 [ 665.121183][T16227] EXT4-fs: Ignoring removed bh option [ 665.304521][T16227] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-001000000000 r/w without journal. Quota mode: writeback. [ 665.797114][T16227] loop4: detected capacity change from 1024 to 64 [ 666.294409][ T49] kworker/u4:3: attempt to access beyond end of device [ 666.294409][ T49] loop4: rw=1, sector=256, nr_sectors = 128 limit=64 [ 666.314603][ T49] EXT4-fs warning (device loop4): ext4_end_bio:357: I/O error 10 writing to inode 15 starting block 128) [ 666.317571][ T29] INFO: task udevd:6535 blocked for more than 143 seconds. [ 666.327748][ T49] Buffer I/O error on device loop4, logical block 128 [ 666.341193][ T49] Buffer I/O error on device loop4, logical block 129 [ 666.347995][ T49] Buffer I/O error on device loop4, logical block 130 [ 666.354774][ T49] Buffer I/O error on device loop4, logical block 131 [ 666.367664][ T49] Buffer I/O error on device loop4, logical block 132 [ 666.374504][ T49] Buffer I/O error on device loop4, logical block 133 [ 666.381294][ T49] Buffer I/O error on device loop4, logical block 134 [ 666.383109][ T29] Not tainted syzkaller #0 [ 666.388053][ T49] Buffer I/O error on device loop4, logical block 135 [ 666.393241][ T49] Buffer I/O error on device loop4, logical block 136 [ 666.393541][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 666.400123][ T49] Buffer I/O error on device loop4, logical block 137 [ 666.423008][ T29] task:udevd state:D stack:23208 pid:6535 ppid:5141 flags:0x00004006 [ 666.434894][ T29] Call Trace: [ 666.438374][ T29] [ 666.441408][ T29] __schedule+0x15ae/0x4660 [ 666.446610][ T29] ? _raw_spin_unlock+0x40/0x40 [ 666.462064][T15981] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-001000000000. [ 666.467114][ T29] ? asan.module_dtor+0x20/0x20 [ 666.484801][ T29] ? mark_lock+0x94/0x320 [ 666.499849][ T29] ? __lock_acquire+0x7d80/0x7d80 [ 666.505071][ T29] ? lock_chain_count+0x20/0x20 [ 666.510151][ T29] ? _raw_spin_lock_irq+0xbb/0xf0 [ 666.515297][T16236] kmmpd-loop4: attempt to access beyond end of device [ 666.515297][T16236] loop4: rw=14337, sector=128, nr_sectors = 2 limit=64 [ 666.531135][ T29] ? _raw_spin_lock_irqsave+0x100/0x100 [ 666.536819][ T29] schedule+0xbd/0x170 [ 666.541033][T16236] buffer_io_error: 6 callbacks suppressed [ 666.541045][T16236] Buffer I/O error on dev loop4, logical block 64, lost sync page write [ 666.555292][ T29] io_schedule+0x80/0xd0 [ 666.559787][ T29] folio_wait_bit_common+0x881/0xfa0 [ 666.565194][ T29] ? folio_wait_bit+0x30/0x30 [ 666.570051][ T29] ? _compound_head+0x120/0x120 [ 666.575012][ T29] ? filemap_add_folio+0x190/0x3d0 [ 666.580383][ T29] ? __filemap_get_folio+0x71e/0xbe0 [ 666.585780][ T29] ? blkdev_writepage+0x30/0x30 [ 666.606703][ T29] do_read_cache_folio+0x1c0/0x7f0 [ 666.622606][ T29] ? blkdev_writepage+0x30/0x30 [ 666.637951][ T29] read_part_sector+0xd2/0x350 [ 666.648013][ T29] adfspart_check_POWERTEC+0x93/0xed0 [ 666.658706][ T29] ? adfspart_check_ADFS+0x620/0x620 [ 666.670363][ T29] ? put_partition+0x360/0x360 [ 666.680389][ T29] ? alloc_pages+0x4e1/0x740 [ 666.697297][ T29] bdev_disk_changed+0x755/0x1450 [ 666.702430][ T29] ? bdev_resize_partition+0xf0/0xf0 [ 666.717185][ T29] ? _atomic_dec_and_lock+0x93/0x120 [ 666.722554][ T29] ? iput+0x33f/0x900 [ 666.726565][ T29] blkdev_get_whole+0x30d/0x390 [ 666.742954][ T29] blkdev_get_by_dev+0x3a9/0x610 [ 666.754931][ T29] blkdev_open+0x14e/0x360 [ 666.776463][ T29] do_dentry_open+0x880/0x14b0 [ 666.804415][ T29] ? blkdev_mmap+0x1b0/0x1b0 [ 666.821930][ T29] path_openat+0x284f/0x3270 [ 666.826583][ T29] ? do_sys_openat2+0xda/0x1d0 [ 666.837747][ T29] ? __x64_sys_openat+0x139/0x160 [ 666.842967][ T29] ? verify_lock_unused+0x140/0x140 [ 666.851705][ T29] ? do_filp_open+0x430/0x430 [ 666.861516][ T29] do_filp_open+0x1f2/0x430 [ 666.866197][ T29] ? vfs_tmpfile+0x620/0x620 [ 666.873705][ T29] ? _raw_spin_unlock+0x28/0x40 [ 666.879711][ T29] ? alloc_fd+0x590/0x640 [ 666.884269][ T29] do_sys_openat2+0x134/0x1d0 [ 666.889701][ T29] ? do_sys_open+0xe0/0xe0 [ 666.894337][ T29] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 666.900824][ T29] ? lock_chain_count+0x20/0x20 [ 666.905882][ T29] __x64_sys_openat+0x139/0x160 [ 666.911200][ T29] do_syscall_64+0x55/0xb0 [ 666.915785][ T29] ? clear_bhb_loop+0x40/0x90 [ 666.927133][ T29] ? clear_bhb_loop+0x40/0x90 [ 666.937096][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 666.943634][ T29] RIP: 0033:0x7faa586a7407 [ 666.957332][ T29] RSP: 002b:00007ffd64efb2d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 666.965834][ T29] RAX: ffffffffffffffda RBX: 00007faa58d47880 RCX: 00007faa586a7407 [ 666.989947][ T29] RDX: 00000000000a0800 RSI: 00005647dfd0d4d0 RDI: ffffffffffffff9c [ 667.005737][ T29] RBP: 00005647dfd0c910 R08: 0000000000000000 R09: 0000000000000000 [ 667.014230][ T29] R10: 0000000000000000 R11: 0000000000000202 R12: 00005647dfd3fa30 [ 667.027363][ T29] R13: 00005647dfd24410 R14: 0000000000000000 R15: 00005647dfd3fa30 [ 667.054499][ T29] [ 667.073955][ T29] [ 667.073955][ T29] Showing all locks held in the system: [ 667.084335][ T29] 1 lock held by pool_workqueue_/3: [ 667.117092][ T29] #0: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 [ 667.134743][ T29] 1 lock held by khungtaskd/29: [ 667.140521][ T29] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 667.152862][ T29] 3 locks held by kworker/u4:3/49: [ 667.158844][ T29] #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 667.170885][ T29] #1: ffffc90000b9fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 667.182250][ T29] #2: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 [ 667.191908][ T29] 2 locks held by kworker/u4:8/3431: [ 667.197884][ T29] 2 locks held by getty/5531: [ 667.202597][ T29] #0: ffff88802d6ac0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 667.212882][ T29] #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 [ 667.223339][ T29] 2 locks held by kworker/0:3/5765: [ 667.231162][ T29] #0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 667.242845][ T29] #1: ffffc90002e47d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 667.257246][ T29] 1 lock held by udevd/6535: [ 667.261875][ T29] #0: ffff888021e854c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 667.272751][ T29] 6 locks held by kworker/u4:10/11556: [ 667.278648][ T29] #0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 667.289913][ T29] #1: ffffc9000fba7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 667.300916][ T29] #2: ffffffff8e3ca510 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 [ 667.310798][ T29] #3: ffff888079ed4250 (&devlink->lock_key#9){+.+.}-{3:3}, at: devlink_pernet_pre_exit+0xee/0x360 [ 667.322254][ T29] #4: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3f/0x180 [ 667.331584][ T29] #5: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 [ 667.342976][ T29] 1 lock held by syz.1.2939/15770: [ 667.353388][ T29] #0: ffff888021e854c8 (&disk->open_mutex){+.+.}-{3:3}, at: sync_bdevs+0x1a4/0x320 [ 667.363395][ T29] 1 lock held by syz.1.2939/15771: [ 667.368887][ T29] #0: ffff888021e854c8 (&disk->open_mutex){+.+.}-{3:3}, at: sync_bdevs+0x1a4/0x320 [ 667.378962][ T29] 1 lock held by syz.1.2939/15775: [ 667.384100][ T29] #0: ffff888021e854c8 (&disk->open_mutex){+.+.}-{3:3}, at: sync_bdevs+0x1a4/0x320 [ 667.394331][ T29] [ 667.396722][ T29] ============================================= [ 667.396722][ T29] [ 667.411234][T11556] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.414953][ T29] NMI backtrace for cpu 1 [ 667.426437][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 667.433667][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 667.443759][ T29] Call Trace: [ 667.447069][ T29] [ 667.450025][ T29] dump_stack_lvl+0x18c/0x250 [ 667.454759][ T29] ? __wake_up_klogd+0xd9/0x100 [ 667.459672][ T29] ? show_regs_print_info+0x20/0x20 [ 667.464898][ T29] ? load_image+0x420/0x420 [ 667.469430][ T29] nmi_cpu_backtrace+0x3a6/0x3e0 [ 667.474392][ T29] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 667.480589][ T29] ? load_image+0x420/0x420 [ 667.485108][ T29] ? wq_watchdog_touch+0xef/0x170 [ 667.490161][ T29] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 667.496336][ T29] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 667.502374][ T29] watchdog+0xf59/0xfa0 [ 667.506564][ T29] ? watchdog+0x1e1/0xfa0 [ 667.510922][ T29] kthread+0x2fa/0x390 [ 667.515011][ T29] ? hungtask_pm_notify+0x50/0x50 [ 667.520064][ T29] ? kthread_blkcg+0xd0/0xd0 [ 667.524672][ T29] ret_from_fork+0x48/0x80 [ 667.529105][ T29] ? kthread_blkcg+0xd0/0xd0 [ 667.533716][ T29] ret_from_fork_asm+0x11/0x20 [ 667.538647][ T29] [ 667.542968][ T29] Sending NMI from CPU 1 to CPUs 0: [ 667.548444][ C0] NMI backtrace for cpu 0 [ 667.548460][ C0] CPU: 0 PID: 3431 Comm: kworker/u4:8 Not tainted syzkaller #0 [ 667.548475][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 667.548484][ C0] Workqueue: bat_events batadv_nc_worker [ 667.548603][ C0] RIP: 0010:kasan_check_range+0x1ba/0x290 [ 667.548625][ C0] Code: 49 01 dc 4d 01 f3 49 8d 5c 24 07 4d 85 e4 49 0f 49 dc 48 83 e3 f8 49 29 dc 74 0e 41 80 3b 00 75 6b 49 ff c3 49 ff cc 75 f2 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 45 84 ff 0f 85 91 00 00 00 41 f7 c7 [ 667.548637][ C0] RSP: 0018:ffffc9000c587750 EFLAGS: 00000056 [ 667.548649][ C0] RAX: 0000000000000001 RBX: ffff88802dc53c00 RCX: ffffffff81695434 [ 667.548659][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff911ef500 [ 667.548668][ C0] RBP: 0000000000000009 R08: ffffffff911ef507 R09: 1ffffffff223dea0 [ 667.548678][ C0] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: 0000000000000001 [ 667.548688][ C0] R13: dffffc0000000000 R14: fffffbfff223dea1 R15: 1ffffffff223dea0 [ 667.548700][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 667.548712][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 667.548722][ C0] CR2: 00007fd1cfa69ed0 CR3: 000000000cf32000 CR4: 00000000003506f0 [ 667.548736][ C0] Call Trace: [ 667.548742][ C0] [ 667.548749][ C0] mark_lock+0x94/0x320 [ 667.548768][ C0] __lock_acquire+0xd3e/0x7d80 [ 667.548794][ C0] ? verify_lock_unused+0x140/0x140 [ 667.548812][ C0] ? mark_lock+0x94/0x320 [ 667.548827][ C0] ? verify_lock_unused+0x140/0x140 [ 667.548848][ C0] lock_acquire+0x19e/0x420 [ 667.548863][ C0] ? batadv_nc_worker+0xd2/0x600 [ 667.548880][ C0] ? batadv_nc_worker+0xd2/0x600 [ 667.548896][ C0] ? read_lock_is_recursive+0x20/0x20 [ 667.548913][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 667.548929][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 667.548946][ C0] ? batadv_nc_worker+0xd2/0x600 [ 667.548961][ C0] batadv_nc_worker+0xef/0x600 [ 667.548977][ C0] ? batadv_nc_worker+0xd2/0x600 [ 667.548993][ C0] ? process_scheduled_works+0x975/0x1600 [ 667.549013][ C0] process_scheduled_works+0xa60/0x1600 [ 667.549040][ C0] ? worker_attach_to_pool+0x370/0x370 [ 667.549059][ C0] ? assign_work+0x3cc/0x5d0 [ 667.549078][ C0] worker_thread+0xa5e/0xfe0 [ 667.549104][ C0] kthread+0x2fa/0x390 [ 667.549117][ C0] ? pr_cont_work+0x550/0x550 [ 667.549133][ C0] ? kthread_blkcg+0xd0/0xd0 [ 667.549147][ C0] ret_from_fork+0x48/0x80 [ 667.549163][ C0] ? kthread_blkcg+0xd0/0xd0 [ 667.549177][ C0] ret_from_fork_asm+0x11/0x20 [ 667.549200][ C0] [ 667.556997][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 667.816949][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 667.824151][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 667.834211][ T29] Call Trace: [ 667.837493][ T29] [ 667.840460][ T29] dump_stack_lvl+0x18c/0x250 [ 667.845146][ T29] ? show_regs_print_info+0x20/0x20 [ 667.850431][ T29] ? load_image+0x420/0x420 [ 667.854943][ T29] panic+0x2ca/0x720 [ 667.858869][ T29] ? bpf_jit_dump+0xd0/0xd0 [ 667.863409][ T29] ? __irq_work_queue_local+0x13a/0x3b0 [ 667.868965][ T29] ? preempt_schedule_thunk+0x1a/0x30 [ 667.874347][ T29] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 667.880507][ T29] watchdog+0xf98/0xfa0 [ 667.884666][ T29] ? watchdog+0x1e1/0xfa0 [ 667.888999][ T29] kthread+0x2fa/0x390 [ 667.893065][ T29] ? hungtask_pm_notify+0x50/0x50 [ 667.898091][ T29] ? kthread_blkcg+0xd0/0xd0 [ 667.902679][ T29] ret_from_fork+0x48/0x80 [ 667.907095][ T29] ? kthread_blkcg+0xd0/0xd0 [ 667.911694][ T29] ret_from_fork_asm+0x11/0x20 [ 667.916472][ T29] [ 667.919634][ T29] Kernel Offset: disabled [ 667.924039][ T29] Rebooting in 86400 seconds..